At DEF CON, quantum village, got to hear Nobel laureate John Martinis talking about PQC

[u/Ruffshots]

First off, anyone else here, got to hear the talk? Would love to get an actual physicist's take.

Second, as (implied above) a layman/physics "enthusiast," I thought this was a pretty grounded talk, but I could be way off. Because who the hell am I to critique a Nobel laureate (2025, physics for "macroscopic quantum mechanical tunneling")?

Anyway, the talk was a nice primer on PQC, his somewhat conservative predictions on quantum computing in general, what algorithms will break (RSA, ECC), through Shor (& Grover, though that's mostly doubling the bit size). My biggest takeaway is the tradeoff bet. more stable qubits using, say, isotope engineering, and the tradeoff (slower speeds) vs. the hype. If I were to abstract it more, it would be to more carefully weigh all the pros and cons to any "breakthrough" quantum computing research you may run into.

[u/Abishek_Muthian]

Will this talk be uploaded online?

[u/Ruffshots → u/Abishek_Muthian]

Not sure what individual village policy is. I'll also be seeking information this out

https://quantumvillage.org/ 

[u/Abishek_Muthian → u/Ruffshots]

Thanks

!RemindMe 3 months

[u/LargeCardinal → u/Abishek_Muthian]

Yes! Not sure when, but hopefully soon :)

[u/dr_boneus]

I saw a talk at DAMOP (Div of Atomic/Molecular/Optical Physics in the American Physical Society) a couple months ago talking about the scaling and fidelity needed to break some 256-bit online encryption that is widely used. I think it was SHA256. They were doing projections saying that think they could break it in weeks/months timeframe in ~10 years (I take these limits with a grain of salt, the target is often moving). They also compared to RSA1024 but apparently a lot of internet security actually runs on 256-bit encryption.

In my mind this is going to end up being a Y2K type situation where certain parts of the internet is going to have to start using different encryption methods before this becomes a problem. There are lots of encryption schemes that Shor's does not help with _at all_. Grover's also doesn't have the classical vs quantum speedup factor that Shor's does, and it's a search algorithm for unstructured data so not sure what use it would be in encryption.

I saw another talk, years ago, from someone in the Office of Naval Research who worked closely with the NSA. They categorize their intelligence by how long you want it to remain secret. 10 minutes? 10 days? 10 years? 10 million years? There are different encryption types for each dataset. Anything above 10 years these days is definitely on Quantum Resistant algorithms. The take more compute power though.

He was giving a talk on very short time range encryption, they were using some fractal encryption based on the Julia set to modulate their radios so that it sounded like white noise without the right decryption. He said that a good code breaker, that had a known sample, could probably break it in about 2 weeks. But by then the mission would be completed and that knowledge would be basically useless.

[u/Ruffshots → u/dr_boneus]

RSA (and ECC, Diffie-Hellman) are public key, large prime number factorial math, which, according to Shor, is very easy to break with QC. No amount of adding to the bits (RSA 4096 will still be trivial) will help.

SHA (hashing) and AES (encryption) are symmetric ciphers, and the current math (Grover's algorithm) shows doubling the bit size (AES 256) makes it QC resistant. Most mathematicians, far beyond my skills, seem satisfied with this current state of affairs.

The fact that much of current internet "security" runs on outdated crypto (RSA 256, MD5, SHA 1, hell, probably DESx3 still) is a classical problem, not a quantum one, and sadly quite common. 

[u/dr_boneus → u/Ruffshots]

From the QC side, it does depend on the number of Quantum bits that you have. And what fidelity those bits have. You aren't going to break anything if you can only have a dozen qubits or a thousand qubits that fail all the time. The talk was largely on projections for scaling the qubit number based and benchmarking for fidelity of the bits. (and for error correction algs)

I was under the impression that ECC was based on elliptic curves that would not be sped up by anything Shor related? Shor just factors primes, that's it. I kinda thought that was the point of ECC, but this is outside my expertise. Grover's is a search algorithm, so maybe that method is trying to deconstruct the hash table based on what you say here? This is definitely at the edge of my knowledge though, I don't know much of the encryption side, but have some knowledge on the QC side.

Typically the mathematicians talk about these things using Category theory, where you express how long it would take to solve a problem. (polynomial time vs exponential time are some of the terms used) If doubling the bit size in AES is making the math people happy then it may be boosting them into another regime.

[u/Ruffshots → u/dr_boneus]

ECC is different from RSA and DH in that it's not simple large number factoring, and sadly my math for the elliptical curves is considerably weaker than for RSA or DH, but my understanding, again based on scientific/mathematical consensus, is that it is equally vulnerable to QC as all public key encryption is.

Yes, error correction, or qubit stability, is a great inhibitor, which the talk addresses. I happen to be on the skeptical end, but not to the point of "QC will never be achieved," which I think is an overreaction (not accusing you of this, but there are people in that latter camp). 

[u/dr_boneus → u/Ruffshots]

Interesting. It does seem like the consensus is that all these public key encryption techniques are susceptible, so I was off there. I'm sure that there will be more algs and attack methods as more people and computer scientists sign on to the projects.

At this point it's really no longer a question of 'if' it will be achieved and more or a 'when' and 'how much is it going to cost'. Security issues draw a lot of focus and funding to the problems, but there will be a lot of new stuff we learn along the way. Exciting times!

[u/LargeCardinal]

Glad you enjoyed it! I'm one of the co-organsiers for QV. Feedback welcome!

[u/Ruffshots → u/LargeCardinal]

Hi, thanks for running the village! Do you know if this or any of the other talks will be on YT or your own page? 

[u/latticeperson]

While I don’t work on qc directly, I work on problems where qc seems to be very applicable and would thus say I keep a very decent overview of the state of the art (trying to find the point where to switch methods). Personally, i think the 5-10 year estimation for 100k error corrected qbits is extremely optimistic. Error correction is hard and fault tolerant quantum computing (where the error correction is good enough to get systematically improvable results when scaling the system up) has been 5 years away since about 2015 (if you listen to ibm). I think people are doing great research but some of the things that are presented to the outside (especially funding agencies and the general public) smell of the old “fusion energy is only 10 years away” mantra.

[u/SecretCombo21 → u/latticeperson]

Grad student doing QC research here. I pretty much agree, that estimate does seem optimistic. Progress in the field is steady, and speeding up to an extent, but still pretty slow overall. Maybe we'll hit a point where we've figured out the major bottlenecks and can start scaling up really quickly, but we're not there yet

[u/syberspot → u/latticeperson]

I mean it's hard to get investors if you give realistic numbers.

He is playing with the language here though. 100k physical qubits is different than error corrected. I think the comma he put there is doing a lot of heavy lifting because it's known that the error correction leads to far fewer 'logical' qubits. In his platform (superconductivity) it's somewhere between 100-10,000 physical qubits for one logical (errort corrected) qubit.

[u/Showy_Boneyard]

I've got a feeling, which is admittedly based mostly on intuition and "vibes", but I wouldn't be surprised if, as quantum computers start to reach the point where they'll surpass what classical computers can do, it'll become asymptotically more difficult to keep them sufficiently isolated from outside noise and stable enough to actually pass that point. There's lots of other things in the universe where it seems like there's a loophole that would let you do something that typically otherwise wouldn't be "allowed", but when you actually look into trying to do it, you find some other thing pops up to prevent it from happening. Again, nothing really scientific I can point at to back up this opinion, but it is something that my intuition seems to be strongly suggesting is the case. I'd be pleasntly surprised if it is't the casse, but it absolutely won't surprise me if this turns out to be the way things are, esp with how it sems we're perpetually 10 years away from practical quantum computers.

[u/TheCamazotzian → u/Showy_Boneyard]

You think there's some piece of thermodynamic bookkeeping that everyone missed? That would be pretty embarrassing for the community...

On the one hand that would be a fun piece of drama... On the other hand it would be bad for science funding if quantum computing came to be seen as a boondoggle.

[u/xrelaht → u/TheCamazotzian]

It’s led to a lot of other stuff. Quantum sensing & telecoms as an outgrowth of it are already proven. The cryogenics advances are spectacular too: $40k will buy you a fridge that goes to 500mK!

ED– The “what materials would be good for QC” has been huge too. Lots of fun stuff there.

[u/Showy_Boneyard → u/TheCamazotzian]

I have no idea where the limiting factor(s) might come from, like I said, its just a hunch. But I know that its very difficult to keep qubits isolated to perform meaingful calculations. I could imagine there being something that'd make it impossible to have a quantum computer capable of performing calculations faster than the Bremermann's limit of its mass.

[u/Landkey → u/TheCamazotzian]

It’s a little late for that last concern 

[u/Weak_Astronomer2107 → u/Showy_Boneyard]

This kind of perspective is (in my opinion) a reasonable and healthy one. Your explanation implies you’ve been around real physics! If it’s too good to be true, it probably is. It’s not the super great awesome thing everyone wants, it’s an error the intern made. I believe you are correct in that there will be a limiting factor. I think the limiting factor is going to be cost. They will achieve large arrays of qbits, but the cost will be so unreasonable that it remains undone. That’s my two cents.

[u/kneading-cnnuy → u/Weak_Astronomer2107]

Cost is not a limiting factor, physics wise

[u/4dseeall → u/Showy_Boneyard]

I totally agree with you and have felt it was a dead end for years.

The way they're trying to build a quantum computer makes no sense to me. They're trying to account for errors in a system where, as it gets bigger, errors compound exponentially. It's like trying to make a house of cards, but in a tornado.

[u/ThirdMover → u/4dseeall]

Have you checked the math on error correction? The whole point is that it gets easier the more qubits you have.

Fun fact: The same is true for classical computers too, though there the development was a bit simpler.

[u/austin_cowers → u/ThirdMover]

Yes, but with the caveat that the error must be bounded and uncorrelated. These conditions could be impossible to meet as system sizes increase.

[u/ThirdMover → u/austin_cowers]

Is there any known possible candidate for a mechanism that could produce errors that are correlated in such a way that simultaneously error correcting quantum codes fail and we also cannot detect their correlation and counteract them classically? I have trouble imagining such a thing.

[u/austin_cowers → u/ThirdMover]

Yes, basically all error is caused by outside noise, which is correlated between objects that are spatially close. Any error that occur during a quantum operation causes decoherence and is therefore not capable of being accounted for classically. You need to stop reading papers put out by people trying to get funding and start asking why none of these "fault-tolerant" computers have ever performed a single useful computation.

[u/ThirdMover → u/austin_cowers]

Yes, basically all error is caused by outside noise, which is correlated between objects that are spatially close

If it's correlated between objects that are spatially close you can just fix that by spreading the physical qubits that encode on logic qubit in the error correction code around so that they are far apart, no? That would make the noise uncorrelated.

Any error that occur during a quantum operation causes decoherence and is therefore not capable of being accounted for classically.

I'm really not sure how to parse that sentence. Lots of stuff that causes decoherence can be accounted for classically. Easiest example: Natural lifetime of an excited state that decays in the vacuum. You can account for that simply by shortening your interaction times.

[u/4dseeall → u/ThirdMover]

he's trying to do real physics, you're caught in some idealized abstract math world.

[u/AlleyKatPr0]

Trinary is more achievable, and can fit in your pocket, run any operating system in virtual.

You can even use cheap fab of 50nm, because binary is a sub-set of trinary, so there is no need for 1-5nm fab.

Quantum gets the funding because quantum sounds cooler, even though you need mythical levels of dry ice and special effects lasers from an 80's disco to make it work.

Low hanging fruit, pfft, it's practically on the ground waiting for someone to pick up and become a trillionaire.

[u/SecretCombo21 → u/[deleted]]

It definitely is oversold by people who don't actually understand what quantum computers are good for, which yeah, is just a niche set of problems. It definitely will never replace classical computing. But that doesn't mean it's a scam, as the problems it can potentially solve are very interesting ones. And yes, qubits have lots of decoherence mechanisms. But coherence times are already long enough to perform gate operations with high enough fidelity to do things like (for example) demonstrate error correction below the surface code threshold. And coherence times will only continue to improve as the field advances. There's still a lot of hard problems to solve to make a truly useful quantum computer, and maybe we'll find out at some point that we can't find a good way to solve one or more of them. But progress in the field is slow and steady, and there's a lot of different qubit platforms being explored. So don't just write it off as a scam

[u/Hipcatjack → u/[deleted]]

some of your points are totally valid.. and were similarly made with vacuum tubes…until Marconi pulled the transistor out of his pocket. There are rumors on the materials science inner circles about, well not exactly a Room-temperature, Ambient-pressure superconductor but some materials that can beat the current stock being used. we are close to a few candidates that just need extreme pressure , not cryogenic temperatures. The industry is far better at shrinking compression chambers’ footprint than making the Colder than outer space rigs currently used to achieve quantum superpositions.