如果AI或量子计算机破解了加密货币的密码学，加密货币如何生存

所以我觉得，这就是为什么你会看到像Justin这样的人有这样的反应，但Justin说得很好，我们需要尽量减少未来可能存在的任何理论风险。

So, you know, this is, I think, why you're seeing this reaction from people like Justin, but I think articulated well by Justin, like we need to minimize any kind of possible theoretical risk that might exist in the future.

因此我们需要做哈希，我们需要改变，而且我们现在就要做。

Therefore we need to do hashes, we need to change, and we get that on the, on the right now.

这就是，我觉得，Justin的观点。

That's, that's, I think Justin's perspective.

而且我觉得这里面有很多是很有道理的。

And I think there's, there's a lot of, I mean, that's very valid.

另一方面，Yehuda作为Coinbase的首席密码学家，现在，就在这一秒，他负责着数十亿美元，Coinbase，他的名字就押在上面。

On the flip side, Yehuda is responsible as the cryptographer at Coinbase, you know, the chief cryptographer at Coinbase for billions of dollars right now, at this second, Coinbase, like, it is his name on the line.

所以，你能理解为什么他可能认为，我们不应该抛弃目前唯一被证明有效的东西，然后进入防御模式。

And so, you can understand why he's maybe got the view that, maybe we shouldn't throw away the only thing that we know has worked right now and go into bunker mode.

而且我觉得两边都有道理，对吧？

You know, and I think there's elements of truth to both, right?

然后这就是我觉得Conor想要表达的那个微妙之处。

I mean, and then this is I think the nuance point that Conor's trying to articulate.

一方面，我们确实需要行动，因为量子计算，而且我们需要仔细考虑转向哪里，因为我们不知道AI会带来什么。

It's like, on the one hand, we do need to move for sure because of quantum and we need to think carefully about where we move to because we don't know what AI might bring.

但另一方面，我们不应该仓促行事，把已知的好东西都扔掉。

But on the other hand, we don't, we, we shouldn't rush this and, you know, and throw, you know, and throw everything that we know is good away.

不幸的是，这里没有简单的答案。

Unfortunately, there's no easy answer here.

困难的答案是，是的，任何东西都可能随时出问题，如果出了问题，你的钱就危险了，对吧？

The hard answer is that like, yeah, I mean, anything could break at any time and your money is on the line if it does, right?

最终，我们唯一的防御就是主动为所有可能情况做好准备。

Ultimately, our only defense against that is proactively preparing for all eventualities.

有一个术语，如果你想的话我们可以再讨论，但之前已经提过几次了，就是“加密敏捷性”这个概念，对吧？

And there's this term that, you know, we can come back to if you want, but I mean, this has like been referenced a few times, this concept of crypto agility, right?

就是说，不要把所有的鸡蛋放在一个篮子里。

Where it's like, you don't put all your eggs in one basket.

对，也许哈希会出于某种原因失效，或者格密码也会出问题，所以，我们有一些备用计划，对吧？

Yeah, maybe hashes are gonna break for some reason, or maybe lattices and so, okay, we have some backup plans, right?

我觉得这其实就是这个充满不确定性的世界的答案，不同的利益方在追求不同的目标。

And this is really, I think the answer into this world where this is inherent uncertainty and you have different kind of interests pursuing different goals.

对，也许吧，

Yeah, maybe,

最后一点，

the last piece on that,

有时候我觉得，给安全生态系统加把火，说‘好吧’是件好事。

think, you know, sometimes it's it's it's great to light a fire under the security ecosystem and say, okay.

那我们就来压力测试一下。

Well, let's, you know, let's let's pressure test this.

确保我们准备好了，因为总得有人出来搅局，说‘我们开始吧’。

Let's make sure we are ready because it takes someone to kind of set the cat out amongst the pigeons and say, let's go.

我们来谈谈这个话题，因为如果这能让人们认真对待后量子迁移，还有现在的后AI迁移，那就更好了。

Let's have this conversation because if it's gonna make people take the post quantum migration seriously and and now the post AI migration seriously, the better.

而且我觉得，就像亚历克斯说的，我喜欢过去几周那场辩论的一点是，它让大家开始讨论这件事了。

And I think to Alex's point, what I what I enjoyed about that, the whole debate that took took place over the last couple of weeks was it it got people talking about it.

不管他们出于什么原因，那是另一回事，但我觉得这确实表明，我们还没准备好。

Whether for their right or wrong reasons is a different question, but I think it it really showed, okay, we're not ready for this.

如果真会出现这种黑天鹅事件，AI 会破解加密方案，那我们必须做好准备。

You know, if there is gonna be these black swan events where AI will break crypto schemes, we we need to be ready.

我们需要公开进行这样的讨论。

We need to have that conversation in the open.

这真是……

And that's and that's that's a

一股新鲜空气。

breath of fresh air.

我们刚开始做 Project 11 的时候，谈论量子对加密的影响还是个禁忌话题。

When we first started Project 11, it was taboo to be talking about quantum's impact on crypto.

而现在我们看到，这已经变成主流话题了。

And now what we're seeing is it's becoming mainstream.

连约翰·霍普金斯、耶胡达都在讨论这个了。

It's becoming John Hopkins, Yehuda.

现在连Justin Drake都在讨论这个了。

It's becoming Justin Drake.

我们终于把话题彻底打开了。

That's that's that we finally ripped the band aid off on the conversation.

我来说说其他一些反应，然后我们再继续讨论其他问题。

I'm just going to describe some of the other reactions, and then we'll we'll move on into some of the other issues here.

以太坊基金会的前成员，现在在Tempo工作的那个人发推说，椭圆曲线已经被破解了，任何暴露的公钥都会导致资产被窃取，而且不是白帽黑客先帮你保住资产的那种。

So,, formerly of the Ethereum Foundation, now at Tempo, tweeted, quote, Ephileptic curves are broken so that any exposed public key leads to compromise, and it's not by white hat hackers who save everyone's assets first.

你的币会直接归零。

Your coins are going to zero.

就算你把币放在保险模式里也没用。

Having them in bunker mode is not going to help you.

它们照样一文不值。

They are still worth zero.

Dragonfly的Haseeb Qureshi发推说，有些人回应说，是的，但如果ECDSA被破解了，社会面临的问题可比区块链大得多。

Haseeb Qureshi of Dragonfly tweeted, quote, some people respond, yes, but if ECDSA were to be broken, society would have much bigger problems than just blockchains.

想想银行、TLS、证书颁发机构。

Think of banks, TLS, certificate authorities.

区块链反而是你最不用担心的问题。

Blockchains would be the least of your problems.

但Haseeb说，你不应该把这当作安慰。

But, Haseeb said, you should not take that as consolation.

银行可以恢复。

Banks can recover.

TLS可以恢复。

TLS can recover.

证书颁发机构可以恢复。

Certificate authorities can recover.

他们可以重新对每个人进行KYC，然后切换到新的加密标准。

They can re KYC everyone and switch to a new cryptographic standard.

而我们区块链，无法从公钥密码学的失败中恢复过来。

We, blockchains, cannot recover from a failure in public key cryptography.

在最坏的情况下，任何人都能算出别人的密钥，也就是说，任何人都能拿走别人的钱。

In a worst case scenario, anyone could compute anyone else's keys, meaning anyone could take anyone else's money.

我们就不知道谁拥有什么，也没办法证明任何事。

We wouldn't know who owns what, and we'd have no way to prove anything.

那就不再是货币了。

That's no longer a currency.

那就像一面涂鸦墙。

That's a graffiti wall.

我们只能把整个区块链扔掉，从头再来。

We would have to throw the entire blockchain in the trash and start over.

我很好奇你在这个问题上站在哪一边。

I'm curious if you are on one side or another here.

我不想在这上面花太多时间，但我就是得把这些评论放进播客里。

I don't wanna spend too much time on it, but I just had to get these comments into the podcast.

里面有很多劲爆的评论。

There's a lot of juicy ones.

我觉得……

I think...

其实我同意Haseeb的观点，但有一个重要的前提。

I actually agree with Haseeb with with one important caveat.

你看。

Look.

我觉得区块链是可以恢复的。

I think blockchains can recover.

我们得记住，比如回到以太坊刚开始的时候，有人不小心手滑搞出了重入漏洞，在智能合约里，然后大家都决定当这事没发生过，在我们的世界里。

I mean, we have to remember, like, go back to the beginning of Ethereum when someone accidentally fat fingered a bug and, you know, the reentrance bug and smart contract, and everyone just decided that didn't happen in our version of the world.

然后我们，比如，回滚到了之前的区块，这当然就是以太坊经典分叉，那在社交层面显然非常动荡，但以太坊后来还是成了第二大区块链。

And we, like, went back to, you know, a former block and this was of course the Ethereum eat classic pork and like, you know, that was obviously socially very disruptive, but Ethereum went on to become the second largest blockchain.

所以，我觉得最终这些去中心化方案还是有社会层面的兜底机制的，对吧。

So, I think, you know, ultimately there is this social fallback, right, for these decentralized schemes.

现在，如果明天AI或者量子计算突然出现，开始偷大家的钱，那肯定会引起巨大的混乱，所有东西都会被打乱重来，对吧？

Now, it be incredibly disruptive if, you know, AI or quantum tomorrow were to show up and, you know, start, you know, stealing everyone's money and there would be, you know, a kind of this everything gets thrown up in the air?

那当然会了。

Absolutely it would.

但我不认为这一定是区块链的终结，前提是，我们理论上还能找到某种新的密码学方案，然后在一个新的分叉或者重新启动的新体系里应用它。

I But don't think it's necessarily gonna be the end of blockchains, assuming again, there is some kind of cryptography that we could theoretically apply in some kind of new fort or new universe that we restarted.

但我完全同意Haseeb的看法，因为我们在Project 11讨论量子计算时，他一直在反驳的那种情绪，就是人们那种末日心态，觉得好像量子计算机一上线，地球就要爆炸了似的。

But I agree with Haseeb entirely in that I I, you know, we we've gotten kind of the sentiment that he's that he's arguing against a lot at Project 11 with Quantum because people are like, oh, it's just like the kind of this doomsday mentality where it's like, oh, well, it's like the earth will explode if a quantum computer comes online.

但实际上不是那样的。

It's like, no, that's not how it's gonna work.

而且从实际角度来说，我觉得Haseeb没有提到的一点是，区块链的密码学跟其他应用场景相比，是最接近货币的，或者说最接近货币应用的。这一点有利也有弊。

And also practically speaking, you know, think one thing that that Haseeb didn't mention that I think is, you know, special about blockchains and this cuts both ways is that the cryptography on blockchains is like the closest thing to money where, you know, or it's like the closest to the monetary application of any of those other use cases.

比如说，你可以用密码学登录你的银行账户，但如果我设法破解了你和银行之间加密会话的公钥或私钥，Laura，通常银行那边，如果我想把所有的钱转走，银行很可能会打电话给你，问你确定要这么做吗？就是会有其他的一些保障措施，对吧？

Like, yes, you can authenticate to log onto your bank, but if I like am somehow able to crack the public key or the private key for your encrypted session with your bank, Laura, like typically your bank, like if I try and wire all the money out, your bank is probably gonna call you and be like, Hey, are you sure you wanna, you know, there's like other things, right?

但在中本聪的比特币里，如果你拿到了中本聪的私钥，不管他在哪里，没有任何银行会打电话给你。

Whereas in like Satoshi's Bitcoin, if you have Satoshi's private key, wherever they are, there's no one bank is calling you.

也没有矿工会打电话给你。

No miners calling you.

就是说，它就会直接发生，对吧？

Like it's just gonna happen, right?

所以，基本上在所谓的保障之间没有任何缓冲，就是说，从签署消息到转出资金之间，这既是优点也是缺点，对吧？

And so the, the fact there is basically no safeguards between safeguards is a quote unquote here, between like being able to sign a message and send the money, it's both a feature and a bug, right?

这正是它能做到无需许可的原因。

It's what enables this to be permissionless.

这也是它和银行不同的地方。

It's what makes it different than a bank.

但这也意味着这些东西一旦被攻破……

But it also means that these things can be...

一旦被攻破，你和潜在的灾难之间就真的没有屏障了。

Once they're broken, there's, like, really no wall between, like, you know, you and catastrophe potentially.

我不觉得这是好事还是坏事。

And, you know, I don't think it's it's not a bad or good thing.

我只是觉得这就是这种架构的现实。

I just think it's the reality of this architecture.

我觉得那种‘反正一切都会完蛋’的观点，

I find the view that, oh, well, everything is going to be effed anyway.

有点像虚无主义的看法。

It's sort of like the nihilist view.

所以我同意。

So I agree.

我比较站在Haseeb那边，觉得我们应该试着做点什么。

I'm sort of on the Haseeb side that we should try to do something.

那我们现在就来深入聊聊这些不同类型的密码学吧，因为我看到很多争论都集中在这上面。

So let's now dig into these details about these different types of cryptography because that's kind of where I saw a lot of arguments.

Justin说，要安全地退出‘地堡模式’，需要后AI时代的密码学。

So Justin said exiting bunker mode safely will require post AI cryptography.

我的倾向是全力押注基于哈希的密码学，完全避开那些结构化的数学假设，不管是曲线、格还是同源之类的。

My inclination is to go all in on hash based cryptography and avoid structured mathematical assumptions entirely, whether from curves, lattices, or isogenies.

我猜那是这么发音的。

I'm assuming that's how to pronounce that.

我试着猜一下。

I'm taking a stab.

他说，一个经过实战检验的哈希函数，比如Shaw或Blake系列的，就能提供合理的后AI安全性。

He said a single battle tested hash, e g from the Shaw or Blake families, yields plausible post AI security.

然后我们看到了AI的……

Then we saw a i's...

A十六z。

A a sixteen z.

AI十六z。

A I sixteen z.

A十六z最近发了一条推文，称之为……

A sixteen z recently tweeted what it called.

它发了一条关于格密码的推文，还附了一张批评基于哈希结构的截图。

So it tweeted the case for lattices, and then it had a little screenshot of a critique of hash based structures.

然后StarkWare的Ellie Ben转发了那条推文并发表了评论。

And Ellie Ben, assassin of StarkWare, quote tweeted that.

抱歉，这就像是在引用推文之上再引用推文。

Sorry, this is like quote tweets upon quote tweets.

然后他说，不同意。

And he said, disagree.

格结构有丰富的数学结构，正好适合AI去攻击。

Lattices have juicy mathematical structure ripe for AI to attack.

简洁版本是基于模块SIS的。

And the succinct version is based on module SIS.

我不知道那是什么意思，但你可以给我解释一下。

Don't know what that means, but you can explain to me.

这有很多

It's a lot of

太新了。

too new.

哦，这是一种格吗？

Oh, it's a type of lattice?

这是格相关的东西。

It's a lattice thing.

是的。

Yes.

好的。

Okay.

他说，这是……

He said, and this is...

这些从2012年才出现。

These have only been around since 2012.

他说，我建议再等三到五年，让AI先试试水，然后再把大笔资金托付给它。

He said, I recommend waiting another three to five years for AI to kick the tires before entrusting serious money with it.

自己做研究。

Do your own research.

注意安全。

Stay safe.

而Vitalik似乎更同意Justin的看法。

And Vitalik kind of seemed to agree more with Justin.

他发推说，对于签名和证明，我们已经知道如何只用哈希了。

He tweeted, for signatures and proofs, we already know how to go hash only.

更大的挑战在于公钥加密，这正好是Matthew Green提到的点。

The bigger challenge is for public key encryption, which is kind of to Matthew Green's point.

而且这远远超出了区块链的范畴，还涉及安全通信、匿名协议等。

And this goes far beyond blockchain, secure communication, anonymizing protocols.

很多地方都需要公钥加密。

Lots of things need public key encryption.

所以加密很重要。

So encryption.

那你就随便解释一下你记得的那些术语吧。

So go ahead and just explain any of the terms that you remember from there.

比如，我觉得那个……

Like like, I think the the...

大概是最主要的那个。

Probably the main one.

我们刚才聊了基于哈希的，但曲线、格、同源这些概念最好也解释一下。

So we kind of talked about hash based, but the curves lattices isogenies probably would be good to define.

你还记得其他你觉得对大家重要的内容吗？

Anything else that you remember that you think is important for people now?

那就说说它们和基于哈希的有什么不同吧。

Go ahead and just explain how those differ from hash based.

劳拉，这个问题让康纳来回答吧。我们真应该让一个AI代理直接把那一集里从Frobenius到ModuleSIS的所有术语整理成一份词汇表。

I'll let Conor answer this, Laura, we really should just have an AI agent just spit out a glossary of terms from the episode between Frobenius and ModuleSIS.

那集里密码学的术语太多了。

It's just like, it's very rich with the cryptography jargon.

总之，康纳，你来吧。

Anyway, Conor, go for it.

对，我们确实需要某种AI字幕，不过好吧。

Yeah, we need some sort of AI subtitles, but okay.

所以，整个论证的核心又回到了，正如Alex在节目一开始所说的，这些不同的密码学方案是存在的。

So the, the, the, the core of that whole argument comes back to the, the, you know, as Alex said at the very beginning of this, these different, different cryptographic schemes exist.

所以，它们是同一件事的不同变体，是多个工具，但最终目标都是一样的。

So different flavors of the same thing, multiple tools that all do the same ultimate goal.

所以在用户层面，你希望能够签署一条消息，说：我，Conor，拥有这些比特币，我要把这些比特币转给Alex。

So at the user level, you want to be able to sign a message that says, I, Conor, own this Bitcoin and I'm moving this Bitcoin to Alex.

所以今天，我只是希望这个功能能够正常运作。

So today I just, I want that to work.

我只是希望能在钱包里按下发送按钮，然后比特币就能从地址A转到地址B。

I just want to be able to press my send button on my wallet and I want the Bitcoin to move from address A to address B.

目前，这是通过椭圆曲线来实现的。

At the moment, that is done by elliptic curves.

所以，这就是99%的区块链所使用的，也就是椭圆曲线密码学。

So that is what the entire 99% of blockchains use is elliptic curve cryptography.

而这是这些数学上非常丰富的方案之一。

And this is one of these mathematically rich schemes.

这背后需要一些相当复杂的数学运算，当你点击发送按钮时，你的电脑会运行一些数学方程，这些方程最终会生成一个数字签名。

It requires, you know, somewhat complicated match under the hoods that when you click that send button, you know, your computer runs some mathematical equations and those mathematical equations effectively produce this digital signature.

格密码也是同样的道理。

Lattices, the same idea.

所以曲线和格，它们都是某种抽象的形状，但这就是它们的本质。

So a curve and a lattice, they're both kind of these, you know, abstract shapes, but that's because that's what they are.

它们在数学世界里有着某种结构化的形状。

They, they kind of have these kind of structured shapes in, in a, in a mathematical world.

格密码也是同样的概念。

And lattice is the same idea.

你点击发送，用的就是格方案。

You know, you click send and you're using a lattice scheme.

所有这些复杂的数学运算都在你的电脑上完成，最终它会说：嘿，这里有一个数字签名，证明康纳拥有这些比特币，并且他正在将它们转移到亚历克斯的地址。

All this complex maths happens on your computer, which eventually says, Hey, here's a digital signature that proves Conor owns this Bitcoin and he's moving it to Alex's address.

同源密码学也是如此。

And the same goes for isogenies.

这些都是复杂的数学。

It's all this complicated maths.

贾斯汀提到的重点是，我们稍后会讲到A-16Z的回应，那种基于哈希的数字签名方案并不涉及这些数学。

The point that Justin's referring to, and we'll get into the A-16Z response, that hash based digital signature, digital signature schemes don't have that maths.

它们更多是通过生成随机性来证明康纳拥有那些比特币，但底层并没有做任何花哨的数学运算。

They are more just about creating randomness in such a way that still proves that Conor owns that Bitcoin, but it's not doing any fancy maths under the hood.

实际上，它只是把这些信息打乱，以证明我拥有这些比特币，但并没有涉及那种需要博士学位才能深入理解的复杂数学。

It's actually just jumbling around all this information in such a way that I can prove I own this Bitcoin, but it's not doing kind of complex mathematical stuff that need a PhD in to really deeply understand.

整个论点归结为贾斯汀所说的：任何底层有这种复杂数学构造的方案，都比那些纯粹依赖随机性和哈希方案（比如他提到的SHA-2、BLAKE-3）更容易被AI攻破。

And the whole argument boils down to what Justin refers to as any scheme that has this complex math constructions underneath the hood are more likely to be broken by AI than these hash based ones, which rely purely on randomness and these hash schemes that he mentions, SHA-two, Blake-three.

这些哈希函数实际上是随机函数，输入数据，输出随机数据，而数学结构则是建立在相当复杂的数学基础上的。

These are those, you know, effectively random functions, take data in, spit random data out, whereas the mathematical structures are built on this kind of pretty complicated mathematics.

这就是论点的核心。

That is the core of the argument.

AI有更大的机会，打个引号，破解这些基于数学的方案，而不是那些结构不那么严谨的数学方案。

AI has a bigger chance, quote unquote, of breaking these mathematical based schemes than it does the ones that require less structured math.

让我插一句，康纳，如果你不介意的话，听众现在可能会想，好吧，行。

And let me jump in, if you don't mind Conor saying, like, at this point, listeners may be thinking like, okay, cool.

那为什么我们不直接用哈希函数呢？

Well, why wouldn't we, why wouldn't we just use hash functions?

因为，对，结构少，风险也小，那为什么还要用格基方案呢？

Because like, well, yeah, there's less structure and that's less risk than like, why would we ever use a lattice?

我觉得有必要指出，美国国家标准与技术研究院，也就是NIST，已经标准化了两种后量子方案，一种是格基的，一种是基于哈希的。

And I think it's important to point to point out that NIST, the National Institute of Standards Technology in The United States, has standardized two post quantum schemes, a lattice one and a hash based one.

格基方案其实是他们的首选推荐。

The lattice one is actually their primary recommendation.

所以NIST说要用基于格的签名方案。

So NIST is saying use the lattice based signature scheme.

那如果格基方案确实有结构，而且AI可能破解，他们为什么还这么说呢？

Now why would they say that if, you know, it's true that there's structure and maybe AI to break?

估计NIST也是从二十年的时间跨度来考虑这个问题的。

I mean, presumably NIST is thinking about this in the twenty year timeline too.

它是一个标准机构。

It's a standard body.

所以问题最终是这样的。

So the issue is ultimately as follows.

嗯，其实有两个问题。

So, well, there's two issues.

一个是性能。

One is performance.

基于哈希的密码学更大、更慢，在很多性能方面都更差。

Hash based cryptography is bigger, slower, worse along many performance dimensions.

这正是为什么NIST实际上已经标准化并明确表示应该优先使用基于格的方案MLDSA，对吧？

That's exactly why effectively NIST, you know, with, like, has standardized and has said that MLDSA, the lattice based scheme should be preferred, right?

因为那样性能上的权衡就没那么多。

Because there's not as many performance trade offs.

想想看，而且NIST考虑的是互联网，你知道，互联网是一个全球分布式系统。

Think about, and again, NIST is thinking about the internet and, know, it's a, the internet's a global distributed system.

所以这显然是个问题，对区块链来说也是。但我觉得性能确实是一个方面。

So that's, that's obviously a concern as it is for block But I think that the performance piece is certainly one aspect.

另一个方面是，我们不能只从这些签名的角度来考虑密码学。

The other aspect is we can't just think about the cryptography in terms of these signatures.

我们还得考虑它们是怎么被使用的。

We have to think about how they're used.

举个具体的例子，Fireblocks，当你用Fireblocks管理你的资产时，你不仅仅是在签名一条消息，你是在这个椭圆曲线签名之上运行一个复杂的多方计算协议，这就像是一个独立的东西，用来保护你的资金安全，对吧？

Let's make a tangible Fireblocks, when you like you cuss to your assets using Fireblocks, you're not just signing a message, you're doing a complicated multi party computation protocol on top of this elliptic curve signature that involves, you know, it's like a separate whole thing that helps keep your money secure, right?

所以，数学和密码学的好处在于，它们有结构，你可以在上面搭建像MPC这样的脚手架。

And so, the nice thing about math and cryptography with structure is you can build all the scaffolding around it like MPC.

而随机哈希数学的坏处是，你没法这么做，因为如果能的话，那它就不安全了，对吧？

The bad thing about random hatch math is you can't, because if you could, well then it wouldn't be secure at all, right?

所以，这又有点回到了Yehuda和Justin那个话题。

And so, again, this kind of ties back a little bit to the Yehuda Justin thing.

Justin不用担心这个，但Yehuda肯定得担心，对吧？

You know, Justin doesn't have to worry about that, but Yehuda definitely does, right?

我觉得Yehuda上一家公司，在被Coinbase收购之前，就是做MPC的，对吧？

I think Yehuda's last company before it was acquired by Coinbase was an MPC provider, right?

所以，这些东西根本没有什么所谓的预启动器。

So, these things, you know, there's no such thing as a pre launcher.

我觉得这才是真正的重点。

That's I think really the upshot.

那这对区块链意味着什么呢？

And what does this mean for blockchains?

这意味着我们将进入一个告别单一椭圆曲线安全的世界，进入一个多极化的世界，有些人会选择同源密码学，因为那些权衡在那里是合理的。

It means that we're going to enter a world where we are going to leave the world of monolithic elliptic curve security, and we're going to enter into a multipolar world where some people are gonna choose isogenies because those trade offs make sense there.

有些人会选择格密码，因为那些权衡在那里是合理的。

Some people are gonna choose lattices because those trade offs make sense there.

还有些人会选择哈希。

And some people are gonna choose hashes.

而从密码学和基础设施的角度来看，这完全是未知领域。

And that is from, like, a cryptography point of view and from an infrastructure point of view, especially completely uncharted territory.

但这是……

But it's...

在我看来，这是我最确定的事情。

I think in my in my view, it's the thing I'm surest of.

鉴于这些情况，这是不可避免的……

It's unavoidable in light of these...

已知的未知，比如量子，以及未知的未知，比如各种威胁。

The known unknown of quantum and the unknown unknown of threats.

对，我想提一下耶胡达的其他观点，他说，也没有证据表明椭圆曲线的难度比哈希函数的难度更容易被攻破。

Yeah, just to call out Yehuda's other comments, he said, there's also zero evidence that elliptic curve hardness is more vulnerable than hash function hardness.

实际上，从历史上看，函数被攻破的情况比椭圆曲线更多。

In fact, historically, functions have been more broken than than elliptic curves.

所以我很好奇，你同意他的观点，还是更同意贾斯汀的观点？

So I'm curious, like, do you agree with him or do you agree more with Justin on that point?

那部分确实没错。

That that part's true.

从历史上看，我们淘汰的哈希函数比标准的椭圆曲线函数要多。

So historically speaking, have retired more hash functions than we have standard elliptic curve functions.

我们在哈希函数中发现的漏洞比在椭圆曲线方案中发现的要多。

We have found more breakages in hash functions than we have in these elliptic curve schemes.

而且

And

为什么会这样？

why is that?

因为这不……

Because it doesn't...

我很好奇，因为当你们一直在谈论哈希函数的随机性时，我就在想，你怎么知道什么是真正随机的？

I'm curious because what I was wondering actually when you guys kept talking about the randomness of hash functions, I was like, how do you actually know what's actually random?

比如，可能有一个隐藏的东西，在人眼看来是随机的，但实际上机器能发现它不是随机的。

Like, because there probably could be a hidden thing where, like, to the human eye, it looks random, but that actually a machine could figure out it's not.

所以，我这样理解对吗？这就是原因吗？

So, like, am I right in thinking that's why?

这个……

The the...

我……

I...

你问了一个密码学中最深奥的问题。

You asked one of the deepest questions of cryptography.

你正在揭开……

You're uncovering...

这就像……

That is like...

他不会紧张的。

He's not gonna nervous.

这让很多摄影师非常紧张。

That made a lot of photographers very nervous.

这是一个本质上无法回答的问题。

That is an, that is an inherently impossible question to answer.

而我们密码学家，往往最终就假设它是随机的，但关键在于，它真的是随机的吗？

And us cryptographers, we tend to eventually just assume that it's random, but the point about is it truly random?

人工智能能发现规律吗？

Will AI be able to spot patterns?

这可是个大问题。

That is a huge issue.

而且没有好的办法来确认它是否随机，因为如果它没问题的话，你怎么知道它是随机的呢？

And there's no good way of knowing it's random because how can you know it's random if it's Okay.

我是说，这个

Mean, this

这让我更没信心了。

this now gives me even less confidence.

我之前还以为这是个奇怪的问题，只是随便想想，但现在我意识到，哦，其实……

Like, thought that was, like, a weird question that I was wondering, but now I'm like, oh, actually.

所以所有的安全措施，都……

So all the security that...

或者说，我们对哈希函数的所有信心，都取决于这个看似简单的问题。

Or all the confidence we have in hash based functions depends on this one kind of obvious question.

而这正是这些函数失效的主要原因。

And that's largely where the functions break.

哦，抱歉，各位。

Oh, sorry, everybody.

所以，过去这些哈希函数出问题，主要就是因为我们发现了它们并不像预期的那样随机。

So that's largely where these hash functions have broken in the past is we've found ways that they're not as random as they're meant to be.

我们找到了检测的方法——能不能判断这个输出是真正随机的，还是来自这个哈希函数？

We've found ways to detect, you know, okay, can we detect that this output is truly random or has it come from this hash function?

一旦我们开始发现这些模式，就必须淘汰这个哈希算法，因为它无法满足安全哈希函数的严格要求。

And if we begin to spot those patterns, we have to retire that hash algorithm because it doesn't meet kind of the stringent requirements of being a secure hash function as a result.

所以，Yehuda说得完全对。

So, so Yehuda is completely correct.

这一点在整个行业里都是众所周知的。

I mean, this is, and this is well known across the industry.

过去三四十年里，我们已经淘汰了好几代哈希函数。

We've retired multiple versions of hash functions over the past, you know, thirty, forty years.

但椭圆曲线加密，我们从来没淘汰过。

We have not retired elliptic curve cryptography ever.

所以如果你要打个分，看哪个更容易被攻破——虽然这比较不太公平——但哈希函数在这场辩论中确实处于下风。

There is, you know, so, you know, if you're to do a scoreboard of which has been seen to be more vulnerable, it's not the perfect comparison, but hash functions are definitely losing the debate against elliptic curves.

不过我觉得，就像Alex刚才提到的，这场辩论双方都有道理。

I think though, and this is like, Alex kind of just mentioned this, but you know, the whole debate, you know, both sides are making good points.

但我觉得……

But I think there...

没人真正知道哪个会先被攻破。

No one really knows which are going to break.

如果我们知道的话——也许有些AI实验室知道，存在信息不对称——但我们确实不知道哪个会先倒下。

You know, if we knew that, and maybe some of the AI labs do and there's an asymmetry of information, but we don't know which ones are going to fall for it first.

但我觉得，问题本身可能就问错了。

But I think the issue is it's kind of the wrong question.

选择哪种加密方案或者哪种加固系统当然重要，但这只是冰山一角。

Which cryptographic scheme or which hardened systems you're going to go for is fine, but it's the tip of the iceberg.

而这就是问题所在。

And this is the problem.

如果我们陷入这场争论，花上六到十二个月的时间在推特上争个你死我活，讨论是用格密码还是哈希函数，或者其他什么，我们真正不想看到的是，这分散了我们的注意力，忽略了我们有实际工作要做，而决定签名方案只是迁移过程中需要回答的五万个问题之一。

If we get caught up in this debate and spend the next six, eight, twelve months trying to have an ego battle on Twitter of are we going to use lattices or hashes or any of this conversation, You know, we don't, what we don't want is distracting away from the fact that we do have real work to do and deciding the signature scheme is only one of the 50,000 questions you have to answer yourself if you're going to migrate these schemes.

这真的是我们唯一的危险——我们密码学家，或者说工程师们，普遍喜欢在理论上进行哲学思辨和争论。

And this is really the only danger we have here is we can, you know, cryptographers and, you know, I guess engineers in general love being philosophical and debating these things in theory.

但实际上，我们面临的是迫在眉睫的威胁。

But really what we have is we have these looming threats.

无论是人工智能还是量子计算，对密码学和加密货币来说都是实实在在的威胁。

Both AI and quantum are real, real threats to cryptography and to crypto alike.

我们需要开始迁移的过程。

You know, we need to begin that migration process.

我认为我们越早摆脱这些争论，就越有帮助。

And I think the sooner we can get past some of these debates, it's gonna be somewhat helpful.

而且我觉得……

And I think...

再说，为了更清楚地说明康纳刚才的观点，我们需要假设任何事情都可能

And again, like, to kind of put it to, like, to put a fine point on the on the point Conor just made is that, you know, we need to assume anything could

出问题。

break.

就是这样。

That's like that.

我觉得这又回到了历史，哈希函数被攻破过，非对称方案也被攻破过。

I mean, I think that's just, I mean, again, like go back in history, the hash functions have broken, you know, asymmetric schemes have broken.

你可以指出任何数量的证据，表明一切都可能出问题。

All, you could point to any, you know, number of pieces of evidence that show that everything could break.

而且我认为确实如此，任何事情都可能出问题。

And I think it's true, anything could break.

我觉得这其实是一种哲学上的思维转变，就是说，嘿，我们基本上需要做最坏的打算。

And I think it's just a philosophical kind of chain mindset change where it's like, hey, just need to basically plan for the worst.

对于像区块链这样的系统，我们最终希望它成为关键基础设施，我们不能永远假设一切都会保持不变，永远都是现在这个样子。

And for systems like blockchains that, you know, ultimately we want to be critical infrastructure, you know, we can't ever bake in the assumption that everything's gonna last forever and be how it is.

这就是加密敏捷性的核心。

And that's crypto agility in a nutshell.

我认为这不仅是区块链的未来，也是整个网络安全的未来。

And this is, I think, really going to be not only the future of blockchain, it's gonna be the future of cybersecurity generally.

这种敏捷性，以及对你的加密架构的零信任，只要你能做到，就是未来的方向。

Is this agility and this kind of zero trust on any of your even cryptographic architecture insofar as you can get away with that is gonna be the way to go.

现在，人们可能会问我，亚历克斯，这听起来很有道理。

Now what, and then people could also ask me to like, Alex, that sounds sensible.

为什么现在不是每个人都这么做呢？

Why doesn't everyone do that today?

答案很简单，就是成本，对吧？

Cost is the simple answer, right?

如果我要支持两种方案而不是一种，那成本肯定更高。

If I'm supporting two schemes versus one, it's gonna be more.

如果我支持三种方案而不是两种，那成本肯定更高。

If I'm supporting three schemes versus two, it's gonna be more.

就像你决定给自己的房子买多少保险来应对各种潜在风险一样，协议和人们也得决定需要多少冗余度，才能确保在想要保护的价值或信息上，能抵御所有最坏的情况。

And just like you decide how much insurance you wanna carry for your house against what long tail of threats, protocols and people are just gonna have to decide what level of redundancy is enough to assure me that I'm protected against all worst case scenarios for the value that I'm trying to secure here or the information.

关于这一点，最后要说的是，我

And and the last piece on that, I

觉得，这真的很……

think, is really...

得给这一切加点积极的角度，因为到目前为止听起来挺悲观的。

You know, to put a positive spin on all of this because it sounds quite doomsday so far.

如果我们能正确构建这些系统，如果我们能迁移到这种新的加密敏捷性……

If we build these systems correctly, if we migrate to this new crypto agility...

也就是亚历克斯提到的加密敏捷世界，我们采用的第一个方案肯定不会是最后一个。

Crypto agile world that Alex is referring to, the first scheme we move to certainly won't be the last.

我们可以这样构建这些方案，这样就不需要再进行大规模迁移的讨论了。

You know, we can build these schemes in a way that now we don't have to have this big migration conversation.

人工智能正在破解密码学。

AI is breaking cryptography.

是的。

Yes.

确实如此。

That is true.

但同时也创造了全新的密码学。

But it's also creating brand new cryptography.

我完全不认为比特币或以太坊在第一次后量子迁移中使用的方案会是最后一个。

And, you know, I don't for a second think that the scheme that Bitcoin uses in the first post quantum migration or Ethereum will be the last.

我们会看到这些新方案出现，它们更好、性能更高、更节省燃料、吞吐量更快，无论你想通过这些方案解决什么样的性能指标，我们都会找到它们，这很棒。

We will see these, you know, new schemes come out that are better, more performant, more gas optimized, you know, faster throughput, whatever the kind of performance metric you're looking to tackle with these schemes, we'll find those and that's great.

如果我们正确构建这些系统，我们就能享受人工智能创造所有这些新密码学带来的好处，而且如果我们构建得当，就能不断迁移这些系统。

And if we build the systems correctly, we can kind of reap the reward of AI making all of this new cryptography and we can constantly just be migrating these systems if we build them properly.

如果我们像以前那样构建，只是把所有东西直接搬到新方案上。

If we build them the same we've done before, where we just lift and shift everything over to a new scheme.

嗯，每次我们有了新方案或者新突破，都得进行这些一模一样的迁移讨论。

Well, every time we have a new scheme or a new break, we have to have these exact same conversations about migration.

这

It's

会变得有点

going to become a

烦人，如果我们得一直这么做的话，因为随着AI的发展，这只会越来越快。

little bit tiresome if we have to keep doing that because this is only going get faster with with with A.

我

I.

是的，回到关于NIST的评论，我想知道他们更倾向于格密码，或者我不知道这么说对不对，但他们建议人们采用格标准的部分原因是不是因为它数据量更少。

Yeah, to go back to the comment about NIST, I wonder if part of the reason that they're more on the side of lattice or I don't know if that's the way to phrase it, but you know, reason that they're proposing people adopt the lattice standard is because it, I guess, is less data intensive.

但另一件事是，既然NIST可能不会为区块链推荐标准，他们对安全性的标准可能不同。

But then the other thing is, since NIST is probably not recommending standards for blockchains, they might have a different standard of what security is.

所以，Justin，我理解如果他更担心AI或量子带来的高级数学威胁，那可能就是为什么他会偏好随机的东西。

And so, Justin, I understand if he is more worried about the threat of advanced math from AI or quantum, that might be why he would prefer something random.

但再说回来，这又回到了我们之前聊的那个假设，就是它到底是不是真的随机，以及我们能不能知道，或者可能根本没法知道，这本身就是个风险。

But again, this goes back to what we talked about, This assumption that it is actually random and whether or not that is true and how we can know or or how we probably won't be able to know that's its own risk.

这让我想到另一个问题，就是区块链在安全方面的选择，可能会变成要么成要么败的关键。

And so that leads me to another thought, which is that it sort of creates this situation where choices that blockchains make about how to secure themselves could end up being make or break.

有点像赌博，因为你得等技术发展起来，才能知道什么真正有效。

Like, in a way, it's almost like a gamble because you kind of need for the technology to play out to see what will actually be effective.

所以，如果链现在就得做决定，那可能突然有个突破，某条链就基本完蛋了，这么说可能不太好听。

And so it's like, if people if if chains have to make their choices now, then it might be that, like all of a sudden, some breakthrough happens and a chain is kind of fucked, basically, for lack of a better word.

我说得对吗？这种情况有可能发生吧？

Am I right that, like, that could be a scenario?

我觉得是的，但我会说得温和一点。

I think yes, but I would soften it.

而且我……

And I...

让我先简单说一句……

Let me just actually make a quick...

简单说一下哈希函数的事，因为，对，我们知道的随机性都不是真正的随机。

Like, a quick copy on the hash function thing because, like, yes, all of the randomness we know are not.

我觉得有一点可以替那个观点辩护一下，或者说给那个论点一个公道，就是为什么哈希函数可能不错。

I think the one thing just to steel man that or to or to give it, you know, give that argument it's due on why hash functions might be good.

椭圆曲线签名被签过的次数，我不知道，可能有几十亿次吧。

The number of elliptic curve signatures that have ever been signed, I don't know, maybe in the billions.

我不知道。

I don't know.

我不知道。

I don't know.

那是个很大的数字，但每个比特币区块产生的哈希数量是天文数字级别的。

It's like, it's a big number, but like the number of hashes that get made for every single Bitcoin block is astronomically huge.

所以，我们运行哈希函数的次数……

So, like, the number of times we've run the hash function...

顺便说一句，如果比特币矿工能在哈希函数里找到规律，他们肯定会那么做，因为那对他们来说价值巨大。

And by the way, if a miner in Bitcoin could find a pattern in the hash function, they would definitely do it because that would be an enormously valuable thing for them to By do.

而且，还有很多其他基于随机哈希函数的工作量证明方案，都是人们某天心血来潮想出来的，结果经常被攻破。

Way, there's like many other proof of work schemes that have been built on random, you know, hash functions that people just decided they made up one day, they get broken all time.

所以，这就是简单回顾一下，顺便提一下这个点。

So that's just just to just to quickly kinda go back and touch on that.

重要的是要让你明白，哈希函数真的非常非常非常安全。

It's like important to to give that argument to you that like hash functions are really, really, really secure.

它们确实经历了很多攻击。

They've seen a lot of attack arguably.

所以，并不是说它们完全随机。

So it's not that they are perfectly random.

事实上，我们知道它们不是完全随机的，但我觉得它们非常坚韧。

In fact, we know they're not, but I think it's, they're very resilient.

好的。

Okay.

现在说到你的观点，在一些区块链的语境里，人们有一种幻想，觉得这是一个自动化的协议，自我治理，好像我们把它放到宇宙中，它就会永远保持原样。

Now to your point, think there's a fantasy in some blockchain context that people are like, it's this automate, it's like, you know, it's a protocol that just self governs and somehow like, we're gonna put it in the universe and then it's just gonna always be what it is.

我不是要指名道姓，但我觉得比特币生态在这方面特别严重。

I mean, not to name names, I think the Bitcoin ecosystem is particularly guilty of this.

就好像，哎呀，它的形态完美无缺，会一直存在到宇宙热寂。

It's like, oh, it's perfect in its form, it's gonna last until the heat death of the universe.

这纯粹是胡说八道，对吧？

That's pure poppycock, right?

现实是，密码学，你只要看看过去一百年的密码学，它一直在演变，对吧？

The reality is that cryptography, you just look at last hundred years of cryptography, it's evolved, right?

而且事物需要演变，对吧？

And things need to evolve, right?

而且需要有人参与这些社区，这些社区最终支撑着这项技术，来决定并做出这些权衡，对吧。

And there needs to be people who participate in these communities that ultimately underpin this technology that decide and make these trade offs, right.

而这，我觉得，取决于你有多执着于自动化去中心化，这可能会让人沮丧，但我觉得这也减轻了一些压力。

And that's, I guess, depending on how much of a, you know, I guess, automated decentralization max you are, that could be depressing, but I think it's also, it takes some of the pressure off.

而且我也觉得，康纳提出的实际建议是，我们把这些系统建得有点灵活。

And I also think to the practical suggestion that Conor made is like, we build these systems to be somewhat agile.

如果我们把下一步要做的，看作是密码学的最终解决方案或最终形态，那我们就有了更多的灵活性。

If we think about what we go to next as not the final solution, you know, or the final, you know, form of cryptography, then it gives us a lot more flexibility.

而且我觉得，这也给了我们微调和演进的机会。

And, you know, and I think opportunity to fine tune and evolve.

我觉得这就像一个逻辑陷阱，很多协议设计者都会掉进去，就是觉得我现在必须构建一个完美的系统。

I think that's like, it's a logical trap that I think, you know, that I think a lot of protocol designers kind of fall into where it's like, I have to build the perfect system now.

你看，没有哪个系统是完美的，对吧？

Like, look, no system is perfect, right?

世界在围绕它变化，需求也在变，所以系统也必须跟着变。

The world evolves around it and the needs change and therefore the system has to change.

这正是我们现在进行所有这些对话的原因。

That's exactly why we're having all the conversations we're having right now.

而且，如果我们假设明天会有所不同，那在我看来就太傻了。

And we should be, we would be silly in my opinion, to assume that it's somehow gonna be different tomorrow.

但是，是的，你看，我确实觉得……

But but, yeah, look, I do think...

话虽如此，这并没有消除这个决定的重要性。

That said, it doesn't remove the consequential, like, the, you know, the consequential nature of this decision.

但是，劳拉，我觉得现在所有这些协议都可以做一个简单的决定。

But that said, Laura, I think there's an easy decision that all these protocols can make right now.

那就是采取行动。

It's doing something.

行动起来。

Do something.

不幸的是，在加密货币生态系统中，仍然有很多人选择假装什么都不需要做。

And there's unfortunately still a lot of people in the ecosystem in crypto that just start choosing to pretend like nothing needs to be done.

现在，选择什么都不做，我绝对认为会带来灾难性的后果。

Now, so choosing to do nothing, I absolutely think will have catastrophic consequences.

而且说清楚，我认为选择做错事也可能带来灾难性的后果。

And to be clear, I think there's a chance that choosing to do the wrong thing could too.

但说实话，我更看好那些至少选择采取行动的链，因为至少有一点信心，相信最终系统会由那些关心它、与它有利害关系的人来维护，而不是那些不关心的人。

But honestly, my bet is on the chains that are at least choosing to do something because at least there's, like, a little bit of faith in the proactivity that ultimately the system will be maintained by people that care about it and have a stake in it as opposed to people that aren't.

好的。

All right.

那我们聊聊时间线吧。

So let's talk about timelines.

每次我进行这种讨论，我总是说，好，我们来谈谈时间线。

Every time I have one of these discussions, I'm always like, well, let's talk about timelines.

贾斯汀说，在我看来，现在做好准备应对ECDSA在Q日之前被破解的可能性是合理的，最坏情况下，是几个月而不是几年，这真是让人震惊。

Justin said, in my opinion, it is now reasonable to brace for the possibility that ECDSA breaks before Q Day, in the worst case, in months, not years, which, woah.

然后他说，所谓破解，指的是快速恢复私钥，比如。

And then he said, by break, I mean fast private key recovery, e.

比如，在一周内，在可用的硬件上，比如。

G, in one week on available hardware, e.

比如，一个大型GPU集群。

G, a large GPU cluster.

所以，亚历克斯，我知道上次你上节目的时候，我一直追问时间线的问题。

So, Alex, I know the last time when you were on the show, I kept asking about timelines.

我确实看到了谷歌发布的另一项公告，是关于所谓的魔法态的进展，据我理解，这对量子计算的建模来说挺关键的。

I did see another announcement by Google about a development around so called magic states, which as far as I understand, are kind of crucial for modeling quantum computing.

我知道那只是量子方面的，但我敢肯定它对AI也有普遍的应用。

So I know, you know, that's only quantum, but I'm sure there's applications for AI just generally.

所以我很想知道，现在我们对AI和量子都有了这么多了解，你对时间线有没有更新的看法，就是这些技术什么时候会对区块链产生影响。

So I'm curious, now with everything that we know about AI and quantum, if you have an updated sense about timelines in terms of when this will be relevant for blockchains.

我们真的没给观众喘息的机会啊。

We're we're really not giving the audience a break here alone.

对吧？

Okay?

最后几分钟，我们来聊聊魔法态。

Last few minutes, let's talk about magic states.

不过，算了。

Anyway, no.

但这些其实都是相互关联的，所以我觉得有必要提一下。

But it's it's all connected, so I I think it's important to address.

所以简单来说，魔法态和量子纠错有关。

So very briefly, magic states have to do with quantum error correction.

谷歌的那个结果基本上验证了他们之前的一些资源估算。

And, you know, the the Google's result basically validated some prior resource estimates that they had.

说实话，我不觉得这会改变QDay的时间线。其实今天早些时候还有另一个结果，来自一家叫Quantinuum的公司，这是一家总部在科罗拉多的量子计算公司，他们在纠错方面也取得了非常亮眼的成果。

I don't think it changes QDay time lines, honestly, There was another result earlier today, actually, from a company called Quantinuum, which is a quantum computing company based in Colorado that also had a very impressive result with regard to error correction.

你看，我还是不觉得这会改变大局。

Look, again, I don't necessarily think it moves the needle.

但它的作用是，劳拉，你记得吗，以前我给出QDay预测的时候，其实不只是给一个日期，我们还得给出对这个日期的信心程度。

What it does is, you know, if you recall, Laura, when in the past, when I've given QDay predictions, it's really been about like, you know, we give a date, but we also have to give our confidence in that date.

所以，我认为量子攻击真正可行的最早时间大概在2030年左右。

So, I think my earliest date where I think a quantum attack is realistic is probably around 2030.

然后，我认为更有可能发生的时间段是2030年代早期到中期，也就是2033到2035年。

Then I think, you know, a chance where it's more likely than not is called the, you know, the early to mid 2030s, so 2033 to 2035.

有了这两个新结果，我觉得我们更可能落在较早的那个时间点上，对吧？

With these two results that have come out, I think we are more likely in the case where it is earlier, right?

还有很多工程工作要做，而且正如康纳之前说的，今天没有什么东西是坏的。

You know, there's still a lot of engineering work to be done and to Conor's earlier point, nothing's broken today.

而且说实话，我仍然会感到震惊，如果……

And I would still be shocked, frankly, on the out...

非常非常小的可能性，在……

Very, very outside chance that within...

在这个十年结束之前，量子计算机就能存在。

By the by the time that, you know, the decade is out that quantum computers exist.

话虽如此，我觉得有些人，你节目上也请过一些，他们喜欢说，哦，那都是理论。

That said, I think there are people, and you've had some of them on your show, that love to say like, oh, it's all just theory.

人们只是在写论文，没有真正的工程实践。

People are just writing papers and there's no real engineering going on.

而我认为这两个例子就是真正的工程实践，并且证明了这确实在起作用。

And I think these are two examples of real engineering and demonstrated evidence that this is actually working.

而且我觉得这让那些人的论点变得更加站不住脚了。

And I think it makes the arguments that some of those individuals make much more tenuous.

我不想危言耸听，说这马上会改变一切，因为我觉得不会。

I don't wanna be alarmist and say this changes everything right now, because I don't think it does.

但我也觉得这确实表明我们正处在一个轨道上，很快我们就会进入后量子时代。

But I also think it definitely implies that we are on a trajectory where soon we are going to be in a post quantum world.

AI的时间线更难预测。

The AI timelines are way harder to reason about.

我不知道，这有点像未知中的未知，就像你和我一样，不知道神话或下一个模型能进化得多快。

I dunno, like that's kind of the unknown, unknown, like your guess is good as mine as to how fast mythos or whatever next model can evolve.

我不知道。

I don't know.

我不是这方面的专家。

I'm not an expert at it.

非常重要的一点是，而且我们经常谈到这个问题，后量子迁移和后AI迁移是同一回事。

The, the, the, so, so, thing that's very important is, and we get to that question a good bit, the, the post quantum migration and the post AI migration are the same.

如果你迁移到后量子安全，而且按照贾斯汀的说法，如果你使用基于哈希的方案，你就一石二鸟了。

If, you know, if you, if you migrate to post quantum security and to Justin's point, if you use hash based schemes, you, you kill two birds at one stone.

你现在就是后量子安全了。

You're now post quantum secure.

然后借用贾斯汀的说法，也是后AI安全，因为他认为哈希在AI攻击下不会崩溃。

And then, you know, to use Justin's framing, post AI secure as well, because he doesn't think hashes will break under, you know, AI attack.

AI的时间线肯定比量子更紧迫。

The AI timelines are definitely more immediate than the quantum ones.

我们已经看到AI在破解这些方案，虽然还没破解生产环境中使用的方案，但已经能破解现有方案了。

We're seeing AI break these, you know, break schemes, not break any schemes they use in production yet, but break schemes today.

这是事实。

And that is true.

所以我们不能回避这个事实。

So we can't shy away from that fact.

AI攻击已经来了，你知道的。

The AI attack is here, you know.

所以如果Q日是指量子计算机出现的那天，那我不知道，A日或者你想怎么叫都行，AI日可能就在现在，或者上个月，大概就是这段时间。

So if Q Day is the day quantum computerized, I don't know, A Day or whatever you want to call it, AI Day, you know, that's happening, you know, maybe now, last month, you know, sometime around now.

而且，很可能会有更多的方案因此被攻破。

And that is, it is likely that we will see more schemes fall to this.

很难说哪些方案会被攻破。

It's impossible to tell which schemes will fall.

我觉得我们在生产环境中使用的主要方案不会是最先被攻破的。

I don't think any of the major schemes we're using in production are going to be the first to fall.

所以我认为这些方案在Q日之前被攻破的可能性不是零。

So I think it's a non zero chance that these schemes fall before QDay.

但好消息是，如果你已经在关注后量子迁移，那你其实也在为后AI迁移做准备了。

But the good news is if you're focusing your post quantum migration, you're already kind of focusing on your post AI migration as well.

这其实是同一项工作。

It's the same, it's the same work to be done.

就是同一个迁移过程。

It's the same migration.

就是选择一个新的、你知道安全的算法方案，迁移到那个算法上，并且按照亚历克斯说的，以加密敏捷的方式去构建。

It's just picking a new algorithm scheme that you know is going be safe, migrating to that algorithm and building it in such a way, to Alex's point, that you're crypto agile.

所以，可以说，AI时代已经来了，如果你相信超级智能，相信OpenAI所说的。

So the, the AI day is here, so to speak, if you believe in super intelligence and you believe what OpenAI is saying.

那么现在的问题就是，我们该如何应对？

So now it's just a case of how do we deal with that?

我觉得，我们应该尽快开始后量子迁移。

Well, I think it's, we begin this post- quantum migration, you know, in fast, soon.

如果你还没开始规划，今天就该做了。

If you haven't started planning this, you should do it today.

而且我们确实有有序的迁移方案。

And we do have orderly migration.

这不是什么紧急情况。

It's not a panic station.

我们不必在两周内完成所有事情。

We don't have to do everything, you know, in the next two weeks.

我不认为椭圆曲线会在几个月内被攻破。

I don't think elliptic curves are going be broken in a couple of months.

也许我会后悔说这话。

Maybe I will regret saying that.

但我们有时间来完成这次迁移。

But, you know, we have time to do this migration.

我们知道需要朝着什么样的最终目标去建设。

We know the kind of end state target we need to build towards.

现在关键就是把这些工作做完。

It's now about just getting that work done.

而且正如亚历克斯所说，开始这项工作本身就很难，但一旦开始了，从AI前和量子前到AI后和量子后，就有一条非常明确的路径。

And to Alex's point, just starting that work is hard, but once we started it's, you know, there's a pretty defined path of how we go from pre AI and pre quantum to post AI and post quantum.

好的。

Okay.

那我们现在来谈谈这些不同的解决方案，我要提三个。

So let's now talk about these different solutions and I'm going to name three.

我试图把三个问题塞进一个问题里。

I'm trying to cram, like, three questions into one question.

所以Dragonfly的Haseeb Qureshi提出了他所谓的“密码战备状态”。

So Haseeb Qureshi of Dragonfly proposed what he called cryptographic wartime.

在他看来，这比“地堡模式”更好，因为他说那不仅要求你转移你的币，而且在转移到新地址之后就不能再动了。

In his view, this is, like, better than bunker mode because he said that requires you to not just move your coins, but then not move them again after you move them to this fresh address.

所以他提出了一个系统级的解决方案，引用一下，包括治理、生态系统范围的计划，不仅涉及协议开发者，还涉及钱包、交易所、应用等等。

So he proposes a system level solution, quote, which includes governance, ecosystem wide plans that engage not just protocol devs, but also wallets, exchanges, apps, etcetera.

他还说，这将从每个区块链创建他所谓的“密码恢复模式”开始，这种模式始于一种新的、极其简单的基于哈希的——所以他支持基于哈希的——公钥系统。

And he said that would start with every blockchain creating what he calls cryptographic recovery mode, which begins with a new and extremely simple hash based, so he's pro hash based, public key system.

然后每个人使用签名方案创建一个备份密钥。

And then everyone creates a backup key using the signature scheme.

然后在某个时间点，每个应用都会要求你必须有备份密钥才能进行交易。

And then at a certain point, every app won't let you transact unless you have one.

所以基本上，应用会设定一个截止日期，在那之后，强制你创建这些备份密钥之一。

So basically, like, the the apps kind of institute a sort of deadline where after that, it forces you to create one of these backup keys.

然后他提议，除此之外，还要预先部署一个“紧急开关”，验证者可以在不进行协议升级的情况下投票切换这个开关，这将强制所有地址进入密码恢复模式。

And then he proposes that in addition, there's a pre deployed kill switch in which validators can, without a protocol upgrade, vote to flip the kill switch, which will force all addresses into cryptographic recovery mode.

后面还有更多细节，但大致就是这个意思。

And there's, you know, more details after that, but that's kind of the overall gist.

我还想提一下Balaji Srinivasan在《The Chopping Block》节目里说的一些观点。

I also wanna call out some things that Balaji Srinivasan said in an episode of The Chopping Block.

他是Network School的创始人。

So he's the founder of Network School.

他说他认为区块链可能需要实施类似这样的机制，引用他的话说，你使用以太坊，通过使用以太坊，你可能需要在链上签署一个声明，大意是如果某个哈希函数或数字签名被破解了，矿工可以把链回滚到一周前或某个时间点的状态。

He said he thought that blockchains might need to implement something like the following, quote, you use Ethereum, and by using Ethereum, you may have to ascend to something on chain that says if there's a hack of, you know, this or that or the other hash hash function that you that, you know, digital that sorry or or like a digital signature or what have you, that miners can then rewind to the state from, like, a week ago or, you know, whatever time frame.

而且交易可以被撤销，所有人在使用前都同意这一点，作为服务条款的一部分。

And that transactions can be reversed and everybody consents to that ahead of time as part of the terms of service.

这非常有意思。

That was super interesting.

在同一期节目里，他还提出了另一个建议，说区块链可能会配备一个带有代币预算的AI，每当有新模型发布时，AI会立即用这个新模型来探测区块链的漏洞，并防御任何潜在的黑客攻击。

And then in another suggestion in the same episode, he said that blockchains might come with an AI that has, like, a token budget so that whenever a new model drops, the AI immediately uses that new AI model to probe the blockchain for vulnerabilities and defend itself against any would be hackers.

但我很好奇你们对这些提议有什么看法，或者你们有没有完全不同的想法。

But I'm curious for, you know, any reactions to any of these proposals, or or if you have a completely different one.

不。

No.

我和Conor只是有点想笑，因为我觉得第二个……

I mean, me and Conor are just chuckling a bit because I think the second one...

实际上，Project Lotto的第一个产品叫“黄页”，正是技术描述的那种东西，那是一个备用方案，比如你签署一条消息，你总能证明你拥有一个比特币，甚至不需要在获得它之后。

Actually, Project Lotto's first product was this thing called Yellow Pages, which was exactly what what technology is describing, which is this fallback solution where like you sign a message and you could always prove you had a Bitcoin, not even after procured it.

我想就这些建议发表一些总体看法。

I think to make a comment broadly on these suggestions.

首先，我觉得，是的，关于“战时模式”之类的创意框架很不错。

First off, I think very, yeah, creative framing on the wartime mode, etcetera.

但我认为……

But I think what's...

有一些……

There are...

比如，这些大体上……

Like, these are broadly...

细节我就不一一说了，但总体建议都挺好的。

I'm not gonna speak to all the details, but broadly good suggestions.

难点在于，我和Conor都能亲身感受到，就是进入这些社区，去推动这件事的讨论。

The challenge, and I can speak firsthand to this, as can Conor, is getting in the the the communities and having the conversation about doing this.

其实我在读Haseeb那篇文章的时候，心里就想，哇。

I actually was like, as as you're reading Haseeb's thing, was like, wow.

我真希望Haseeb能把这篇文章发到比特币邮件列表上，看看会有什么反应。

I really would love Haseeb to send this on the Bitcoin mailing list and see what happens.

这才是最难的地方。

That's the hard part.

难的不是想出办法来缓解这个问题。

The hard part is not coming up with ways in which to mitigate this.

难的是怎么去建立这种共识，而且不只是在一个生态里。

The hard part is how to figure out how to build this consensus, not just even in one ecosystem, right?

我们说的是跨多个生态。

We're talking about across multiple ecosystems.

而且说实话，我觉得现实情况是，那确实是个很好的建议，我很尊重那两位，Haseeb和Balaji，我都认识他们。

And look, I I think the reality is that that's a very good, like, I respect both of those individuals, both Haseeb and Balaji, who I personally know.

但我就是觉得，这更像是那种思想领袖会说的话，对吧？

But I just think it's it's a very like thought leader thing to say, right?

就是说，我们应该这样做。

It's like, this is what we should do.

这是终极目标，但问题是，在……

This is the ultimate thing, but it's like, in the...

但实际操作上，你怎么说服所有这些不同的生态系统都……

But practically speaking, how are you gonna convince all these disparate ecosystems all say...

步调一致呢？

Sing the same sheet of music?

而且我觉得最终，出于实际考虑，最好还是让各个生态系统和它们的利益相关者自己去决定这些问题的答案。

And I think ultimately, I think it's best left to, for practical reasons, best left to the individual ecosystems and their stakeholders to determine the answers to those questions on their own.

当然，如果它们想采纳Balaji或Haseeb的建议，那也很有道理，但我也觉得没那么简单，比如说什么，我们干脆给每个区块链都规定一个代币预算吧。

Now, I think it makes a lot of sense if any of them want to adopt the advice that either Balaji or Haseeb has, but I also don't think it's that simple as like, oh, what if we just like mandated a token budget for every blockchain?

那只是，那只是，我们永远不会生活在那个世界里，这是我个人的看法。

That's just, I mean, that's just, we're never gonna live world is my personal view.

我觉得，是的，我算是个密码学家，我觉得我们应该，我喜欢所有这些创造性的解决方案，过去几周我看到了几百个，可能过去一年里也是。

I think, yeah, I guess I'm a cryptographer, I think we should, you know, I like all these creative solutions and I've seen hundreds of them in the past couple of weeks and probably over the last year.

我内心总有一部分想说，好吧，与其想出更多创造性的解决方案，把精力花在那上面，不如我们直接去做迁移这些系统的工作。

A part of me always kind of want say, well, let's just, you know, rather than coming up with more creative solutions and using that energy over there, like we should just do the work of, you know, migrating these systems.

这并不是说那些创造性的想法不好。

That's not to say those creative ideas are bad.

你知道，它们都是合理的想法。

Know, they're, they're all reasonable ideas.

实际上，亚历克斯的观点是，每条链都必须回答那些问题，每条链都必须有一个终止开关、一个冗余机制、一个万一的预案、一个黑天鹅开关。

Actually, in fact, Alex's point, every channel will have to answer those Every chain will have to have a kill switch, a redundancy mechanism, a what if, a black swan switch.

每条链都必须有哈西布提到的那个东西，就是某种形式的种子证明，这又是我们在Project 11里构建的一个解决方案，哈西布大概就是暗示那个。

Every chain will have to have what, you know, Haseeb is alluding to, which is some sort of proof of seed, which again is a solution that we built at Project 11, which is kind of what Haseeb is hinting at towards there.

这确实是真的。

And that is true.

所有这些事情都需要考虑，但我觉得亚历克斯说得对，80%的工作就是启动迁移。

All of those things will need to be considered, but I think to Alex's point, the 80% of the work is just getting the migration started.

而那部分工作很枯燥。

And that's the boring work.

确实有点枯燥，但没关系。

It's kind of, it is boring and that's fine.

然后所有这些创意解决方案都很重要，但它们解决的是边缘情况。

And then all of these creative solutions are important, but I they're solving for edge cases.

它们解决的是可能出错的问题。

They're solving for things that could go wrong.

我们知道有大量工作要做。

We know there's a huge amount of work to do.

我们今天就可以开始。

We can just get started on that today.

至于那些创意解决方案，我觉得每个生态系统都会非常不同，因为你想向整个加密社区推销这些方案。

And then the creative solutions, what's the point, I think each ecosystem is gonna be very different because you try and pitch that to the entire crypto community.

这就是我们会对所有链采取的做法。

This is what we'll do with all chains.

如果发生这种情况，我们会把所有的链都回滚。

We'll roll them all back if this happens.

我觉得现在这还不现实。

I don't see that being realistic just yet.

祝你好运，Haseeb。

Good luck, Haseeb.

我知道我们得走了，工程师会很不高兴，但我必须问最后一个问题。

So I know we have to go and the engineer's gonna be really mad, but I have to ask one last question.

你最近宣布了Strongpoint，这是一个面向后量子密码学过渡的新型机构托管平台。

You re-, you recently announced Strongpoint, which is a new institutional custody platform for the transition to post quantum cryptography.

而且你让Zcash作为初始开发合作伙伴。

And you have Zcash in as as an initial development partner.

你还和Realm Insurance合作。

You're also partnering with Realm Insurance.

那就跟我们聊聊这个新平台的发展吧。

Go ahead and talk about, you know, this this development in this new platform.

好的。

Yep.

简单打个广告。

Quick plug.

简单来说，Strongpoint 是一个加密敏捷托管解决方案。

So, I mean, very high level of Strongpoint is the crypto agile custody solution.

我们刚才说的那些，比如要具备凭证敏捷性。

So, everything we just said about, Hey, we should do credential agility.

我们正在做的就是这件事。

That's what we're building here.

托管显然是客户、密钥和资金交汇的地方。

Custody is obviously where customers and keys and money intersect.

所以，我们正在构建我们认为未来世界需要的形态，也就是 Strongpoint。

So, we're building what we think the world needs to look like in the future in that Strongpoint.

所以，Zcash基金会是我们的设计合作伙伴。

So, Zcash Foundation is a design partner.

我们一开始就会支持Zcash，还有其他几种资产。

We're gonna be supporting Zcash out the gate along with several other assets.

不过快速提一下Realm，你刚才提到了，我们今天也宣布了，和Realm的这个设计合作，我真的很兴奋。

But touching on Realm real quick, which we, you know, you just highlighted and we've announced today, this design partnership with Realm, I'm very excited about this.

Realm是数字资产领域的保险提供商，是领先的提供商之一。

Realm is an insurance provider in the digital asset space, one of the leading providers.

我们在这方面的工作主要是探索如何给这种风险定价，对吧？

And our work there is really gonna be explore how you can price this risk, right?

理论上，希望到了这个采访或讨论的这个时候，我们已经把所有人都吓坏了，把各种可能出错的方式都讲了一遍，对吧？

In theory, mean, hopefully at this point in this interview or in this discussion, we've scared the living daylights out of everyone and out of all the ways things could go wrong, right?

而保险在一定程度上就是为了缓解这种情况，对吧？

And insurance is there to some extent to mitigate that, right?

但当然，保险的艺术在于能够正确地定价。

But of course the art of insurance is being able to price it properly.