Speaker 1: So I was actually just looking at my phone this morning, right,
Speaker 1: Oh yeah, yeah, just checking my bank balance, sending a text,
Speaker 1: doing a software update, and just kind of hit me.
Speaker 2: Let me guess you have no idea how any of
Speaker 2: it actually stays secure?
Speaker 1: Literally no idea. I mean, I know there's that little
Speaker 1: lock icon in the browser, and I hear the word
Speaker 1: encryption thrown around a lot, right, But if you actually
Speaker 1: ask me to explain how my credit card number doesn't
Speaker 1: just you know, float out into the ether for anyone
Speaker 1: to grab, I've got absolutely nothing.
Speaker 2: Well, you are definitely not alone there. I think for
Speaker 2: most of us, cryptography is basically just magic.
Speaker 1: It really feels like magic.
Speaker 2: It's a black box, you know, the a secret in
Speaker 2: one side and random noise comes out the other. But
Speaker 2: for the people actually building our digital world, treating it
Speaker 2: like magic is well, it's actually incredibly dangerous.
Speaker 1: Because magic isn't real. But the software bugs definitely are.
Speaker 2: Exactly when cryptography breaks, it doesn't just glitch out for
Speaker 2: a second. It fails spectacularly, and that is exactly what
Speaker 2: we are digging into today. We're doing a deep dive
Speaker 2: into serious cryptography.
Speaker 1: Second edition by Jean Feleete almissant. And this isn't just
Speaker 1: some dry textbook right, Like, he's not just writing from
Speaker 1: an ivory tower somewhere.
Speaker 2: Far from it. He's a principal research engineer who deals
Speaker 2: with the actual messy reality of digital asset protection.
Speaker 1: He's a builder, he is.
Speaker 2: If you've ever heard of Blake two or sci fash,
Speaker 2: which are algorithms running on millions of servers literally right now,
Speaker 2: he designed those. So when he talks about how these
Speaker 2: systems break, he really knows where the bodies are buried.
Speaker 1: I actually love the metaphor he uses right at the
Speaker 1: start of the source material. Yeah, he compares learning this
Speaker 1: stuff to mountaineering.
Speaker 2: It's such a great image, he says. The book can
Speaker 2: give you the ropes, the ice axes, the carabineros, right,
Speaker 2: the tools, but you, the reader, you actually have to
Speaker 2: make the ascent yourself. You can't just passively watch someone
Speaker 2: else climb a mountain.
Speaker 1: Well, consider us the surpis for this deep dive. We're
Speaker 1: going to point out the handhold so nobody falls off
Speaker 1: the cliff, because honestly, looking at the table of contents,
Speaker 1: there is some serious math in here.
Speaker 2: There is.
Speaker 1: But before we get to like the complex curves and
Speaker 1: the quantum physics. We really have to start at the
Speaker 1: bottom of the mountain. The foundation of everything randomness.
Speaker 2: Randomness is the fuel. I mean, if you don't have
Speaker 2: high quality randomness, the fanciest encryption algorithm in the entire
Speaker 2: world is completely worthless.
Speaker 1: It's like having a titanium vault door but leaving the
Speaker 1: key right under the doormat exactly And I Stories highlights
Speaker 1: something really interesting about this. Computers are literally designed to
Speaker 1: be logical and predictable, right, so they actually struggle to
Speaker 1: be random. And there was this specific update in the
Speaker 1: second edition about Linux that I found fascinating.
Speaker 2: Oh right, the classic developer debate between dev random and
Speaker 2: dev you random.
Speaker 1: Yeah, what was the deal with that?
Speaker 2: For a long time the advice was super complicated. One
Speaker 2: of them blocked your system until it had gathered enough
Speaker 2: quote unquote environmental noise, and the other one didn't block,
Speaker 2: but was seen as maybe less secure.
Speaker 1: Kind of a headache for engineer, huge headache.
Speaker 2: But Almison points out that in modern Linux kernels those
Speaker 2: two have largely converged. The engineering has just gotten so
Speaker 2: much better at scavenging entropy.
Speaker 1: Entropy being that pure chaos.
Speaker 2: Right, It stavenges it from your keystrokes, your mouse movements,
Speaker 2: even the thermal noise of the hardware itself.
Speaker 1: But when that scavenging fails, man, things go south fast. Yeah,
Speaker 1: there was this case study in the book that absolutely
Speaker 1: blew my mind. The satellite phones.
Speaker 2: Oh, the GMR standards, that is a wild story.
Speaker 1: Yeah, we are talking about phones used in active war
Speaker 1: zones on offshore oil rigs in the middle of the ocean.
Speaker 1: You would completely assume this is military grade Fort Knox
Speaker 1: level stuff.
Speaker 2: You would definitely assume that these are the communication standards
Speaker 2: used by massive vendors like Thria and in Marsot. But
Speaker 2: researchers finally took a hard look at the encryption, specifically
Speaker 2: the GMR one standard, and they found something pretty shocking.
Speaker 2: The algorithm wasn't some cutting edge proprietary sheel ih was it.
Speaker 2: It was basically just a clone of the old A
Speaker 2: fifty two cipher.
Speaker 1: And for those of us who don't have our cipher catalogs,
Speaker 1: memorize what exactly is A fifty two.
Speaker 2: It's the encryption that was used in old two G
Speaker 2: mobile phones. And the kicker is it was known to
Speaker 2: be fundamentally insecure years before this.
Speaker 1: So they literally took a broken lock from an ancient
Speaker 1: Nokia and just slapped it onto a satellite phone.
Speaker 2: Effectively, Yes, GMR one used four linear feedback shift registers
Speaker 2: or LFSRs.
Speaker 1: Okay, can we pause on that linear feedback shift register.
Speaker 1: It sounds like a piece of vintage office equipment. How
Speaker 1: does that actually work?
Speaker 2: Imagine a row of bits, just zeros and ones in
Speaker 2: a ship register. You take the bit at the very end,
Speaker 2: do a little bit of math with it, and feed
Speaker 2: it back into the front, okay, and that shifts everything
Speaker 2: else down the line. It creates this stream of numbers
Speaker 2: that looks random at a glance. But the critical keyword there.
Speaker 1: Is linear, meaning it's simple math.
Speaker 2: Exactly, it's mathematically simple. If an attacker sees enough of
Speaker 2: that output stream, they can and just use basic linear
Speaker 2: algebra to reverse the whole process and figure out the
Speaker 2: internal state.
Speaker 1: So it's totally predictable.
Speaker 2: Highly predictable. And the absolute worst part about the satellite
Speaker 2: phone situation. This wasn't software. This was baked directly into
Speaker 2: the hardware.
Speaker 1: Oh wow, that really ties into the illusion of randomness section,
Speaker 1: because if it's software like a messaging app on my phone,
Speaker 1: the developer can just push an update over Wi Fi
Speaker 1: in twenty.
Speaker 2: Minutes, right, But if it's hardware physically wired inside a
Speaker 2: satellite in orbit or a specialized handset in a war zone,
Speaker 2: you can't just send a patch. You have to physically replace.
Speaker 1: The equipment, which nobody is going to do.
Speaker 2: No. It is the perfect example of why security by obscurity.
Speaker 2: Just blindly trusting a company because they assure you its
Speaker 2: export grade is a massive trap.
Speaker 1: Okay, so LFSRs are kind of the quick and dirty
Speaker 1: way to make a stream of numbers, but the source
Speaker 1: material does mention a much better way to use them
Speaker 1: in the hardware world, right, Yeah. The Grain one to
Speaker 1: eight a algorithm.
Speaker 2: Yes, this is where the engineering actually gets clever. Grain
Speaker 2: one is a stream cipher that tries to safely balance
Speaker 2: speed and security. It uses an LFSR for the rhythm
Speaker 2: and speed because they're incredibly fast and hardware, but it
Speaker 2: pairs it with an NFSR.
Speaker 1: A nonlinear feedback shift register.
Speaker 2: Exactly. The nonlinear part is what adds the actual chaos.
Speaker 2: It mixes the bits back in using logic that isn't
Speaker 2: just simple addition. It breaks that predictability.
Speaker 1: So you have the linear part driving the engine and
Speaker 1: the nonlinear part scrambling the output.
Speaker 2: That's a good way to put it. It is a very
Speaker 2: delicate balance, though. If you get the mathematical mixed wrong,
Speaker 2: you are right back to being vulnerable.
Speaker 1: Okay, so we've got a randomness and we've got our
Speaker 1: stream ciphers. Now let's talk about organizing all that chaos.
Speaker 1: Let's get into.
Speaker 2: Hashing the workhourse of cryptography.
Speaker 1: And specifically this birthday paradox thing. I have to admit
Speaker 1: every single time I hear this concept, if it's to
Speaker 1: stop and literally count on my.
Speaker 2: Fingers, it is incredibly counterintuitive to how human brains work.
Speaker 1: The source says that in a group of just twenty
Speaker 1: three people is a fifty percent chance that two of
Speaker 1: them share the exact same birthday, and that just feels wrong.
Speaker 1: My brain immediately says, well, there are three hundred and
Speaker 1: sixty five days in a year, so I should need
Speaker 1: way more people in the room to get a match.
Speaker 2: It feels wrong because we default to thinking about our
Speaker 2: own specific birthday. We walk into a room and think,
Speaker 2: what are the odds someone in here matches my birthday?
Speaker 1: Right?
Speaker 2: But the math isn't looking for a match to you
Speaker 2: it's looking for any match between any two people in
Speaker 2: the entire group. When you have twenty three people, the
Speaker 2: number of possible pairs cross checking each other is actually
Speaker 2: surprisingly high.
Speaker 1: Okay, that makes sense. Yeah, but why does a cryptographer
Speaker 1: care about a party trick with birthdays?
Speaker 2: Because of collisions. In hashing, you take a file, it
Speaker 2: could be a tiny text document or a massive four
Speaker 2: K movie, and the algorithm crunches it down into a short,
Speaker 2: fixed length unique fingerprint a ESH.
Speaker 1: Right.
Speaker 2: A collision is when two completely different files accidentally produce
Speaker 2: the exact same fingerprint.
Speaker 1: Which I'm guessing is really bad.
Speaker 2: It's catastrophic for things like digital signatures. If I can
Speaker 2: figure out how to create a malicious, virus laden software
Speaker 2: update that has the exact same hash as a legitimate.
Speaker 1: Update, then my computer accepts it as safe exactly.
Speaker 2: It tricks the system, and the birthday paradox tells us
Speaker 2: that finding that collision is so much easier than our
Speaker 2: intuition suggests. Mathematically, if your hash fingerprint is dollar bits long,
Speaker 2: you might think it takes two to the power of
Speaker 2: dollar tries to break it.
Speaker 1: This should be a huge number, right, But.
Speaker 2: To find a collision any collision. It actually only takes
Speaker 2: roughly two to the power of dollar divided by two.
Speaker 1: That is a massive shortcut for an attacker, it really is.
Speaker 2: It's a difference between blindly searching for a specific needle
Speaker 2: in a haystack versus just grabbing any two random pieces
Speaker 2: of hay and checking if they happen to look identical.
Speaker 1: So how do we actually build a hash that resists
Speaker 1: that kind of shortcut. The book spends a ton of
Speaker 1: time on this sponge construction, and I just love the visual.
Speaker 1: Here is it literally acting like a kitchen sponge.
Speaker 2: It really is an apt metaphor. Think about how you
Speaker 2: use a sponge in the sink. It operates in two
Speaker 2: distinct phases. First, you plunge it underwater and let it
Speaker 2: absorbs the liquid. Okay, in the cryptographic algorithm, this is
Speaker 2: called the absorbing phase. You take your blocks of message
Speaker 2: data and you mathematically mix them into the sponge's internal
Speaker 2: state using xor operations, XO.
Speaker 1: Being that fundamental logic gait that flips bits.
Speaker 2: Around correct so the mathematical sponge soaks up all the data. Then,
Speaker 2: once every single piece of your message is absorbed, you
Speaker 2: switch to the squeezing phase. You ring the sponge out
Speaker 2: to get your final hash output.
Speaker 1: And this is the structure that SAHA three.
Speaker 2: Uses, Yes, SAHA three, which is Kekak. And the reason
Speaker 2: the industry loves it is because it's so incredibly versatile
Speaker 2: because of this absorb and squeeze structure. You can use
Speaker 2: a sponge for basic harrying, sure, but you can also
Speaker 2: keep squeezing it to generate an endless stream of random.
Speaker 1: Numbers, or use it as a stream cipher exactly.
Speaker 2: It's like a Swiss army knife for cryptography.
Speaker 1: Now, speaking of hashing, we definitely have to talk about
Speaker 1: sci fash. We mentioned earlier that Amisan code designed it,
Speaker 1: but the sources it wasn't even originally designed for encryption, right.
Speaker 2: This is such a fascinating piece of modern Internet history.
Speaker 2: Sifash wasn't built to keep military secrets. It was designed
Speaker 2: to solve a very specific type of denial of service
Speaker 2: attack called hash flooding.
Speaker 1: How does a hash flooding attack work?
Speaker 2: Okay, so think about programming languages like Python or Ruby.
Speaker 2: Under the hood, they use something called hash tables to
Speaker 2: store data quickly. It's essentially a massive digital filing cabinet.
Speaker 2: The program hashes the incoming data to instantly know exactly
Speaker 2: which drawer to drop it into. Super efficient, very efficient,
Speaker 2: unless a hacker figures out your hashing algorithm and intentionally
Speaker 2: sends you a million pieces of junk data that are
Speaker 2: all mathematically calculated to hash to the exact same drawer.
Speaker 1: Oh a collision storm.
Speaker 2: Yes, suddenly your high speed server isn't quickly filing things
Speaker 2: away anymore. It's desperately digging through one massive, overflowing drawer
Speaker 2: trying to find things. It slows the entire server to
Speaker 2: an absolute crawl.
Speaker 1: So the server crashes, but not because it was hacked
Speaker 1: in the Hollywood sense of stealing passwords, but literally because
Speaker 1: it got confused by its own internal filing system.
Speaker 2: Precisely, sifash was specifically designed to be an incredibly fast,
Speaker 2: secure keyed hash function to prevent exactly this. It mixes
Speaker 2: in a secret key so the attacker cannot predict which
Speaker 2: drawer the data will go to. It protects the actual
Speaker 2: infrastructure itself, not just the secrets.
Speaker 1: It's engineering, plain and simple, keeping the pipes from bursting exactly. Okay,
Speaker 1: so we've covered the foothills. We did randomness, we did hashing.
Speaker 1: Now grab your ice axe, because we are tackling the
Speaker 1: big sheer cliff face of the book. Yeah, public key cryptography.
Speaker 1: This is the stuff that lets me send my credit
Speaker 1: card number to a website without a guy in a
Speaker 1: coffee shop van listening in.
Speaker 2: Right, the absolute backbone of the modern Internet.
Speaker 1: And for a really long time, the undisputed king of
Speaker 1: this hill was RSA.
Speaker 2: RSA is the grandfather and its beautiful math. Really it
Speaker 2: relies entirely on the fact that it is very very
Speaker 2: easy for a computer to multiply two massive prime numbers together.
Speaker 2: But it is incredibly mind bogglingly hard to take that
Speaker 2: final massive number and work backward to figure out what
Speaker 2: those two original primes were. Factoring factoring large integers, and
Speaker 2: the book gives some great scale on just how hard
Speaker 2: this is. There's an algorithm called the general number field
Speaker 2: sieve or GNFS. It is currently the absolute fastest way
Speaker 2: we know of to factor these large numbers.
Speaker 1: But fast is a very relative term here, Isn't it
Speaker 1: very relative?
Speaker 2: The source material notes that successfully factoring just a seven
Speaker 2: hundred and sixty eight bit number using GNFS took the
Speaker 2: computational equivalent of two thousand processor years.
Speaker 1: Two thousand years yes, and.
Speaker 2: A seven hundred and sixty eight bit key is considered
Speaker 2: small by today's standards. That is exactly why your bank
Speaker 2: and your browser are using twenty forty eight bit keys
Speaker 2: or even larger. The raw computational power required to break
Speaker 2: that with current classical technology is just astra nomical. It
Speaker 2: is safe because the math is just too hard to reverse.
Speaker 1: But RSA is getting kind of old, isn't it? Like?
Speaker 1: It's clunky? The keys have to be massively huge to
Speaker 1: stay secure. The source says, the industry is moving or
Speaker 1: really has already moved, to elliptic curve cryptography or ECC.
Speaker 2: ECC is definitely the modern standard. It gives you the
Speaker 2: exact same level of security as RSA, but with significantly
Speaker 2: smaller keys, which makes everything faster. Instead of smashing giant
Speaker 2: prime numbers together, we look at the geometric properties of
Speaker 2: points on a curve.
Speaker 1: Now, this was the part of the book where I
Speaker 1: really had to slow down and reread a few times.
Speaker 1: Can you try to visualize this for us? The book
Speaker 1: describes it as a sort of geometric game.
Speaker 2: Let's try picture a standard graph with a smooth, sweeping
Speaker 2: line looping around it. That is your elliptic curve. The
Speaker 2: mathematical game goes like this. You take two distinct points
Speaker 2: on that curve, let's call them point P and point Q.
Speaker 1: Okay, P and Q on the curve.
Speaker 2: Now draw a perfectly straight line through both of them.
Speaker 2: Because of the specific shape of an elliptic curve, that
Speaker 2: straight line is guaranteed to intersect the curve at exactly
Speaker 2: one other place.
Speaker 1: Okay, I'm with you so far.
Speaker 2: You find that third intersection point, and then you reflect
Speaker 2: it straight across the x axis, like dropping a mirror
Speaker 2: image down. That new reflected point is the mathematical result
Speaker 2: of quote unquote adding point P and point Q together.
Speaker 1: It really feels like playing a weird game of billiards
Speaker 1: on a graph.
Speaker 2: It totally does. And if you keep playing that game
Speaker 2: repeatedly adding a point to itself over and over, you
Speaker 2: start bouncing around the curve in this wildly chaotic, seemingly
Speaker 2: unpredictable pattern. The security of ECC comes from what we
Speaker 2: call the discrete.
Speaker 1: Logarithm problem, which is what exactly.
Speaker 2: Basically, if I tell you the exact point where I
Speaker 2: started my game of billiards, and then I show you
Speaker 2: the final point where my ball ended up. You cannot
Speaker 2: easily figure out how many times I hit the ball
Speaker 2: to get there. You can't calculate the number.
Speaker 1: Of hops, and that number of hops is the secret.
Speaker 2: That number of hops is your private key.
Speaker 3: That is genius, really But and there's always a huge
Speaker 3: but when we talk about this stuff, the math can
Speaker 3: be absolutely flawless, and the climbers can still fall right
Speaker 3: off the mountain if they don't tie their knots correctly.
Speaker 2: Implementation is everything.
Speaker 1: We have to talk about the PlayStation three hack because
Speaker 1: this section.
Speaker 2: Was what oh the PS three hack. This is an
Speaker 2: absolute tragedy of implementation.
Speaker 1: I remember when in the Savity it was massive news everywhere.
Speaker 2: So Sony was using ECDSA, the Elliptic Curve Digital Signature algorithm.
Speaker 2: The algorithm itself is incredibly strong, it's the industry standard,
Speaker 2: but the underlying math requires a fresh, completely random number,
Speaker 2: usually referred to as the value K, to generate every
Speaker 2: single signature. And the golden rule of ECDSA is you
Speaker 2: must never ever use the exact same K value twice.
Speaker 1: Let me guess they used the same k.
Speaker 2: They did, and it wasn't just twice. They literally hard
Speaker 2: coded a single static K value into the system. The
Speaker 2: fails offer Flow team, the group of hackers who cracked it.
Speaker 2: They just analyzed a few different game signatures and immediately
Speaker 2: realized that the k value wasn't changing at all.
Speaker 1: And what did that actually allow an attacker to do?
Speaker 2: It takes this impossibly hard cryptographic math and turns it
Speaker 2: into basic high school algebra. Because they now had two
Speaker 2: mathematical equations with the exact same shared variable, they could
Speaker 2: literally just solve for X and X in this case
Speaker 2: was Sony's ultimate private master key.
Speaker 1: That is just wild. So because of one single bad
Speaker 1: random number implementation, these hackers could just sign their own code.
Speaker 2: They could sign anything they wanted. They could run alternative
Speaker 2: operating systems like Linux, pirate games, custom homebrew software. The
Speaker 2: PS three console accepted every bit of it as perfectly
Speaker 2: valid official Sony kind because the cryptographic signature was mathematically perfect.
Speaker 1: It really just drives home the author's point, doesn't It.
Speaker 1: A mathematically strong algorithm is totally useless if the engineering
Speaker 1: surrounding it is lazier weak, absolutely useless. There was one
Speaker 1: other failure mentioned in the book that felt honestly even
Speaker 1: more dangerous because it wasn't just a gaming console being cracked.
Speaker 1: It was the trust of the web itself. The Digito
Speaker 1: Tar disaster.
Speaker 2: Yeah, this is the one that still keeps security professionals
Speaker 2: up at night. The entire secure web HTTPS relies entirely
Speaker 2: on a chain of trust. When you type Google dot
Speaker 2: com into your browser, how does your computer actually know
Speaker 2: it's talking to Google and not some hacker?
Speaker 1: You trust? A Certificate authority a CAA exactly.
Speaker 2: They act as digital notaries. They cryptographically vouch for the
Speaker 2: website's identity. Digito Tar was a major Dutch CAA, but
Speaker 2: in twenty eleven their internal systems were totally compromised. Hackers
Speaker 2: got in and managed to silently issue fake, mathematically valid
Speaker 2: certificates for domains like Google dot com.
Speaker 1: So if I'm just a regular user and my browser
Speaker 1: receives this fake certificate.
Speaker 2: Your browser sees the green padlock icon it says verified
Speaker 2: by Digito Tar. Everything looks one hundred percent secure and normal.
Speaker 2: But it's a trap. The hackers actually use these fraudulent
Speaker 2: certificates to launch massive man in the middle attack against
Speaker 2: Gmail users in Iran.
Speaker 1: Oh wow.
Speaker 2: They were silently intercepting and reading communications that people completely
Speaker 2: believed were securely encrypted.
Speaker 1: It just shows that the chain of trust we all
Speaker 1: rely on is extremely fragile. If just one link breaks,
Speaker 1: if one single notary company gets Lazier gets hacked, the
Speaker 1: whole global system wabbles.
Speaker 2: And once that trust is lost in cryptography, it is
Speaker 2: almost impossible to earn it back. Dignatar went completely bankrupt
Speaker 2: very shortly after that incident.
Speaker 1: Okay, so we've seen how things break in today's world,
Speaker 1: But the book ends by looking at how everything might
Speaker 1: break tomorrow. The ultimate system smasher quantum computing.
Speaker 2: The quantum threat it is looming now.
Speaker 1: Normally, when tech people talk about faster computers, we just
Speaker 1: mean they can guess our passwords faster, right, But the
Speaker 1: book explains that Shor's algorithm, which is designed to run
Speaker 1: on these future quantum computers, is fundamentally different than just
Speaker 1: being fast.
Speaker 2: It is entirely different. It's not just a speed boost.
Speaker 2: Shore's algorithm actually changes the mathematical complexity class the problem.
Speaker 2: Remember how we said earlier that factoring large numbers is
Speaker 2: a quote unquote hard problem.
Speaker 1: Right the two thousand process or years for a small.
Speaker 2: Key, Shor's algorithm turns factoring into an easy task. It
Speaker 2: can solve it in what mathematicians call polynomial time. If
Speaker 2: someone builds a quantum computer big enough and stable enough
Speaker 2: to run it, RSA is just.
Speaker 1: Gone gone, like completely.
Speaker 2: Completely broken, and elliptic curves broken too. The author actually
Speaker 2: notes that a sufficiently powerful quantum computer would reduce the
Speaker 2: security of modern public key cryptography to the level of
Speaker 2: a Caesar cipher.
Speaker 1: Wait, a Caesar cipher like shifting every letter down the
Speaker 1: alphabet by three. That's the secret code I used on
Speaker 1: the playground in third grade.
Speaker 2: Yes, that is the true scale of the threat we
Speaker 2: are talking about here.
Speaker 1: How does it even do that? How is it so powerful?
Speaker 2: It all comes down to quibbits. A classical computer uses
Speaker 2: normal bits. They are strictly a zero or a one.
Speaker 2: A quantum computer uses quibbits, which operate using complax numbers
Speaker 2: and a principle called superposition.
Speaker 1: The book mentioned something about amplitudes on a two D plane.
Speaker 2: Right. Instead of a simple light switch that is either
Speaker 2: on or off, imagine a point moving around on the
Speaker 2: surface of a sphere. Through quantum inspirations like the Hattimer
Speaker 2: gate mentioned in the text, the computer can put these
Speaker 2: corbets into a state where they hold and process huge
Speaker 2: amounts of information simultaneously.
Speaker 1: It just bends the mind, It really does.
Speaker 2: It allows the quantum computer to find the overall period
Speaker 2: of a function, which happens to be the secret mathematical
Speaker 2: backdoor to factoring, almost instantaneously compared to a classical machine.
Speaker 1: That is genuinely terrifying. So if RSA and ECC are
Speaker 1: just doomed, what do we do? Are we literally just
Speaker 1: going back to sending secrets via carrier pigeons?
Speaker 2: No, thankfully not. We move to what's called post quantum cryptography.
Speaker 2: The source spends some time talking about lattice based cryptography
Speaker 2: as the likely successor.
Speaker 1: Lattice based It sounds sturdy, h like a fence.
Speaker 2: It involves finding specific hidden vector in a wildly complex,
Speaker 2: multidimensional grid of points. It is incredibly dense math that,
Speaker 2: at least so far, quantum computers do not seem to
Speaker 2: be inherently good at solving, at least so far. That
Speaker 2: is the big catch. The security of lattice based crypto
Speaker 2: is what we call asymptotic. We think it's extremely hard,
Speaker 2: but we just don't understand the deep mathematical vulnerabilities as
Speaker 2: well as we understand RSA, which we've been testing for decades.
Speaker 2: We are essentially trading a known incoming risk for a
Speaker 2: relatively unknown.
Speaker 1: Risk out of the frying pan and into the multidimensional grid.
Speaker 1: But before we completely wrap up, the second edition of
Speaker 1: the book also added some really interesting new frontiers, specifically
Speaker 1: around blockchain, and honestly glad it did, because usually blockchain
Speaker 1: just gets dismissed in mainstream tech. As you know, crypto
Speaker 1: prices go up, crypto crisis go down.
Speaker 2: Right, the financial speculation overshadows it, but the underlying cryptography
Speaker 2: enabling it is actually fascinating. Chapter fifteen covers some cutting
Speaker 2: edge stuff like BLS signatures.
Speaker 1: What makes a BLU signature.
Speaker 2: So special aggregation? Imagine you have a major network transaction
Speaker 2: that needs to be explicitly approved by a thousand different people.
Speaker 2: In the old cryptographic way, you'd have to append and
Speaker 2: store one thousand separate digital signatures to that file. That
Speaker 2: takes up a massive amount of data space. With BLS,
Speaker 2: you can mathematically mash all one thousand of those signatures
Speaker 2: together into one single compact signature that still proves everyone
Speaker 2: signed it.
Speaker 1: That is huge for scaling a network, it's vital.
Speaker 2: And then there are threshold signatures. Now this sounded like
Speaker 2: something straight out of a Cold war spy movie to me.
Speaker 1: Oh, like the nuclear launch key scenario where two people
Speaker 1: have to turn the keys at the same time.
Speaker 2: Exactly that. You take a single private key and you
Speaker 2: mathematically split it into pieces or shares. You give one
Speaker 2: piece to five different people. You can configure the math
Speaker 2: so that any three of them can combine their pieces
Speaker 2: to sign a transaction. But if only two of them agree,
Speaker 2: it won't work.
Speaker 1: How does the math even handle having just parts of
Speaker 1: the key? Does it just guess the rest?
Speaker 2: No guessing? It uses a concept called lagrange interpolation. Basically,
Speaker 2: the key is hidden on a secret mathematical curve. If
Speaker 2: you have enough points, enough human shares coming together, you
Speaker 2: can perfectly reconstruct the curve and use the secret key.
Speaker 1: And if you don't have enough points.
Speaker 2: If you don't have enough points, you know absolutely nothing.
Speaker 2: It's not like having half a password where you can
Speaker 2: guess the rest. You mathematically have zero information about the key.
Speaker 1: That is so cool. And finally, the term I feel
Speaker 1: like I keep hearing everywhere lately ZK snarks zero knowledge
Speaker 1: proofs ah.
Speaker 2: Yes, this is really the holy grail of digital privacy.
Speaker 1: Right now, as I understand it. It's basically proving I
Speaker 1: know a secret without ever actually telling you what the
Speaker 1: secret is.
Speaker 2: Right. The classic analogy is the magic cave. Imagine I
Speaker 2: know the secret password to open a door deep inside
Speaker 2: a cave. I want to prove to you that I
Speaker 2: know the password, but I refuse to say it out loud. Okay,
Speaker 2: So I go into one side of the cave, I
Speaker 2: use the password to open the door, and I come
Speaker 2: out the side where you are waiting. The only physical
Speaker 2: way I could have done that is if I truly
Speaker 2: knew the secret. I proved it without revealing it.
Speaker 1: But how does that translate mathematically to code?
Speaker 2: Mathematically, it involves turning a standard computer program into a
Speaker 2: massive logical circuit, and then translating that circuit into a
Speaker 2: giant list of mathematical constraints. If I can provide a
Speaker 2: set of numbers that perfectly satisfies all those complex constraints,
Speaker 2: I can cryptographically prove I possess the underlying data without
Speaker 2: ever transmitting the data itself.
Speaker 1: And that's how you get anonymous blockchain transactions.
Speaker 2: Right.
Speaker 1: The network can verify the money is totally real without
Speaker 1: ever seeing who sent it or who received it.
Speaker 2: Exactly. It's incredibly powerful stuff.
Speaker 1: We have honestly covered a staggering amount of ground today,
Speaker 1: from the janky hardware, baked randomness of old satellite phones,
Speaker 1: to quantum killing algorithms, and all the way to zero
Speaker 1: knowledge proofs. If there's one single thing I've learned from
Speaker 1: this deep dive said, cryptography is not a quote unquote
Speaker 1: solved problem.
Speaker 2: Not even close. Cryptography is an internal arms race. It
Speaker 2: is a constant, exhausting battle between mathematical complexity and cryptanalysis.
Speaker 2: The engineers building the walls are permanently racing against the
Speaker 2: hackers building the ladders.
Speaker 1: The author actually ends the book with a bit of
Speaker 1: a sci fi scenario that really stuck with me. It's
Speaker 1: a hypothetical news headline from the year twenty forty eight.
Speaker 2: ACM Inc. Reveals secret quantum computer launches break crypto as
Speaker 2: a service.
Speaker 1: That is just a chilling thought. You wouldn't even need
Speaker 1: to be a nation state hacker anymore. You could just
Speaker 1: rent a server for an hour to break global security.
Speaker 2: It is entirely plausible, And that's exactly why the final
Speaker 2: takeaway from serious cryptography is so critical. As an industry
Speaker 2: and as users, we have to stop treating these systems
Speaker 2: as magical black boxes. We have to treat them as
Speaker 2: rigorous engineering disciplines.
Speaker 1: We have to actually pick up the ropes in the
Speaker 1: ice axes and do the climb ourselves.
Speaker 2: Exactly. You have to be the mountaineer of your own security.
Speaker 2: Don't just blindly trust the little lock icon in your browser.
Speaker 2: Try to understand the architecture that holds it together.
Speaker 1: Well, on that slightly terrifying note, I'm definitely going to
Speaker 1: go update my passwords, check my systems, enter b sources,
Speaker 1: and maybe just wrap my entire phone in aluminum foil.
Speaker 1: Thanks for guiding us through the math and the madness today.
Speaker 2: My pleasure stay secure out there.
Speaker 1: And to you listening, thanks for climbing with us. But
Speaker 1: before you go, just think about this. What if the
Speaker 1: random number generator inside the device you are using to
Speaker 1: listen to this right now is already quietly failing and
Speaker 1: you won't even know it until your entire digital life
Speaker 1: is compromised. Just something to moll over. Catch you on
Speaker 1: the next deep dive