# An introduction to post quantum signature schemes for Ethereum

- Speakers: [Pierre Daix-Moreux](https://streameth.org/speakers/pierre-daix-moreux)
- Channel: [Devcon 7 SEA](https://streameth.org/devcon_7_sea)
- Date: 2024-11-12
- Duration: 09:35
- Watch: https://streameth.org/watch/6732fde980d989c5b7b1f05e

## Description

In this lightning talk, we will give attendees the opportunity to understand the various post-quantum signature schemes proposed to make Ethereum post-quantum ready.

## About the speakers

### Pierre Daix-Moreux

Pierre is an applied cryptography engineer at the Privacy and Scaling Explorations Team


## Transcript

Hi. All right, so a bit of context about why do we need post-quantum signature schemes for Ethereum. So what can quantum computers do? So you can think about it as very good as quantum computers at being very good at exploring large search spaces, which are typically the kind of spaces in which cryptography operates in. So there was a researcher called Peter Shore that proposed one day an algorithm that would solve the discrete log problem very efficiently so the discrete log problem is one of the most fundamental problems in cryptography and he showed a very efficient algorithm that would break this kind of problem very efficiently. And hashing, however, is safe. So quantum computers can make some improvements at it, but we basically consider them to be safe. So it's really about the ECDLP and the things that use the ECDLP and also pairings that will break catastrophically. So what does it mean for Ethereum? And my goal here is just to give you a bit of an intuition of what Ethereum is faced with. So here is a bit what it will look like for Ethereum in terms of constraints. So the consensus layer in Ethereum uses some aggregation scheme, which is BLS signatures. And what we would like to do for Ethereum is basically to keep some aggregation scheme because it makes running a node easy. You don't have too much hardware requirements. So we would like to have an aggregation scheme that does not require too much hardware from the node runners and that will still be post-quantum ready. Same for the execution layer. So we would like to have a post-quantum scheme that lets us keep the account-based model Same for the execution layer. So we would like to have a post-quantum scheme that lets us keep the account-based model that we have on Ethereum and yet minimize the requirements that will be made to wallet teams when we ask them, when Ethereum will ask them to maybe change the signature scheme that they use. So that's the constraint space that we have. We want to avoid to have signature schemes that impose too much of a load on nodes. And also we want some signature schemes that make it possible to have a post-quantum secure execution layer where we can make transactions safely. So what kind of cryptographic objects do we have to do that? What is the toolbox that is at our disposal to do that? So here what we want is we want a cryptography that can run on our everyday computers but can still remain secure against adversaries that have access to quantum computers, basically. And so to do that, we already have some answers. So we have hash functions, as we saw before, which are safe, we can say. We also have lattices. So here, lattices are nice because they are pretty fast when you want to generate signatures, but they generate pretty large ones. And we also have things like isogenies, which help us get small signatures, but are kind of slow. They are getting faster. And they don't have an aggregation scheme yet. But this is some of the cryptography tools that we can use to help make Ethereum post-quantum safe. And so I give some examples here. So there is the module based lattice signature scheme, which is a recent NIST standard, I think. So here you see it uses lattices. You also have the Winternet signatures, which are hash-based. And you can also use some stack-based aggregation technique with a post-quantum resistance signature based, and you can also use some stack-based aggregation technique with a post-quantum resistance signature scheme. And you can see in all of those proposals, it's based on lattices, hashes, isogenies. And you will see those things come again and again and again in the proposals that will be made for helping Ethereum be post-quantum secure. So what's next? So it's pretty hard to predict when a quantum computer is going to come up, and also at what rate it's going to come up. Maybe it's going to come up one day, it's going to pop up, and we are going to be like, oh, wow, okay, now we need to switch, or maybe it's going to come up slowly but surely. Some think that quantum computers are not even physically realizable. Recently, there was a blog post by Scott Aronson where he was saying that basically we'd be very surprised if quantum computers don't come in the next 10 years. And this is probability density, which is pretty fat tail, so I think it's not very useful. It's not very telling something. And there was a proposal by Justin Drake that he was thinking about using quantum canaries. So the idea of making a puzzle that can only be broken by a quantum computer so that if you break it, you get a lot of money but at least we will know that when the puzzle is broken it will be the time to switch to some post-quantum schemes Thank you Thank you Pierre Question time Do you want to throw it? I cannot do it with my foot right? I don't know I guess you can It's soft enough Do you want to throw it? So I cannot do it with my foot, right? I cannot. I don't know. I guess you can. It's soft enough. Oh, no, no, I can't. OK. Thank you. Pretty good throw. With NIST approving just post-quantum algorithms now for the first time, do you think that the NSA or the governments in general know more already about the state of quantum computers available? I have absolutely no idea. There's no public evidence of anything, right? The Chinese or the US or anyone would have. I would definitely lie on the paranoid side, but I have absolutely no idea. Okay, next question. What makes Lattice so well suited to post-quantum security? I hear them coming up a lot. So it's just that you can think of it as if you try to find the key that you use in your scheme, if use lattices quantum computers are not at all efficient with this so the goal of cryptography in general is to find very very hard problems and to turn those problems into schemes basically and the problems that you have with lattices are very hard and are for which quantum computers are not very good at. So I think it's hard to go into the mathematical details, first because I'm not very familiar with them, but also like in 10 seconds, it's hard to explain in 10 seconds. But basically, you can think of it as a very hard problem, which is still complex for quantum commuters to solve. Yes. Okay, and what challenges is Ethereum currently facing in adopting the post-cronon signature, or what issues may arise in this progress? Oh, that's a good question. So you have changes on the consensus layer. So for the clients that are trying to reach in the proof-of-stake model that we have, you have changes in terms also in the execution layer. So for all the transaction approving logic. So I think there will be engineering challenges. For instance, does that mean that we need to audit everything again? Do we need to make standards again? So yeah, yeah. And also I think it depends off the timeline because if one quantum computer pops up tomorrow, then the challenge to do it would be much more pressing than if we have, like, a much larger timeline to think about. So it would also be an engineering and human problem. Yes, yeah. Okay, that's everything. Thank you, yeah. Okay, that's everything. Thank you, Pierre. Thank you. Our next speaker is Henry. He is the head of ecosystem from StockNet Foundation.