Beyond Harvest Now, Decrypt Later: Your Post-Quantum Game Plan, with Konstantinos Karagiannis

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:00:00)
So now we're in terrifying territory when it comes to cracking RSA, because if you look at the timelines from vendors, quantum computers are going to have this many qubits before 2030. My view is, if Bitcoin is... if one coin is moved, one of Satoshi's coins is moved, I think the whole crypto economy falls overnight. In the history of information security, we've never known a zero day is coming.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:00:21)
So why aren't we doing something about it? It's such a beautiful luxury we have. We're never going to have this luxury again. We're never going to know a specific thing is going to be vulnerable again. I just don't see it happening.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:00:31)
But this time, we do know.

(Joel Beasley at 00:00:39)
I wanted to give a special thank you to Nord Security for sponsoring today's episode. And Nord has been kind enough to give us a discount link for their newest product, NordLayer Browser, that we have put in the show notes below. If you don't know, NordLayer Browser gives IT control over browser sessions so that work data stays protected where the work actually happens. Well, I want to start with the title. So the intended title was "Harvest Now, Forge Later," and then there were several topics of the conversation about "Harvest Now, Decrypt Later."

(Joel Beasley at 00:01:09)
So I thought my producer made a mistake calling it "Harvest Now, Forge Later." And then I read through and found out more. Explain to me "Decrypt Later," "Forge Later," and how that came about.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:01:21)
And is this now actually the podcast?

(Joel Beasley at 00:01:23)
Yeah, yeah.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:01:25)
This is it. This is being you.

(Joel Beasley at 00:01:26)
It's like we're having coffee. I've just got questions.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:01:30)
All right. Yeah. No, I love a good rolling start like that. Yeah.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:01:33)
So "Harvest Now, Forge Later," I'm kind of partial to the phrase because a guy I just love invented it. Anyway, I came up with it because I wanted to differentiate between the attacks that people thought were going to come with quantum computers and what would actually be the most devastating. So we have "Harvest Now, Decrypt Later," and we'll talk about that later. But "Harvest Now, Forge Later" is the idea that once a quantum computer appears, they'll be able to gather publicly available information related to signatures, and then they'll be able to derive the private key from that publicly available information.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:02:11)
That's how public key cryptography works. It's designed to have a public component, something that's shared for the world, and quantum computers will be able to then, as I said, derive and cause a forgery. So that's way more devastating, and I have lots of examples I could give about why it's more devastating than just reading a message.

(Joel Beasley at 00:02:31)
Yeah, well, because you can instantly assume the identity of almost anyone.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:02:35)
Yeah, anyone or anything.

(Joel Beasley at 00:02:37)
Anything.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:02:38)
Yeah. Think about how awful that is, right? So if you read someone's message, you have that one message. You know?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:02:45)
You have that one ephemeral bit of data. You have something that just passed through at some moment and might still be valid, might not be, you know? If you captured a message from the NSA, it might be like, "Meet me at the drop."

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:02:57)
It's like, well, where's that? I don't know. And this was five years ago. You know what I mean?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:03:02)
Whereas with a forgery attack, you can become something like, let's say, a validly signed piece of software. And if you're a validly signed piece of software, all the network intelligence and your SIEM and your endpoint security, they're all just going to see it as, "Hey, Microsoft dropped a new update," and let's push it to all the machines that are using our local cache server or whatever. And then it'll just chug along happily.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:03:29)
And in reality, it's a backdoor. It'll take a while. Maybe network intelligence would be able to figure out that packets are going some weird way, but for at least a little while, that maliciously signed piece of code will run unhindered.

(Joel Beasley at 00:03:43)
What are people doing about this?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:03:46)
Sadly, not enough. Everyone I talk to is fixated on "Harvest Now, Decrypt Later." And just to be clear, I have to say this upfront: I'm not saying it's not a threat. I'm not saying, you know, don't worry about "Harvest Now, Decrypt Later."

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:03:58)
I'm not saying that. I'm just saying it's the least likely attack for the first couple of years after Q-Day. So everyone's just prioritizing that. If you read any of the literature, if you go to any of the sales materials related to post-quantum cryptography, you'll just see "Harvest Now, Decrypt Later, Harvest Now, Decrypt Later." Your data's already gathered.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:04:16)
The reality is, yes, a lot of data is already gathered. We know this. We have evidence that China, for example, has been tapping fiber optic lines and gathering information for years. We know this. It's validated.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:04:28)
Through the Snowden leaks, we know that the US has been doing similar things, right? We know all these things. But when you end up with terabytes of data that are stored, eventually, you have to decrypt them. And when you decrypt them, it could take days to just decrypt one key.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:04:47)
So let's say year one, China or whatever nation state gets a quantum computer and they're able to run it for five days, let's say, and decrypt a key, they just read one communication stream. They can do that 73 times a year. Okay. How long is it going to take them to get through terabytes of messages? I mean, the mathematical likelihood is that for the first several years, almost relatively zero packets will be decrypted.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:05:15)
That's just the reality. So I just don't view that as a pressing threat. Now, in cryptography, when something's broken, it's broken. So it's important to protect against this. But ultimately, it's just not what people are going to be attacking.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:05:31)
They're going to be attacking signatures first. So when you try to look at what companies are actually doing with the problem, they're very much focused on their perimeter traffic right now, you know? I can't say who, but there are certain, let's say, banks and things that are about 60%, 70% there on their perimeter traffic with at least post-quantum cryptography.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:05:53)
Cloudflare, the very popular provider, they claim more than half of their human traffic—you know, people on a browser—is protected by post-quantum cryptography, including DNS now they've implemented. That's all great, but again, that's traffic, you know?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:06:11)
And I just don't think traffic is going to be the first attack.

(Joel Beasley at 00:06:14)
You mentioned Q-Day a couple times. What is this day?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:06:17)
Sure. So Q-Day is a day that a cryptographically relevant quantum computer can crack, let's say, RSA or ECC or Diffie-Hellman, one of the types of public key cryptography that are in use. Most people think of it as a day that RSA falls, but I don't think we should think of it that way. I think we should think of it as the day that any one of those fall. And I specify that because it's starting to look like one of them might fall sooner, and we can get to that. But in general, it's the day a quantum computer can do that, can derive the private key and execute one of these attacks. And we used to think about a long time till Q-Day. I mean, if you want a real short history lesson—

(Joel Beasley at 00:06:45)
Mm-hmm.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:06:45)
In where all these problems came from, Peter Shor in 1994 wrote an algorithm, Shor's algorithm.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:07:05)
And in it, he showed that by doing a mathematical technique called modular exponentiation, it should be possible for a quantum computer with what he thought were about 6,000 error-corrected qubits should be able to factor large numbers, which is what we rely on for security. Fast forward to about 2012, and researchers thought, "Well, it would actually be more like a billion qubits." So once that number started floating around, people were like, "Oh, we've got 30 years, 40 years. We don't have to worry about this." And I was just starting to get involved in the scene, and I was working on quantum key distribution.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:07:41)
And I was telling everyone, "No, I don't think that's quite right. I don't think a billion is the number." I just... it just didn't seem right to me.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:07:47)
And, of course, most people didn't want to listen to me because that would mean panic stuff. So they basically put it off. But we did eventually get to the point where we started to see compressions of this. In 2019, Gidney and Ekerå showed that 20 million qubits was more like the number. In 2025, Gidney alone showed 900,000 qubits as the number.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:08:11)
And just last year, we got that number down to around 100,000 qubits. So now we're in terrifying territory when it comes to cracking RSA, because if you look at the timelines from vendors, quantum computers are going to have this many qubits before 2030. It's very likely, which means Q-Day could be 2029, 2030, depends.

(Joel Beasley at 00:08:32)
Because we're like 6,000 right now, right? Something in that neighborhood?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:08:35)
Well, we have thousands now. They're not error-corrected, but these approaches don't quite require it. It gets a little complex. The approaches themselves call for certain types of error correction and certain types of connectivity and all that. So to keep it simple, the idea is that if you were to just draw a line on how the number of required qubits are plummeting and then you draw a line of how the available qubits are rising, they're going to crisscross.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:08:59)
And when they crisscross, Q-Day arrives. And most people think of RSA, as I mentioned. So that might be 2029, let's say, with IonQ. They're claiming to have around 200,000 trapped ions by the end of 2029. And, give or take, if you use something called the Pinnacle architecture, you should be able to crack RSA possibly with that many.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:09:19)
But they also, IonQ, put out their own paper showing that with 19,000 trapped ions, they can crack ECC, and that might be as soon as 2028. And ECC is what protects Bitcoin, Ethereum, you know, most blockchain. It protects many edge devices. And in general, we can consider that Q-Day too. So it might come even sooner.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:09:43)
So I'm trying to get people started because companies... there's a lot of companies that haven't done anything yet. It's just the sad reality. And we need them to at least start by getting an inventory and starting to begin the migration to post-quantum cryptography.

(Joel Beasley at 00:09:59)
Is ECC ever a... I'm familiar with RSA being a software engineer, but is ECC ever a substitute for RSA?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:10:07)
Sure, yeah. For, depending on the types... yeah.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:10:09)
See, the thing about ECC is instead of the two large factors, right, you plot a point on a set elliptic curve. So you specify one for specific things. And you plot that point, and then you do multiplications or doublings or triplings of it around to another point. And then you end up with different points that can be your substitutes for knowing two prime numbers, let's say. And as a result, a very small bit of data can equal the same amount of key strength as RSA.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:10:40)
You know? So that's why ECC is great for edge devices and other types of technology and for blockchain, because you don't want gigantic anything on a blockchain. You want it to be really, really small. And as a result, there is no RSA at all in blockchain. It's purely ECC. And what happens there is blockchain technology specifically is very performance-hindered. You don't want to have gigantic key sizes. And, unfortunately, if you look at the standards that NIST published for post-quantum cryptography, they're large. You're going from, you know, 60, 80 bytes to something like 2,000 bytes or whatever.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:11:23)
That's mass amounts, orders of magnitude larger. So what you end up with when you get into the 2,400 range or so is you're going to have fewer bits of information that you could cram into each block, and then it'll slow down performance. And no one's really ready for that. And it's not such an easy engineering problem to solve.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:11:46)
And I've been talking to Bitcoin developers for over 10 years about this, and I just haven't seen any movement. They always kind of treat it as like, "Well, we don't have this quantum computer, you know?" And I'm not going to call anyone out by name, but that's been sort of the approach. It's like, "Well, we don't have this machine."

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:12:02)
So what, you know? And it's like, "Well, yeah, but do you understand the reengineering that has to be done to implement a different kind of cryptography to something that's built on ECC?"

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:12:10)
It's very difficult. Vitalik always understood this, the founder of Ethereum. And Ethereum has a plan for, by 2029, working on all the layers of the Ethereum machine. And Ethereum uses more ECC than Bitcoin.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:12:25) It has things like BLS signatures that allow proof of stake. It has these other elements that require elliptic curves as well. And fixing each of those is going to be complicated, but at least they're working on it and they have a deadline.

(Joel Beasley at 00:12:39) I don't have the exact article to reference or anything like that, but I thought that there was a quantum safe Bitcoin without even a hard fork?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:12:54) There's other blockchains that are quantum safe, but Bitcoin is absolutely not. There was a company... There's a company called BTQ. They did a test net of one of the BIP, or Bitcoin Improvement Protocols, BIP 360. And they basically rebuilt it with that in mind to show that it can be done. And I had Chris Tam from that come on my podcast, The Post-Quantum World, and he told me he thinks that for Bitcoin to implement something similar to the actual blockchain would take about seven years. That was his guesstimate. Oof.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:13:26) We don't have seven years. We don't have seven years, right? But still, like, when I look at Vitalik and Ethereum, I love that they're pushing Ethereum. I love it. And I have... My heart does belong in some ways to Ethereum. I was the first to attack, to hack smart contracts and talk about it at Defcon years ago. So I've always been sort of involved in the cryptography behind that. But it won't matter. My view is, like, if Bitcoin is, you know, if one coin has moved, one of Satoshi's coins has moved, I think the whole crypto economy falls overnight. I just don't think people have a stomach for it. You know what I mean? Like, whenever I do... I say show of hands, you know, to the audience or whatever. Like, if you found out that one of the coins moved on the blockchain, would you ever buy Bitcoin again? And no one's hand goes up. You know, whether they understand the intricacies or not, or hey, now it's different, they don't care. And I'm afraid that that's what's going to happen.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:14:15) It's too sentiment based, and people will just... The whole crypto economy could collapse. So I view that as a potential chaos attack. Right? Like, when... Think about it. China could divest all their Bitcoin and then attack Bitcoin. That could be their first zero-day attack if they want. So it's scary. And I almost saw that. Like, recently, Vitalik wrote a blog where he talked about Ethereum becoming like a cryptographic computer. He was... It almost feels like... I'm not going to put words in his mouth, but it almost feels like he's trying to distance Ethereum from just being a blockchain. Like, you know, I'm... Again, I'm not saying what his motives are. I just feel like there might be this sentiment shift that Ethereum has to distance itself a little bit because we all know Bitcoin just... I don't see it getting there. I don't see it.

(Joel Beasley at 00:15:00) Have you ever talked with, like, Peter Schiff or any of the big pro or anti-Bitcoin people about this specific concept?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:15:10) I've talked to people. I'm not going to say who, and I'm not going to say what they're going to say.

(Joel Beasley at 00:15:13) Like, on your podcast, but...

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:15:15) My podcast... Yeah. Chris Tam came on. I would like to have some more people come on, including some of the folks that have worked on the BIP protocols for, you know, to improve. This is just not a situation we can leave as is right now. It's just really bad. We have to find a way that... I don't know. You know, I can't give investment advice, but like, I have a hard time saying go buy Bitcoin. I just do. I mean, you know, if we're just talking pure technical, which is what I do 90% of the time. Yeah. Like, technically, it's just such a risk.

(Joel Beasley at 00:15:50) Yeah. It's weird, like, that Mara isn't talking to you or BlackRock or Fidelity. Like, these people that either have massive Bitcoin funds or have just massive investments in the space. You know?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:16:02) I mean, I do talk to... I do, like, private lectures for companies. Oh, you do? I go in and I speak to their teams and everything. I'm doing one this week. I can't say where, but I'm doing one. Yeah. And yes, the blockchain question comes up so fast. You know? I don't even get to the slide. I'm like, oh, it's the next slide. Yeah. You know? Like, they just...

(Joel Beasley at 00:16:19) It's where their money is.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:16:24) Yeah. They're like, and what do I do about all my Bitcoin? You know? It comes up. So I mean, I talk a lot about this. And, you know, I have a book coming in the spring, Post-Quantum Panic. And...

(Joel Beasley at 00:16:36) That sounds good. Sounds helpful.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:16:37) Oh, yeah. Yeah. It's really that bad. And I sent you guys a cover. So if you want to be the first to show it to the world, you can, like, pop it up on the screen. It's right here. No. I don't know.

(Joel Beasley at 00:16:47) No. David can do that in post.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:16:48) There you go. Yeah.

(Joel Beasley at 00:16:49) Give that face up.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:16:52) There's the book. It's right there. Yeah. Yeah. And in it... Yeah. It comes out World Quantum Day, actually, which is funny, in April. And in it, I go into the Bitcoin problem. I go into just all the problems and especially the forgery one that I mentioned because I don't think people realize that that's the big issue. You know, that... That's what's going to be really devastating on the first day. If you run a quantum computer for five days and you take over an entire organization, that's insane. You know, that's way better than reading one executive's email.

(Joel Beasley at 00:17:22) Well, you gave me a new perspective because let's just talk about... For a second, we kind of glossed over it, but you're like, 73 keys per year that they could... That's so slow. You don't even know what you're decrypting when you're decrypting it. Right? So, for example, like, when I hear harvest now, decrypt later, now I am not a security expert. I want to put that out there. I'm 20 years as a software engineer building scalable business platforms, but writing the code to do so. So I have, like, enough security understanding to do that, but I'm not... I never went deep into security. But my thoughts were when I saw the harvest now, decrypt later, I was like, oh, they can decrypt the transfer of my machines talking to each other. Right? And then you get the RSA keys. Right? Public and private key and now you have both and you have this conversation. But I never thought about the fact that the day it comes out, the speed at which you could decrypt. For some reason in my mind, just so you know where I'm coming from, I imagined it was infinitely fast. Yes. The day it comes out. But you've given me this new perspective like, no, no, no. They'll be able to decrypt one thing and no one's going to raise their hand. The beauty of this attack is going to be how long can we keep it quiet.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:18:37) Yes. Alan Turing, you know, Enigma is a perfect example and it's a really deep example too. Yes. They're going to be quiet. And because it takes so long, like, no one's going to realize that that's not the vector. And I don't know where it happened initially, just to answer your thing about the instantaneous first. Somehow the press got that in their mind years ago and just like it would be an instant light switch. And that's the reason that harvest now, decrypt later became the only discussion. It's like, no. No. No. No. The minute it's available, everything we... Everything you ever sent is readable instantly. You know? And it's just not true. It's not what's going to happen. So when Alan Turing cracked Enigma, he obviously didn't tell the Nazis, hey, guys, I can hear everything you're saying. You know? It's really funny. I love reading it. No. He didn't do that. And then even in the movie, they dramatize it as if, like, Alan Turing's practically, like, controlling life or death or something in The Imitation Game, and that's not the case. I mean, he handed over the information to, like, you know, the army and they took care of it over there in the UK. But the reality is that they went out of their way to hide it. They created these, like, false flag operations. They put out messages that said, oh, I think we saw a plane overhead. We're going to go a different way. Like, they made up all these BS reasons for why ships were going around U-boats. You know? They did everything in their power to not, like, get anyone killed without announcing it. I don't know if anyone actually died because of these... You know? I'm not sure it's... War is a little messy and tricky to narrow down like that, but that's how it really went. Now imagine if Alan Turing could do one step more. Instead of, like, just reading some messages that the Nazis were sending, imagine if he can, like, forge his own and send it, what he could do. Like, hey, U-boat X-13. I want you to be in this lake at this time. And then all of a sudden, you change the whole outcome of the war even quicker. You know, because you have boats going in the wrong direction and, like, what's going on? I mean, eventually some would catch on, but that's the power of forgery, right? So it will be kept secret at all costs. It'll be forgery attacks, just very hush-hush. There might be some signs.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:20:35) Around the time we think a machine comes online, if there is a mass situation where they detect malware that somehow had a validly signed key, I think the quantum alarm bells will ring. If a Bitcoin moves, the alarm bells will ring. You know, there'll be certain things that are like canaries in the coal mine, stuff we can look for. But if they're clever, it might be hundreds of days. I mean, it's about 240 days or so, whatever the number is that an APT, advanced persistent threat, can live on a network undetected. So I think it'll be even worse because we're not just talking about quantum computing. We're talking about frontier AI, hacking models that will enable these attacks. You know? They're going to be able to intelligently figure out what to go after, what key to attack, what possible exploits also in the OS that you can do extra things with. You know? I can view these, like, piggyback sort of attacks as being very likely. So that's what I predict.

(Joel Beasley at 00:21:31) Is there... So you've mentioned a couple times about one of Satoshi's coins moving. I don't know everything about Bitcoin, but at some point in time, did he say that he would not ever move a coin?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:21:44) No. It's just more like the great mystery. You know, where is he? Who is he? Yeah. What's the reason they're just sitting there? You know? And because it's been so long, if one moves, it's just become, you know, holy canon in the blockchain world.

(Joel Beasley at 00:21:58) Has it?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:21:58) If one moves, it's a quantum computer. That's all it could be, baby. It can't be anything else. Like, that's what's happened. It's become this, like, law. And it is the number one canary for sure. And the vulnerability applies to more coins than that. Like, he has 1,100,000. There's, like, 1,700,000 that are affected from other address reuse. There's, like, 6,900,000 in total that for various reasons have had their addresses revealed. And that's one type of attack. And that type of attack could be done completely silently. Right? You could download the blockchain, go through, find an address that's vulnerable, reverse the private key, get the money. But you better spend it quick because it won't be worth anything.

(Joel Beasley at 00:22:38) Exactly. Yeah. Yeah. You gotta spend it quick. If I have this computer today, the last thing I'm doing is moving one of Satoshi's things.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:22:45) Unless you want to cause chaos, unless that's your entire... Exactly. Your... Exactly. It might be, yeah, financial devastation.

(Joel Beasley at 00:22:52) Well, step one is to enrich myself. Then once we have that, I will do chaos.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:22:56) Yeah. You gotta hurry because, again, like, I don't know how long it'll take. And then in reality, almost every Bitcoin is vulnerable because when you try to spend it, it goes in something called the mempool. You... Hey.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:23:07) I'm doing a transaction, and for around ten minutes on average, it could be less or more, for around ten minutes it sits there and lives. And if someone were to capture that and reverse it with a quantum computer or derive the private key, they can put their own transaction, pay a higher transaction fee, and according to Google Research, have around a 41% chance of spending the money first, which would mean you would be accused of double spend. You know?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:23:33) And you'd be like, what happened? I'm being accused of double spend. It's my money. You know?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:23:36) So that could happen, and that would also be a canary. And you'll notice I said within ten minutes, right? And I just told you before that it takes five days to crack an RSA key.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:23:45) Well, Google showed a technique where ECC can fall with around 500,000 qubits—yeah, a lot of qubits—within around nine minutes. So that nine-minute attack is a key number because it's less than the ten-minute average of a transaction in mempool. But it doesn't have to be that fast attack. It could be way fewer qubits, like 26,000 neutral atom qubits running for a week or ten days, whatever it is, and just gathering those private keys, like I said, offline. So no one sees scanning.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:24:14) No one sees anything. You just download the blockchain. Anyone's allowed to download the blockchain. That's the whole point. It's supposed to be auditable.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:24:19) It's a ledger. You know? So that attack is the quiet one, the one that will probably be easier to pull off.

(Joel Beasley at 00:24:26) That's wild. There's not zero incentive to do this. There is massive financial incentive to figure this out.

(Joel Beasley at 00:24:35) There's your startup funding as a quantum computing company. We're going to crack the blockchain.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:24:41) Yeah. Oh, yeah.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:24:42) I get weird requests because both, because I did the hacking smart contracts for Defcon years ago and all my PQC work, I get the strangest messages on X. Oh my god. They're like, "Hey, Constantinos. Can you help me? I lost my private keys. I swear it's my wallet." And all this long story. It's like, I think you're protesting too much. It sounds like they're definitely not your keys.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:25:07) But I mean, I obviously wouldn't. I don't have the physical capability of doing it yet. No one does, thankfully. But it's coming.

(Joel Beasley at 00:25:15) I will tell you about this. This prince in another country messaged me.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:25:20) Yeah. Absolutely. Yeah. I think he messages me all the time. He gets scared to be.

(Joel Beasley at 00:25:26) Very, very popular.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:25:27) Yeah. Yeah.

(Joel Beasley at 00:25:28) In the prep document, there's something about walking us through an example of forging a signed audio driver to hit NSA laptops. Is this something you did?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:25:38) Well, no. Because again, I would have to have a cryptographically relevant quantum computer. But I use it as an example in the book that's coming. And the reason I use it is because, you know, just to show that such a simple, silly piece of code, you know, that everyone relies on, can easily be the first zero day on Q-Day. So it could go something like this.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:26:00) You know, that morning a validly signed audio driver will push out to multiple laptops in an organization, possibly a government organization. It'll show all lights are green, right, because it's validly signed from a reverse key that took five days, let's say, to run. And once it's installed, it'll operate like an audio driver, but it'll just have a little lagniappe, as they say in New Orleans, a little something extra. And that something extra could be a boot kit, and a boot kit could then install a root kit into the ring zero of your motherboard, which means that if you detect the attack one day and try and reinstall Windows on all your machines and you think you're golden, no. They're all still infected.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:26:43) So what would happen is you'd have an attack that would completely make it impossible to trust your system of trust that's built into your organization. You won't be able to trust your PKI. You won't be able to trust anything. Like, you'll have this gigantic mess on your hands.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:26:59) So I live in Manhattan. And in Downtown Manhattan, there's a building called One Seaport, and it's sort of like a cautionary tale. They were building this thing, and they decided they went deep enough. So to save a few million dollars, they didn't go quite deep enough into the foundation, and they started building. Well, halfway through construction, it became a little bit of like a leaning tower of Seaport, like, about three inches.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:27:25) Now there's this big mess where it costs too much to fix it and too much to take it down, so it's in limbo. And every time I walk by this skeleton, which quite frankly, I think somewhere to take that down, I don't know, man. It's like, I just feel like it's coming down. When I walk by it, I think of organizations the same way.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:27:42) They're, you know, if they get hit by this Q-Day attack, the type I'm envisioning with forgery, what do you do? You know, it's going to cost so much. Like, you don't know how deep it went, and it's just not going to be something we've seen before. Like, in security, there's something called the zero day. And the zero day is an attack we didn't see coming.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:28:00) Right? We've had these before. And then we've had something like Y2K where everyone was building towards this deadline. Well, Q-Day is like if those two had a baby. You know?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:28:09) You've got, like, this date that we know is coming sorta, and we know it's going to be a zero day. We've never known this before, though. In the history of information security, we've never known a zero day is coming. So why aren't we doing something about it?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:28:21) It's such a beautiful, like, luxury we have. We're never going to have this luxury again. We're never going to know a specific thing is going to be vulnerable again. I just don't see it happening. But this time we do know, and we can make sure that we're not that leaning tower, you know, that we don't get in that situation.

(Joel Beasley at 00:28:36) Well, we count our blessings. At least there's no super advanced intelligence emerging right now that'll help us do this stuff faster.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:28:42) Yeah. Yeah. Quantum and AI, I mean, it's a very misunderstood thing. Like, you'll hear about it on...

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:28:49) Let's say there's another podcaster with a very similar haircut to mine, and he talks about quantum all the time, and he usually gets it wrong. And then people email me like, "Joe Rogan said this. Joe Rogan said that." It's like, I'm not Joe Rogan, so I don't—I mean, I'll explain to him.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:29:01) You know? So I would love to chat with him one day. But yeah, so we have to realize that quantum and AI, though, is a thing. You know?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:29:10) And it goes two ways. There's quantum for AI, this idea that quantum computers are making AI work better. They're making it more efficient at power maybe, or better training data generated by a quantum computer.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:29:22) Great. And the other way is AI for quantum. AI helps the entire stack. You're a developer. You know, it's a stack.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:29:28) Right? Quantum is all classical until you get to the quantum computer. So AI is helping optimize every step of the way down. So they're already holding hands and helping each other.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:29:37) But I'm worried about when it's frontier AI saying, "Hey. I know I'd hack this thing. Hey, buddy, crack this key for me. Thank you, Mr. Quantum Computer, and now let's go."

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:29:46) You know? Like, that's what I'm worried about. Like, that's where I think we're headed.

(Joel Beasley at 00:29:51) I don't think you have to be worried. We'll get there.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:29:52) Oh, yeah. Yeah. And we'll get there with local AI too, I believe. Yeah. Like, you know, some of these local models, if you post-train them and, you know, you do some other creative stuff, you can get really serious horsepower to run on, like, you know, a Mac Mini.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:30:08) I mean, you just could. You throw out everything else. You don't want it to be good at writing sonnets or whatever. Like, you just want it to be able to do the thing. Right?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:30:16) So I've seen some devastating power on these local models. And imagine where they'll be in a couple years when we have the quantum computer to go with them.

(Joel Beasley at 00:30:24) Well, yeah, I actually, perfect timing, about two weeks ago I stumbled into this local LLM training type group on Facebook. It's all these home hackers that are, you know, not black hat, just hackers in the sense of putting stuff together themselves. And what they're able to do and the efficiencies they're able to get out of these things was just blowing my mind. Because I'm at the point in my career where nothing I'm doing is so intensive that I need to bring it locally.

(Joel Beasley at 00:30:52) Yes, I love privacy. So there's that driver of bringing it locally. But I haven't actually made the decision to build my own fully functional setup because I'm just API-ing all the different tools I want together currently. So I hadn't spent much time in this little community. And over the past two weeks, I have, and it's just blown my mind, the ingenuity and the creativity they have when they have such limited budgets, but they have access to the technology.

(Joel Beasley at 00:31:19) They're doing amazing things.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:31:21) Yeah. And that's local. And, of course, yeah, the API stuff is off the charts. I used to joke that I'm an Opus-level hacker who likes having access to Haiku, and then Opus 4.5 came out, and I'm like, now I can't make that joke anymore. Now I'm like a Sonnet-level hacker.

(Joel Beasley at 00:31:39) Is anybody predicting, like, putting a day count on Q-Day? Are they saying, like, "Hey, we think it's thirty days out, ninety to a hundred and sixty?" Whatever.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:31:47) For quite a while, I've been saying 2029. And recently, the big players have been agreeing with me. You know?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:31:54) Last year, they started to come on board. Like, we started to see Microsoft say, "Hey, we're pushing everything, our core services by 2029." Google said the same thing. Cloudflare said the same thing.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:32:04) All of a sudden, everyone came up with 2029 as being the thing. I was basing it on extrapolations of the plummeting qubit counts required and the increasing timeline.

(Joel Beasley at 00:32:15) So just basic logic.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:32:16) Yeah. Yeah. Oh, yeah. Yeah. Pretty much.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:32:18) I mean, I wasn't, like, you know, just looking at a crystal ball or anything. Like, I was trying, you know, I was trying to base it on math. That's just kind of how I operate.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:32:26) So now everyone's starting to realize that 2029 is very likely. And the problem is when the standards came out from NIST in August 2024, they came with this assumption based on NSM-10, which was a Biden-era White House memorandum. And it said that once the standards come out, you got about ten years if you're a government agency to migrate. So the whole NIST approach was cool, you have till 2030 for deprecation and 2035 for true disallow.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:32:54) That is not good. That is way too slow. That means you can have RSA, ECC, all that running until 2034, the end of the year. You know? Like, that's not good.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:33:06) So Trump in June, he signed two executive orders. Executive Order 14413 was about, "Hey, the U.S. has to be first in quantum. We're going to build a machine." That's powerful.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:33:16) Great. 14412 is the one more interesting for what we're talking about. It said that high-value assets in the government need to be migrated for key encapsulation by the end of 2030 and for signatures by the end of 2031. So I applaud that. It shows a little more urgency.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:33:35) And, hopefully, if people start to copy that, that's great. But the problem is I think it's backwards. I wish we did signatures 2030 and key encapsulation 2031 because I'm telling you, signatures are going to be the first attack. That's a hill I am willing to die on.

(Joel Beasley at 00:33:51) Are you on any boards with him or the government?

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:33:55) With Trump? Oh, no. Definitely not. I wish. I would love to have a chat with him about this.

(Andersen Cheng (or a quantum security/cryptography expert - likely the guest being interviewed) at 00:34:00) Yeah. I've spoken to different people, but definitely haven't had the chance to influence at the higher level. But if anyone in the executive branch is listening, feel free. I would love to have a chat about how we might want to adjust these timelines a little bit because this is a severe risk.

(Konstantinos Karagiannis at 00:34:18) And if a nation state wanted to attack us, they will be going after that. They will be going after the knowledge that our signatures might not be where they should be until the end of 2031. It's not a great place to be. Now, it's not easy.

(Konstantinos Karagiannis at 00:34:33) I'm not gonna pretend that signature is an easy thing. It's not that we could push a button tomorrow. You know? There's this whole thing of crypto agility, and cryptography, unfortunately, was never built into information technology. It sounds like I just made up complete nonsense there.

(Konstantinos Karagiannis at 00:34:46) No. What I mean is it was never the core thing. Like, we slowly got into networking and understanding it, and we started layering things on. But if you think about it from the very beginning, the Internet was never built to be secure. Right?

(Konstantinos Karagiannis at 00:34:57) It was all the same thing. It was like in the old phone freaking days. You know, you would pick up the phone and you'd play some tone or you'd do something, and you would fool the payphone into thinking you paid. Right? Because the authentication and communication are going with the same line, and that's the way it always was, and the Internet was like that.

(Konstantinos Karagiannis at 00:35:13) And then we just sort of started hanging on the Christmas tree of an organization. We started hanging cryptography in little glass pieces. And those ornaments fall and they break and we can't keep track of them, and that's what cryptography is. There's no push button where you say update it. You know, you can update your OS.

(Konstantinos Karagiannis at 00:35:29) You can update your whatever, but you can't just say find all my cryptography and update it. And that's why we're in the mess we're in. So trying to get people to migrate to post-quantum cryptography is really trying to get them to become crypto agile and then migrate to post-quantum cryptography. And then the hope is that if in the future, one of these new math ciphers is found to be insecure, we don't have to panic. We can just swap it out for another post-quantum cryptography cipher.

(Konstantinos Karagiannis at 00:35:55) Right? We can go from ML-KEM, which is lattice-based, to Classic McEliece or to HQC, which is code-based and is actually being selected specifically as a backup just in case something goes wrong. So that'll be coming out in about a year. So the idea is that we have to get agile first, you know, and then be able to do this push button. So I would love for that to be a thing, you know, throughout the government.

(Konstantinos Karagiannis at 00:36:19) I know they're working on it. I'm not saying they're not. I just think that the signature problem is so serious that we need to accelerate it. I just don't think...

(Joel Beasley at 00:36:28) So, obviously, Trump's not sitting around coming up with this stuff himself. He puts together these groups of people and...

(Konstantinos Karagiannis at 00:36:33) Well, yeah. I mean, that's what it is to be president. Right? It'd be suck if any president ever was like, today, I'm gonna solve cryptography. I just don't believe it.

(Konstantinos Karagiannis at 00:36:42) Yeah. No. That's insane. But you should apply. These people, I encourage you.

(Joel Beasley at 00:36:45) You should apply. They have these groups. They have these, you know, that get together councils that they'll have. You should get on your real spot.

(Joel Beasley at 00:36:53) I talked to a lot of people. I've been doing this ten years and a thousand episodes. I could tell you, you're like at the top. You should... If you have a desire and drive, I'm looking at you.

(Joel Beasley at 00:37:02) I'm American. I love my country. I'm like, I want you on our team.

(Konstantinos Karagiannis at 00:37:06) That's sweet. Yeah. Well, I love our country too. And, hopefully, when the book comes out, maybe, who knows, maybe someone on Trump's team will read it. Maybe.

(Konstantinos Karagiannis at 00:37:13) It's possible. You know? That might be the thing. I mean, you never know how this stuff starts. Right?

(Konstantinos Karagiannis at 00:37:18) If you go all the way back to Ronald Reagan, he watched War Games, and he turned to Dick Clark, and he was like, hey. Is this possible? And he's like, let me find out, Mr. President. And, yeah, he found out it was. And that sort of began our cybersecurity program, you know, all in one moment.

(Konstantinos Karagiannis at 00:37:32) Because... And I got to be on his podcast actually years ago, and I was in his book too, talking about quantum. But, yeah, like, this is how things happen. So who knows? Maybe this book will end up in the right hands.

(Konstantinos Karagiannis at 00:37:44) I hope so because, yeah, it's an urgent situation. I didn't pick the title lightly.

(Joel Beasley at 00:37:49) Is it already out?

(Konstantinos Karagiannis at 00:37:51) No. I'm sorry. Comes out in April. Yeah.

(Joel Beasley at 00:37:53) Bad question. Uh, rephrasing it. Is it done?

(Konstantinos Karagiannis at 00:37:57) Oh, it's done. Right now, I'm doing edits. Like, they're sending me stuff back and forth, and Wiley's pretty great about that. So, yeah, going through the process. They're gonna let me make some final tweaks, like, really late in the editorial process.

(Konstantinos Karagiannis at 00:38:10) So if some groundbreaking paper comes out, like, February maybe, I'll be able to just call up and be like, okay. We gotta remove this sentence, add this sentence. So hopefully, I'll be able to make it as current as possible. But, yeah, there will be some cutoff. Just like an LLM, there'll be a knowledge cutoff at some point before it goes to the printer in March for an April release.

(Joel Beasley at 00:38:32) Nice. Nice. Well, man, this is brilliant. As we wrap up, what's one thing technology leaders should be focused on? Let's...

(Joel Beasley at 00:38:38) And let's quarantine this advice to, let's say, technical leaders at companies between twenty and two hundred million dollars in revenue. Where should their mind be at?

(Konstantinos Karagiannis at 00:38:51) I think they should... In general, with this problem or any other problem, they should lead by building, not mandating. They should stay very hands-on if possible. You know, when things get very complex, it's not good to have, like, a 30,000 foot view only. It's not good to be down this delegation tree...

(Konstantinos Karagiannis at 00:39:12) Delegation tree where you don't really understand all the pieces. I think it's good to be as hands-on as possible. So that's what I try to do. I try to... I mean, I actually wrote the tool that we use to take technical inventory for our customers and build the CBOM or cryptographic bill of materials because I wanted to stay that close to it.

(Konstantinos Karagiannis at 00:39:31) You know? So I think... I'm not saying every leader should be developing the applications, but they should be keeping a hands-on view and helping to demystify then complex topics for whoever the stakeholders are or maybe customers depending on how it works. Because those little details will get...

(Joel Beasley at 00:39:53) Thank you so much for listening. And if you found this episode useful, please share it with a friend or colleague who you think would get value from it. And if you have topics that you'd like to hear discussed on the podcast, either add me on LinkedIn or send me an email [email protected]. Every time I get an email or LinkedIn message, it absolutely makes my day and inspires me to keep going.