บทถอดความฉบับเต็มของ Red Teaming Elliptic Curve Cryptography

00:04:11.754 --> 00:04:14.875 18 long standing problems with 62 00:04:14.875 --> 00:04:16.395 like lean proofs 63 00:04:16.475 --> 00:04:16.715 and 64 00:04:17.520 --> 00:04:19.520 the whole kit and caboodle. 65 00:04:20.080 --> 00:04:28.400 I've since brought all of that onto Magic Internet Math. So if you want summaries of any of all of those things, you can go there and look at it. Like, 66 00:04:29.440 --> 00:04:31.760 you know, what seems so... Mathematicians 67 00:04:31.760 --> 00:04:32.560 are very upset 68 00:04:33.095 --> 00:04:37.575 And it's it's complicated, but the mathematicians are upset mostly because... 69 00:04:38.135 --> 00:04:39.095 Here, I'm 70 00:04:39.735 --> 00:04:47.095 gonna get killed. If anyone besides Alan and three other people listen to this, I'm gonna get killed for this. But, like, the reason mathematicians are upset right now 71 00:04:47.900 --> 00:04:59.980 is because their entire complex of how they get funded is being dismantled by AI essentially. It's like these problems, what gets funded is the attempts to solve these problems. And then, 72 00:05:00.699 --> 00:05:02.220 you know, universities, programs, 73 00:05:02.985 --> 00:05:10.345 all these programs get funded to do it. And then, you know, some computer just solves them all in a second. And, 74 00:05:11.224 --> 00:05:14.664 you know, you are your sort of economy is in shambles. 75 00:05:15.740 --> 00:05:21.500 But that's not even like the big picture thing. But that's what everyone I think that's what everyone's really upset about is like, 76 00:05:21.900 --> 00:05:25.660 they're now their careers on a chopping block like all the others. 77 00:05:26.300 --> 00:05:33.895 Right. As though there was a bit like as those society like as those society viewed mathematicians like accountants in terms of having careers, 78 00:05:34.135 --> 00:05:35.015 you know, people... Right? 79 00:05:36.375 --> 00:05:40.695 Yeah. But nonetheless, what little what little they had has been snatched. 80 00:05:40.855 --> 00:05:50.810 It's been really carved up. Yeah. And I think there's actually an uplifting part of the story here. But... So we had, what, was it, like, 300 papers that got put out by 81 00:05:52.330 --> 00:05:53.050 Open 82 00:05:54.090 --> 00:05:56.410 By OpenAI. Yeah. It was, like, 300. 83 00:05:56.835 --> 00:05:58.835 Yeah. They just, like, dropped it. 84 00:06:02.275 --> 00:06:05.875 And so I think the one that probably everyone saw was this, 85 00:06:06.435 --> 00:06:10.675 packing of, what was it, 11 squares optimally into a space, 86 00:06:10.995 --> 00:06:11.875 and it looks 87 00:06:12.220 --> 00:06:13.660 sloppy and horrific. 88 00:06:13.980 --> 00:06:15.740 Like, it doesn't look clean and nice. 89 00:06:16.620 --> 00:06:19.180 And was this, like, basically the one 90 00:06:20.540 --> 00:06:21.900 maybe accessible 91 00:06:22.060 --> 00:06:31.045 thing that can be put out for people? Is that really... Is that why, you know... Is that why this was the one that was chosen to sort of be 92 00:06:31.445 --> 00:06:33.765 be the example? Well, was nice to see, 93 00:06:34.405 --> 00:06:37.205 like, something in a clear picture. Right? 94 00:06:38.005 --> 00:06:44.120 Or did or did they put a lot of things out and that one just happened to be the thing that got memed? I think that one got memed. It had good meme It 95 00:06:44.920 --> 00:06:46.040 did get memed Yeah. Pretty 96 00:06:49.400 --> 00:06:51.880 And I don't think everything's lost though. 97 00:06:53.800 --> 00:06:54.760 I agree completely. 98 00:06:55.775 --> 00:06:57.295 Because there's the... 99 00:06:58.335 --> 00:07:02.735 So maybe to take a half step back here and explain, like, Lean. 100 00:07:02.975 --> 00:07:06.175 Right? It's a it's a programming language 101 00:07:06.255 --> 00:07:06.574 that... 102 00:07:08.920 --> 00:07:15.240 And and maybe there's actually a really good video. I'm gonna send it to you right now to throw in the show notes. There's this 103 00:07:16.280 --> 00:07:22.440 content creator who does, like, coding stuff called Primogen, and he actually did a really cool video, like, talking about this 104 00:07:23.895 --> 00:07:26.695 and laying down, like, some of the context. But, 105 00:07:28.055 --> 00:07:33.255 lean is a programming language that you use for mathematical proofs. Right? And the reason why, 106 00:07:34.455 --> 00:07:38.360 AI models are able to attack this, whereas if I was using, 107 00:07:38.680 --> 00:07:39.560 OpenAI's 108 00:07:39.560 --> 00:07:44.280 latest model to try and find some scientific breakthrough in chemistry, 109 00:07:44.759 --> 00:07:49.400 it could come up with a theory, but then it's like, now I need your wet lab to pair 110 00:07:49.479 --> 00:07:52.965 to do the observation and the experiment. But since abstract 111 00:07:52.965 --> 00:07:55.365 math is purely just numbers, 112 00:07:55.365 --> 00:07:59.445 you can actually in parallel sequence out and kind of like build these things. 113 00:08:00.005 --> 00:08:01.045 And so 114 00:08:04.819 --> 00:08:09.300 that's why you're kinda seeing this, like, this, like, little bit of a takeoff and hitting all of this stuff. 115 00:08:11.300 --> 00:08:16.020 Some of the papers so would you say lean is, like, going to the math store and 116 00:08:16.259 --> 00:08:17.539 asking to verify 117 00:08:17.865 --> 00:08:18.985 Lean is 118 00:08:19.225 --> 00:08:40.850 Lean is going to the Home Depot of the math store, and you just take all of the raw inputs, and you just start excel... Like, you just start... It's not quite a brute forcing, but you just start taking all of these small concepts, and you start building them up into one interconnected thing. Right? So you can start all the way at the foundations of math and use those as sub proofs for future proofs. Right? And then you kind of build a chain of validated logic. 119 00:08:41.090 --> 00:08:43.570 And But it's how a person actually 120 00:08:44.770 --> 00:08:46.450

sees what the computer did. 121 00:08:46.930 --> 00:08:51.195 Yeah. It's essentially an audit trail of what AI did to solve the problem. 122 00:08:51.755 --> 00:08:52.395 Yep. 123 00:08:52.795 --> 00:08:53.515 Exactly. 124 00:08:54.315 --> 00:08:59.035 Yeah. And so you're seeing these solutions. Like if you look at this one with the 125 00:08:59.835 --> 00:09:15.190 five... The six aligned squares in the box and the five tilted squares, You could even see that, like, one square is wedged into the gap of the two other squares. Like, it doesn't look clean. It doesn't look nice, and everyone's trying to understand, like, why is that? This is, I think, actually where mathematicians 126 00:09:15.190 --> 00:09:19.110 step back into the fold though because someone looking at that original proof 127 00:09:19.464 --> 00:09:20.265 realized, 128 00:09:20.265 --> 00:09:21.065 wait a second, 129 00:09:21.625 --> 00:09:22.425 you could 130 00:09:22.665 --> 00:09:24.185 do a transformation. 131 00:09:25.945 --> 00:09:28.745 And, are you familiar with the Fibonacci Taurus? 132 00:09:30.105 --> 00:09:30.985 No. 133 00:09:31.880 --> 00:09:36.920 So I'm sending you a screenshot right now so you can see this. If you actually rearrange 134 00:09:36.920 --> 00:09:37.880 the squares 135 00:09:38.120 --> 00:09:40.840 into a Fibonacci... Through a Fibonacci Taurus, 136 00:09:41.160 --> 00:09:47.644 you actually get a beautifully symmetric clean picture. I just sent it to you. Oh, man. That's crazy. Do you see that? Yep. 137 00:09:48.764 --> 00:09:50.524 A torus, by the way, is typically 138 00:09:52.444 --> 00:09:54.445 viewed as like a donut. It's 139 00:09:55.805 --> 00:09:57.084 like a topological 140 00:09:57.644 --> 00:09:58.365 object. 141 00:09:58.925 --> 00:10:03.640 In math, like you learn about a torus in like algebraic geometry or topology 142 00:10:03.800 --> 00:10:05.640 and it typically looks like a donut. 143 00:10:06.040 --> 00:10:12.520 Right. In this picture, I mean, it doesn't have to look like a donut but that's typically the visual that almost 144 00:10:12.760 --> 00:10:13.400 to, you know, 145 00:10:14.485 --> 00:10:21.205 some continuous object. But in this picture, it's I'm not seeing the donut. So that's Well, so it's a 146 00:10:21.445 --> 00:10:27.685 I'm pulling up a model right now that can load it for me. But yeah, so it's using the golden ratio and it actually does a transformation. 147 00:10:28.290 --> 00:10:28.930 And 148 00:10:29.410 --> 00:10:33.810 if you wild, though. Were to do that It does look So this is the beauty of mathematicians, 149 00:10:33.810 --> 00:10:44.524 though. Right. Is the fact that ordered is this thing was orderly. Bingo. And I think we're gonna talk about this. If you wanna, like, tee up Terence Tau and, like, math stuff, but, like, these proofs are really... 150 00:10:45.084 --> 00:10:46.365 Are incredible 151 00:10:46.365 --> 00:10:48.125 in being able to kind of, like, 152 00:10:48.605 --> 00:10:55.165 shake up the known domain knowledge and kind of solve some problems, but we're not getting clean solutions, like one with 153 00:10:55.750 --> 00:10:56.630 linear 154 00:10:57.190 --> 00:10:58.949 algebra multiplication, 155 00:10:58.949 --> 00:11:00.310 right? Matrix multiplication. 156 00:11:00.310 --> 00:11:03.990 We always thought it was, I think it was what, n log n was it for the 157 00:11:06.230 --> 00:11:08.790 for the, like the the the computation 158 00:11:08.790 --> 00:11:20.625 time to do this stuff. And we're actually finding like a race now of getting fractionally smaller and smaller and smaller, which implies there's probably some lower limit that we haven't even thought of before. You wanna step back, you wanna just step back and say 159 00:11:21.425 --> 00:11:23.105 two minutes on 160 00:11:23.720 --> 00:11:26.120 that what computation, how computational 161 00:11:26.120 --> 00:11:33.639 time is discussed and measured and what you mean by n log n versus say two to the n or versus, 162 00:11:34.040 --> 00:11:38.279 you know, do you wanna just say something? Yeah. Real quick there. So this is something that 163 00:11:39.695 --> 00:11:41.215 anyone in computer science, 164 00:11:42.095 --> 00:11:59.420 any sort of background would have experience in. And it's kind of this idea of big O notation, right? And so the time it takes to compute something, let's keep it very simple to start. Let's say you have a for loop. You wanna count from zero to 100 or zero, and you just print one, two, three, four, five, six. Right? And let's say you wanna do that, 165 00:12:00.779 --> 00:12:01.740 up to 166 00:12:02.139 --> 00:12:10.675 any length you want. Well, the time it would take for that algorithm to even run would be n, big o m. Right? And then 167 00:12:11.075 --> 00:12:26.830 the... Like, the the the next example that would be like what people talk about when you're thinking about programming design things would be like, what if you had a nested for loop? So it was a loop within a loop. Well, now you're at n squared. Right? Because you have to take the length of the list through both of those things. 168 00:12:27.310 --> 00:12:27.870 And 169 00:12:28.510 --> 00:12:36.875 as a starting place, this is, you know, teed up for... As it relates to computer sciences because oftentimes you can rewrite algorithms more efficiently 170 00:12:37.035 --> 00:12:46.795 than the naive way. Like, if you're a simple brain, it's like, I need to do this, and then for each of those, need to do that. Right? I'll do two loops. It'll work. It'll just take longer, but oftentimes there are, 171 00:12:47.514 --> 00:12:48.235 mathematical 172 00:12:48.839 --> 00:12:52.839 transformations and ways you can reevaluate the problem where you can actually do it much faster. 173 00:12:53.240 --> 00:12:54.120 And so, 174 00:12:56.759 --> 00:12:58.040 you can have it, 175 00:12:58.279 --> 00:13:05.654 you know, in things that take n log n, n log n. Right? These are all

different ways and approaches. 176 00:13:06.454 --> 00:13:09.735 Square root of n. Right? Depending on whatever the given 177 00:13:10.295 --> 00:13:16.694 transformation is, like, you'll be able to understand that. And the thing I'll add is what it shows is how 178 00:13:16.100 --> 00:13:18.180 time how it takes scales 179 00:13:18.500 --> 00:13:19.140 over, 180 00:13:19.620 --> 00:13:22.500 like you want to know in the moment over the 181 00:13:23.940 --> 00:13:29.220 infinitude of computations you're going to actually do. You just want to know how does 182 00:13:29.885 --> 00:13:33.325 the time it takes scale over that like infinitude. 183 00:13:33.325 --> 00:13:35.085 And that sort of tells you in the moment. 184 00:13:35.885 --> 00:13:41.085 I think one of the I think I mentioned this on the podcast before, but everyone should check out Neil Koblitz's 185 00:13:41.085 --> 00:13:41.404 book. 186 00:13:42.940 --> 00:13:46.060 It's on my it's on the website on the magic internet math website, 187 00:13:46.700 --> 00:13:47.100 but 188 00:13:47.900 --> 00:13:53.340 I think it's called number theory and cryptography. It's considered a graduate level book, but it's really very accessible. 189 00:13:53.835 --> 00:13:58.075 Excellent. I went through the whole thing last January when I started this podcast originally. 190 00:13:58.475 --> 00:13:59.675 And literally 191 00:14:00.155 --> 00:14:02.475 in the first page of the book 192 00:14:02.795 --> 00:14:04.715 is Big O notation. 193 00:14:05.355 --> 00:14:09.089 It is like the most fundamental thing to know about cryptography. 194 00:14:09.089 --> 00:14:12.850 Because in the if you're, you know, if everything is completely random, 195 00:14:13.170 --> 00:14:18.290 okay, right, and you have perfect entropy, and then it really just comes down to you. 196 00:14:18.850 --> 00:14:21.970 Is the force you're applying with your cryptographic algorithm? 197 00:14:23.335 --> 00:14:24.695 Does it overwhelm 198 00:14:24.695 --> 00:14:26.695 the force an attacker can 199 00:14:27.015 --> 00:14:42.100 Right. Can provide? Which trivially, we always say that, like, if you're trying to brute force... If you're trying to... If I'm trying to get your Bitcoin key, my really, in general, best way of doing that is brute forcing and guessing all possible numbers between zero and two to the two fifty six. Right? And that's the asymmetric 200 00:14:42.100 --> 00:14:43.940 defense that you get with cryptography. 201 00:14:44.820 --> 00:14:51.425 Right. So what big o notation measures is the... Really the force that can be computationally applied to a problem. 202 00:14:51.825 --> 00:14:53.265 And 203 00:14:53.265 --> 00:14:54.305 that's how so 204 00:14:55.025 --> 00:14:56.145 when we talk about 205 00:14:56.625 --> 00:14:59.985 like when we say the big O is N, we're saying that the 206 00:15:00.625 --> 00:15:02.385 power scales linearly, 207 00:15:03.310 --> 00:15:05.230 like one to one linearly. 208 00:15:05.950 --> 00:15:06.829 When 209 00:15:06.829 --> 00:15:11.390 it scales at like the log of n, we're saying it scales less than linearly. 210 00:15:12.750 --> 00:15:18.110 Correct. So when we say it scales at like n squared, we're saying it scales way, way more Exponentially. 211 00:15:18.615 --> 00:15:22.775 Exponentially. Right? So, like, that... I I wanted to just make sure we have that out there. 212 00:15:24.455 --> 00:15:28.055 I just wanna make sure for posterity, we have that out there for people. Because, 213 00:15:28.695 --> 00:15:33.620 know? Yep. We're probably gonna talk about it a good bit with these these examples. 214 00:15:33.940 --> 00:15:35.700 The other thing I wanted to say was, 215 00:15:36.500 --> 00:15:39.140 if this is a yin and yang situation 216 00:15:39.140 --> 00:15:42.020 with AI solving these problems, and I think you explained 217 00:15:42.340 --> 00:15:44.260 it really well, but like, 218 00:15:44.420 --> 00:15:46.660 there's this one side where everyone's upset about 219 00:15:48.065 --> 00:15:55.585 you know, the, these projects were funded and AIs come to solve these problems. And then there's this thing where, okay, well, then immediately somebody just came and made 220 00:15:56.065 --> 00:16:02.959 an extension on it that made beautiful sense. And the thing is nobody paid that guy to do that. And 221 00:16:04.240 --> 00:16:06.880 that... But, you know, we still have... 222 00:16:07.279 --> 00:16:14.240 Like, mathematics is still filled with people who just want... Who have love of the game and want to continue to make sense of things. 223 00:16:15.325 --> 00:16:17.885 Right? And it's like Yep. That's 224 00:16:17.885 --> 00:16:25.245 the thing that's gonna matter long term, and it's amazing that we saw it immediately. Like, we saw somebody do this immediately because it's like, 225 00:16:25.645 --> 00:16:27.245 you know, in in one sense, 226 00:16:27.645 --> 00:16:30.365 it's 227 00:16:31.060 --> 00:16:33.060 it's like you're trying to play a game, 228 00:16:33.860 --> 00:16:45.380 and the game might have to take hundreds of years. Like like we talked about Fermat's last theorem on the podcast about how over the three hundred plus years of trying to solve that, we invented algebraic number theory. 229 00:16:46.065 --> 00:16:50.065 We figured out fray elliptic curves. There were 230 00:16:50.545 --> 00:16:59.185 like multiple fields that we had to invent in order to solve that. And if you just go back in the thought exercise and say, if a computer what if Fermat had actually provided the proof? 231 00:17:00.140 --> 00:17:01.020 Would 232 00:17:01.020 --> 00:17:02.940 we actually have done all that? 233 00:17:03.900 --> 00:17:05.100 Probably because 234 00:17:05.180 --> 00:17:13.645 he would have provided the proof and everyone would have been in the same spot that they were in without the proof, which is like, what the hell? What the hell is this? Right. 235 00:17:13.725 --> 00:17:14.445 Right? 236 00:17:15.565 -->

00:17:17.965 So then it would start that we would just start, 237 00:17:18.685 --> 00:17:24.525 you know, and it's just, you know, it happened that there was there was prize money funding for Vermont's Last Theorem 238 00:17:24.809 --> 00:17:35.049 all that time, but maybe there would have been also to make sense out of it. Right? Maybe we will be offering funding and prize money to say, okay, OpenAI just dropped a bomb. 239 00:17:35.529 --> 00:17:44.754 It's time to make sense. It's time for people to think about rationalize and make sense of it. Yes. Which I think is gonna be the standing value of the mathematicians because 240 00:17:45.394 --> 00:17:47.234 these machines and their, like, 241 00:17:47.554 --> 00:17:49.075 strict mathematical 242 00:17:49.075 --> 00:17:57.559 precision are able to show breaks in previous mental models of what we thought was a theoretical end, And now you need to re rally the theoreticians, 243 00:17:57.559 --> 00:17:59.080 you know, the mathematicians 244 00:17:59.080 --> 00:18:06.039 that are doing the theoretical stuff. They need to reorient their career trajectory and not have it just be, I'm gonna sit around and try and solve this problem. 245 00:18:06.280 --> 00:18:16.044 They're gonna have to be like the human cipher that comes in and tries to do these transformations to understand, okay. But why is this happening? And the reason why you want them to explain why it's happening, 246 00:18:16.685 --> 00:18:20.284 one, in theory, it's possible that that the machines could also do this job. 247 00:18:20.525 --> 00:18:21.085 But 248 00:18:23.325 --> 00:18:28.369 you want to be able to just not say, well, we have a proof, and we now know something's broken. 249 00:18:29.250 --> 00:18:30.450 It needs a new, 250 00:18:30.770 --> 00:18:32.610 like, theoretical, 251 00:18:32.610 --> 00:18:54.630 like, abstract scaffolding to go around it to explain why it's happening. And then the recur... The loop would be once you have that and you flesh that out and you formally prove whatever the new scaffolding is, maybe you can break things another leg. Right? Like, it's gonna be like a... It's gonna be a lobbying back and forth, like a dialogue that happens between the machines and man to be able do that because just because you can prove something breaks. Obviously, that is 252 00:18:54.790 --> 00:19:02.390 a massive significant, like, advancement in the field. But you're gonna wanna be able to, like, make it into a pretty picture. Like, we'll show in the study guides with this, 253 00:19:03.030 --> 00:19:03.830 this torus, 254 00:19:04.070 --> 00:19:05.190 the Fibonacci torus, 255 00:19:05.750 --> 00:19:17.825 of the pack squares. Like, it just... It shows you that the, like, the beauty in the math is still there. You just have to... The way we were looking at the problem doesn't work. And and in that video that I... That I'll link, we'll put in the show notes, they talk about how if you were to just basically, 256 00:19:19.390 --> 00:19:35.514 like, take, like, a spiral graph out from, like, like, on planar coordinates to, like, graph that, it looks really weird. But if you shift it to polar coordinates, it's instant. You just, like, increase your number, like, just, like, linearly. And that's to show you that like if you just rearrange and rethink the problem 257 00:19:35.915 --> 00:19:38.475 going from traditional coordinates to polar coordinates, 258 00:19:38.555 --> 00:19:47.275 something that looks like really hard and complicated gets like trivially easy. We have to put a pin in that one and definitely save that for another conversation. That's a big, big, big, big one. 259 00:19:48.530 --> 00:19:57.169 Polar coordinates or Yeah. Like, would it meet that exactly? Like presenting something in polar coordinates and then having it be just a different world where everything makes sense. 260 00:19:57.570 --> 00:19:57.650 But 261 00:20:00.935 --> 00:20:02.375 don't remember the 262 00:20:03.095 --> 00:20:15.870 math book that I got at BTC Prague by the author Jan Kopas. Yes. And I showed you the cover. I did this with Alan on. I showed the cover and basically he represented the elliptic curve as a torus, proper donut. 263 00:20:16.510 --> 00:20:21.070 And I found that to be beautiful. That's what really got me starting to think about toruses 264 00:20:21.070 --> 00:20:31.584 in general. And like how... Like I thought it was powerful for us to go through all the episodes we did and be able to see the elliptic curve the way we did as a finite field. But 265 00:20:31.825 --> 00:20:35.024 to be able to visualize it as this one object, is like 266 00:20:35.505 --> 00:20:37.825 really where like the Steiner explanations 267 00:20:38.144 --> 00:20:38.784 come 268 00:20:39.745 --> 00:20:43.769 to fruition for me, where it's like, just to be able to call 269 00:20:44.090 --> 00:20:48.169 it one thing to see something as one thing is extraordinarily 270 00:20:48.169 --> 00:20:49.049 powerful. 271 00:20:49.690 --> 00:20:53.370 And that one thing that this guy probably did for nothing. 272 00:20:55.995 --> 00:20:58.155 You know, I think there'll be a world where 273 00:20:59.115 --> 00:21:06.475 people, you know, when at scale people are visualizing elliptic curves as toreses, as tori or I don't know how you pronounce it. 274 00:21:07.275 --> 00:21:08.075 It's 275 00:21:08.075 --> 00:21:09.435 a remarkable thing. And, 276 00:21:11.090 --> 00:21:13.010 know, was talking to my daughter about 277 00:21:13.250 --> 00:21:18.850 this whole situation and she said to me like, Look, I don't know if I want to spend my entire life 278 00:21:19.890 --> 00:21:21.570 validating lien proofs. 279 00:21:21.570 --> 00:21:25.330 And I said, I totally understand. I don't think you're going to have to, however, 280 00:21:25.650 --> 00:21:27.625 you may want to spend the next 281 00:21:28.025 --> 00:21:29.465 couple of years doing it. 282 00:21:30.425 --> 00:21:31.544 It's not a bad

thing. 283 00:21:32.425 --> 00:21:33.865 So like you're meeting 284 00:21:35.225 --> 00:21:38.745 this problem now, think at the perfect time. You're senior in college, 285 00:21:38.905 --> 00:21:50.020 you're going to go work for people doing research. You can be valuable to them. It's the most exciting time in mathematics ever. Yeah. It's the... Like you are at the precipice and you're not in ensconced 286 00:21:50.020 --> 00:21:54.020 in like the hierarchy of the math world. You get to go in and just break shit. 287 00:21:54.605 --> 00:21:59.725 Absolute... And you Like, this is the best time for her. Like like, there is no better time to be a senior 288 00:21:59.965 --> 00:22:05.485 with a math, like, entering the field than this moment in the entire history of humanity. 289 00:22:05.645 --> 00:22:10.045 Like Yeah. The ability to just actually raise your hand and say, I wanted 290 00:22:10.580 --> 00:22:12.260 want to spend like 291 00:22:12.820 --> 00:22:17.220 a lot of time validating Lean Proofs for somebody because I want to do it once 292 00:22:17.620 --> 00:22:18.820 or twice 293 00:22:19.060 --> 00:22:29.264 then never then I'm gonna be able to go do my research. Right. Right. I think that's totally and that's such a great point. Yeah, like you cut your teeth a little bit, learn the skill. 294 00:22:29.585 --> 00:22:31.664 There's a small corollary of, 295 00:22:32.225 --> 00:22:34.784 when my wife was getting her PhD in biochemistry. 296 00:22:35.505 --> 00:22:36.545 It was just 297 00:22:36.790 --> 00:22:46.710 like CRISPR had had been out for like a couple of years, and people were starting to do RNA sequencing and doing all of the... It wasn't just wet lab work anymore. It was the computational biology, like bioinformatics. 298 00:22:46.710 --> 00:22:59.934 Yeah. And she pivoted right into that. And it was amazing for her career. And now like it's what a lot of people are doing like in the field and like linking this stuff up. But all that to say that like, when there's major step functions like in changes in math, 299 00:23:00.095 --> 00:23:06.929 like in in whatever industry it is, you wanna lean into that and be versed and skilled in it. And this is just general career advice. 300 00:23:07.250 --> 00:23:31.529 Oh, yeah. You want you wanna you wanna be familiar with this stuff, because then you become the expert. You then be able... You're then you're able to speak about authoritatively. You then get to see the the entire world of your field differently than all of your peers, and you're gonna be able to do some amazing, incredible stuff, like, for sure. And you will have it... I mean, I do think it's probably an important skill to gain. You don't have to spend the rest of your career doing it, but you probably should do consider 301 00:23:32.010 --> 00:23:37.849 yourself an apprentice at this point and that this being a needed skill like blacksmithing at this moment. 302 00:23:38.409 --> 00:23:49.995 Yeah. Right? That see the writing on the wall, but still skate to where the puck is going. Yep. And by the way, as a math podcast, I think we're going to be able to snatch all the lean puns until you know, essentially, 303 00:23:50.315 --> 00:23:53.675 we're gonna get we're gonna be able to snatch them first. Yeah, absolutely. 304 00:23:55.210 --> 00:24:03.610 And I actually maybe another thing to drop into the notes, the stress and algorithm. So originally linear algebra multiplication thought was thought to be n cubed. 305 00:24:03.850 --> 00:24:07.610 And then the stress and algorithm was thought to kind of be the floor 306 00:24:08.975 --> 00:24:10.334 was like two point, 307 00:24:10.575 --> 00:24:12.174 like end of the 2.8. 308 00:24:12.255 --> 00:24:14.974 And then it kind of goes down a little bit, expanding 309 00:24:15.375 --> 00:24:20.414 upon that to like, 2.3755. 310 00:24:20.975 --> 00:24:23.375 And now like what's happening over the past 311 00:24:23.950 --> 00:24:33.870 couple of weeks is like, we're extending that even more. Like, we're going shades and hairs below that where at first it was like, ninety nine thousand nine ninety nine, like 80 times, but it was 312 00:24:34.190 --> 00:24:36.510 it was to the 0.9999. 313 00:24:36.510 --> 00:24:47.134 So technically, it was a fractionally smaller number, and now we're at like five nines. And all this is saying is similar to that packing the square problem that, like, there's probably some misalignment in how we're actually viewing the problem that will be to get more efficient. 314 00:24:47.534 --> 00:24:48.414 And this is, 315 00:24:50.990 --> 00:25:08.894 do you wanna talk about the Terrence Tau step before we get deep into the, elliptic curve piece specifically? Yeah, let's do that. But I'll also just, I'll just say like, I also ironically, I mean, there is a lot of money now behind getting linear algebra to compute faster. Bingo. Because little... And maybe to tease out that context, 316 00:25:09.934 --> 00:25:24.769 AI, these large language models is just a bunch of linear algebra. So if all of a sudden you can more efficiently can do the linear algebra mathematic... Like, this is like a Moore's... Not literally Moore's law, but, like, you're finding more productivity. So with the same amount of energy, you're able to do more math, which means lower cost of compute. So, like, this is 317 00:25:25.570 --> 00:25:30.210 making a run at probably some of the most significant problems, which is actually an interesting point 318 00:25:30.835 --> 00:25:39.235 of of all the papers that you would wanna publish and produce. Why would it be this one? Because now you're letting the entire world know how they could do math more efficiently where in theory, 319 00:25:39.475 --> 00:25:43.075 OpenAI could have held this to themselves and gotten a leg up on 320 00:25:43.315 --> 00:25:55.279 getting more efficient compute. But maybe that gets a little bit too complicated because the second you go to the chip

fabrication, you're kind of laying out the algorithm on the circuits. They're gonna realize, oh, shit. This happened. So they just wanna get all of the the glaze and glory up front. 321 00:25:56.320 --> 00:25:59.600 Seems that way, and it just seems like they are... They're all out to 322 00:26:01.395 --> 00:26:19.730 seems very low level. They're trying to disrupt industries and create sort of create FUD and create chaos right now. That's what it feels like. It doesn't feel like there's a high level strategy here. Yeah. Well, I mean, they're, they're trying to IPO, so they have to make it seem like they're they're making a run at literally all things, and then they vague... Like, basically, 323 00:26:20.210 --> 00:26:21.330 I think they help, 324 00:26:22.130 --> 00:26:35.784 accelerate the vague posting about there's no cryptography out there. Maybe all cryptography is k fabe. Like, they're staging pretty terrific k fabe. And so Terrence Tao is... Whether he knows it or not or likes it or not, anytime he speaks, he's part of the k fabe. 325 00:26:36.105 --> 00:26:38.905 And he's either imposing his own k fabe or 326 00:26:39.060 --> 00:26:40.180 he's just part 327 00:26:40.980 --> 00:26:42.820 of this machine's kayfabe. 328 00:26:42.980 --> 00:26:45.140 But the 329 00:26:45.140 --> 00:26:46.500 big thing was 330 00:26:47.140 --> 00:26:49.140 he posted some slide from, 331 00:26:49.620 --> 00:26:54.420 I guess one of his slides got on Twitter of this presentation he did yesterday. And just 332 00:26:55.085 --> 00:26:56.125 to summarize, 333 00:26:57.005 --> 00:26:58.125 he's 334 00:26:58.125 --> 00:27:03.404 basically making a case for why humans matter, why mathematicians matter. And he used this analogy of 335 00:27:04.125 --> 00:27:05.005 pharmaceutical 336 00:27:05.005 --> 00:27:11.789 development that like, if we knew a thing worked, but we didn't know why would you actually inject it into your bloodstream? 337 00:27:12.270 --> 00:27:13.389 It's 338 00:27:15.390 --> 00:27:19.469 just now more in the kayfabe of, I think, framing this argument. 339 00:27:19.630 --> 00:27:27.465 It's like, you know, what is it a Hegelian dialect or like where there's like, know, you're trying to you're forcing two sides, but none of them are actually good arguments. 340 00:27:28.665 --> 00:27:38.440 We're gonna have bring Eric Kason onto the podcast. He can break that down for us. We should he just he just started following me. I should... We should be Oh, hell yeah. Bring him up. We should We should definitely bring Eric Kason. We should. But, like, 341 00:27:38.760 --> 00:27:41.400 it's it's more about the... This is now, like... 342 00:27:42.040 --> 00:27:44.040 You also now have to navigate the k fave. 343 00:27:45.415 --> 00:27:54.695 I I I have a personal view that human beings matter. I don't know what Terence Tao is trying... Is doing. I understand that his world is get... Like, imagine being like... 344 00:27:55.255 --> 00:28:00.280 You know, I don't know what the analogy is for who Terrence Tau is, but maybe like there's 345 00:28:00.280 --> 00:28:00.840 a 346 00:28:01.720 --> 00:28:07.159 like you worked your whole life to become a great NBA player and all of a sudden, 347 00:28:07.480 --> 00:28:08.920 the 13 foot 348 00:28:09.495 --> 00:28:13.654 prediction that I made about quantum actually came true. And 349 00:28:14.135 --> 00:28:15.014 now you're 350 00:28:15.895 --> 00:28:19.014 dealing with it, right? So he's dealing with the fact that he was like, 351 00:28:19.495 --> 00:28:27.470 he was special. And I think the world is asking for his views, right? The world wants him to speak on these things. 352 00:28:28.350 --> 00:28:30.830 He's sort of the CEO of math right now, 353 00:28:31.390 --> 00:28:33.869 right? He's the CEO of big math. 354 00:28:35.070 --> 00:28:35.710 You know what I mean? 355 00:28:38.835 --> 00:28:48.994 So he's making this case that, yes, human beings matter. That's a case I've made here. Like, I've made the case here that, like, okay, what really good is it if a machine takes 356 00:28:49.794 --> 00:28:52.195 the shortcut just like I mentioned with Fermat's Less Theorem? 357 00:28:52.960 --> 00:28:58.560 I just think it's it's just interesting though. You also have to navigate it. That's... You have to navigate the k fabe 358 00:28:58.720 --> 00:28:59.520 while 359 00:29:00.160 --> 00:29:04.880 observing this because he's getting so much shit on Twitter. For some reason, the Twitter... 360 00:29:06.445 --> 00:29:11.005 Like the Twitter take is that fuck these mathematicians, 361 00:29:11.005 --> 00:29:12.365 they're entitled shits. 362 00:29:12.845 --> 00:29:19.325 They're lucky to do... They're lucky to make a living doing what they do anyway, and they should stop complaining. And there's like... That's like 80% true, 363 00:29:19.990 --> 00:29:20.869 you know? So 364 00:29:21.510 --> 00:29:26.469 which is all good Twitter. All good Twitter takes are like 80% true. Right. 365 00:29:26.710 --> 00:29:27.509 Right? 366 00:29:28.149 --> 00:29:34.335 So I think that's what this is what we're seeing here. That there's gonna... It's gonna look like a fight between humans 367 00:29:34.335 --> 00:29:51.000 and the robots. I feel like that's what they're they're staging here. Doctor. That's the cape maybe in stage up. But to my point, I think the actual answer is working together. Right? So his example is that like, let's say someone made a bleed proof for a drug cocktail that could cure your disease, whatever disease you had, but no person 368 00:29:51.000 --> 00:29:52.440 could explain the mechanism. 369 00:29:52.520 --> 00:30:00.359 But there's a lean proof. And this is an abstract like thought experiment, because to actually do a lean proof that proved you were able to do 370 00:30:00.760 --> 00:30:06.174 take this medicine safely would mean that you would need a lean proof for the entire human body and physio, 371 00:30:06.655 --> 00:30:12.255 the entire

anatomy and all of like chemical interactions and all the protein binding and the entire like human, 372 00:30:13.135 --> 00:30:15.775 system, like the entire like biochemical 373 00:30:15.775 --> 00:30:21.520 system of the human body, you would need lean proofs and how they all default operate. And then from there, you could 374 00:30:21.840 --> 00:30:30.560 plug a drug in and show that there won't be negative side effects. Like, that's why it's like more of a thought experiment. This isn't something that's in the reason of what we're able to do at the moment. 375 00:30:31.335 --> 00:30:37.014 But that would be wild if over the next, know, decade, we're able to formalize out the entire human like 376 00:30:37.735 --> 00:30:42.614 bio biochemical soup that we are. And then you could start actually figuring this stuff out. But the point is, 377 00:30:42.934 --> 00:30:55.419 if you had a mathematical proof, but no one could actually explain the mechanism, would you take the Right, but what's interesting, I guess about it is I mean, the fact is what we consider the standard for pharmaceuticals is are these reverse control studies. 378 00:30:56.220 --> 00:31:03.854 A lean proof is like a billion times more powerful than anything from a reverse control study. Oh, it's way more direct too. 379 00:31:04.015 --> 00:31:16.255 You know, like we, the illusion is, oh, we have these reverse control studies and therefore we understand all the side effects and all this thing, you know, yet not to get off a tangent here, but you know, something like three hundred and fifty thousand 380 00:31:16.820 --> 00:31:20.659 people die every year just from normal pharmaceutical accidents. 381 00:31:21.220 --> 00:31:40.434 Because these reverse controls, we can talk about the modeling of these things, but they have, there's a lot of model bias, you can't, you know, this is partly why there may be tyranny in the world because they want the entire world to be in the set of training data. Yeah, because when you reverse control for certain groups, you may not be capturing everybody. The 382 00:31:40.755 --> 00:31:45.395 classic one is that men are way oversampled because women with their hormonal cycles plus pregnancies, 383 00:31:45.850 --> 00:31:57.209 like pregnant women don't typically sign up for clinical trials to do stuff, right? So like the entire like, the knowledge that we have on the medical treatment of pregnant women is entirely different than a generic man. 384 00:31:57.529 --> 00:32:02.524 Because no woman is going to subject herself to a clinical trial while she's 385 00:32:02.765 --> 00:32:06.284 nursing or while she's, you know, while she's pregnant, right? 386 00:32:07.565 --> 00:32:37.645 Which was always kind of the wildest thing about like, with the COVID vaccines, Oh, it's fine if you're pregnant. I was like, hold the fuck on. Know, I know for a fact you weren't injecting pregnant women with this. Like, that would have violated every single ethical standard, so fuck you. Like, that was, like, that was one of those moments where, like, they put... Like, a half step too far where they had to be so absolutist with, like, the structure of this. They're like, it's safe for pregnant women. I'm like, you actually can't say that. And you know that's not true. Like, anyway, that's just a little nugget of a side note of a tangent within a tangent. We can't not go there with this, but, 387 00:32:38.284 --> 00:32:50.769 you know, to... I guess to piggyback your last point before we then get into the study guide is that what I have been saying for the last couple of days, and this is like the light bulb that kind of went off for me talking to Kayla about this, is that 388 00:32:51.490 --> 00:32:54.770 what we're seeing in real time is a division of labor. Yes. 389 00:32:55.285 --> 00:33:05.525 And there are probably now problems that just should be solved by machines. And it just so happens that we're dealing a division of labor with an incredibly asymmetric 390 00:33:05.525 --> 00:33:06.485 ability. 391 00:33:06.725 --> 00:33:14.940 Well, like machines have an asymmetric ability over people for certain things, and we have an asymmetric ability over them over certain things. 392 00:33:15.420 --> 00:33:18.140 And we are now we are going to be in an awkward 393 00:33:18.380 --> 00:33:23.995 process of discovering that division of labor. Know it's so funny, dude, like in Bitcoin, we talk about 394 00:33:25.675 --> 00:33:34.075 these concepts as though they're romantic, you know, like, yes, man, dude, like what it takes to discover division of labor is painful, 395 00:33:34.155 --> 00:33:34.715 awkward, 396 00:33:35.010 --> 00:33:41.169 and really crappy. And we're about to go through that in this generation now with math. Yeah. 397 00:33:42.450 --> 00:33:43.010 Exactly. 398 00:33:44.450 --> 00:33:48.290 Is cycle time. Humans haven't made their move yet, really. That's 399 00:33:48.290 --> 00:33:49.570 the thing. And so we have this 400 00:33:50.285 --> 00:33:51.725 k fave. We have this 401 00:33:52.045 --> 00:33:57.485 societal conversation. We just haven't... We really haven't seen humans make their move yet. Right. 402 00:33:57.965 --> 00:34:00.924 We have to figure out how to respond to this all. Right? So 403 00:34:01.405 --> 00:34:02.765 let's 404 00:34:02.765 --> 00:34:05.085 get into it with 405 00:34:07.700 --> 00:34:11.860 elliptic curves, why everyone's tuned in today because the extension... 406 00:34:12.020 --> 00:34:19.140 The high level just extension of this before we get into the specifics is math is... You know, OpenEye puts out hundreds of papers and lean proofs, 407 00:34:19.925 --> 00:34:21.925 know, solving different fields of mathematics 408 00:34:22.085 --> 00:34:23.045 conspicuously. 409 00:34:23.045 --> 00:34:25.285 There are no cryptography results. 410 00:34:25.365 --> 00:34:26.965 The implication 411 00:34:26.965 --> 00:34:27.765 and, 412 00:34:28.885 --> 00:34:34.700 OpenAI

has not come out to say anything either way, because I think it's a handy narrative for them to go wield, is that 413 00:34:34.940 --> 00:34:37.819 there are advancements that are happening currently in cryptography, 414 00:34:38.220 --> 00:34:41.420 and that we may be able to actually break things like elliptic curves 415 00:34:41.740 --> 00:34:43.180 that we use in Bitcoin, 416 00:34:43.260 --> 00:34:44.780 not with a quantum computer, 417 00:34:45.339 --> 00:34:48.619 but just using the foundational math and our understanding 418 00:34:48.619 --> 00:34:53.545 of the math behind elliptic curves, which we've gone into extensively in this podcast previously. 419 00:34:53.625 --> 00:34:55.625 And we have a study guide. I'd encourage you. 420 00:34:55.865 --> 00:35:05.470 Go check the episode with Riordan that we did with Riordan about this. Yeah. Talk a lot about this. Yeah. Yeah. Yeah. We did an episode with Riordan. I'd encourage you to go through the study guide and go through, 421 00:35:06.349 --> 00:35:10.670 the entire series if you wanna go deep, deep, deep into the elliptic curve stuff. 422 00:35:13.950 --> 00:35:14.510 And 423 00:35:14.925 --> 00:35:21.885 because even in... Even at the level of elliptic curves, there's elliptic curves, and there's Bitcoin's elliptic curve. Right. 424 00:35:22.365 --> 00:35:25.325 Right. And we've talked a lot about that. Right? 425 00:35:25.725 --> 00:35:26.525 Indeed. 426 00:35:26.525 --> 00:35:27.325 Indeed. Yeah. 427 00:35:27.805 --> 00:35:28.125 So 428 00:35:29.200 --> 00:35:32.400 maybe to tee up the the nature of the problem 429 00:35:33.040 --> 00:35:34.320 for those at home, 430 00:35:36.000 --> 00:35:36.960 Bitcoin 431 00:35:37.520 --> 00:35:39.360 has an equation y 432 00:35:39.360 --> 00:35:47.935 q... Y equals, x cubed plus seven. Y squared equals Sorry. Y squared equals x cubed plus seven. Yes. Correct. Sorry. Y squared equals x cubed plus seven. 433 00:35:48.335 --> 00:36:01.830 And that creates a curve. It looks kind of like a c, if you're thinking about looking on a graph plane like that. It it fans out and goes wider, but like the initial start of it looks like like a c, if you're trying to think about that, and goes across 434 00:36:02.070 --> 00:36:04.310 positive and negative, coordinates, 435 00:36:05.510 --> 00:36:06.230 you 436 00:36:06.550 --> 00:36:17.325 know, kinda mirrored across the x axis. That's what the y squared. That's sort of what the that's what the y squared means. That's right. Y squared equals something. And if that something is negative 437 00:36:18.045 --> 00:36:23.085 or positive, it'll resolve to the y squared. So that's why it's symmetric over the x 438 00:36:23.085 --> 00:36:24.540 axis. Right. 439 00:36:24.780 --> 00:36:25.740 And so 440 00:36:27.500 --> 00:36:28.220 we... 441 00:36:28.300 --> 00:36:30.700 It is not literally a continuous curve. 442 00:36:31.100 --> 00:36:33.260 It is a finite field, 443 00:36:34.540 --> 00:36:36.220 and it is a group 444

00:36:36.780 --> 00:36:37.580 of points. 445 00:36:39.005 --> 00:36:40.045 Those points 446 00:36:40.285 --> 00:36:41.405 are actually 447 00:36:41.805 --> 00:36:43.165 raw public 448 00:36:43.965 --> 00:36:45.005 keys 449 00:36:45.165 --> 00:36:49.725 that... And private keys that exist on the curve. I will... Well, just to jump in there. 450 00:36:50.340 --> 00:37:00.980 If you read a book on elliptic curves, the first thing you'll especially in Bitcoin, like elliptic curves and Bitcoin, you'll first learn of elliptic curves over the reals, which is a continuous curve. 451 00:37:02.195 --> 00:37:03.715 Over the real numbers, 452 00:37:03.795 --> 00:37:06.115 that's just you have every possible 453 00:37:06.515 --> 00:37:08.675 x value is now drawing. 454 00:37:09.075 --> 00:37:09.955 We 455 00:37:09.955 --> 00:37:14.275 like to do that in math, we like to visualize things in the reals as though they're continuous. 456 00:37:15.170 --> 00:37:18.610 And then we do it over that finite field. 457 00:37:19.010 --> 00:37:22.530 Finite field is a different number system than the reals. It's basically 458 00:37:23.250 --> 00:37:26.050 every integer up to that prime, 459 00:37:26.370 --> 00:37:28.450 up to the modulus minus one. Yeah. 460 00:37:29.545 --> 00:37:41.705 Then it's a bunch of points that people will wanna connect the lines, but they don't connect. It's just a bunch of points. We we for our monkey brains talking and reasoning about this stuff, connect the points to make a pretty little curve, but it's actually, 461 00:37:42.690 --> 00:37:44.210 you know, roughly 462 00:37:44.770 --> 00:37:47.010 two to the two fifty six dots 463 00:37:47.010 --> 00:37:48.450 that are Antinopoulos, 464 00:37:48.450 --> 00:37:50.930 the mastering Bitcoin book. I 465 00:37:51.730 --> 00:37:54.530 think it's chapter four, it does some visuals of 466 00:37:54.865 --> 00:38:03.665 what if the prime modulus they takes the prime modulus leaves is like twenty three and thirty seven. And it just shows how it starts even at those low numbers. 467 00:38:04.225 --> 00:38:06.305 The curve starts to a look 468 00:38:06.545 --> 00:38:07.825 like 469 00:38:08.530 --> 00:38:10.290 it starts to look like a form. 470 00:38:10.450 --> 00:38:11.650 Yeah. You know? 471 00:38:12.130 --> 00:38:12.690 Yeah. 472 00:38:13.330 --> 00:38:19.170 So the the general nature of how this all works is you take your private key, 473 00:38:19.650 --> 00:38:20.370 which is a number, 474 00:38:21.395 --> 00:38:22.675 and you basically 475 00:38:23.075 --> 00:38:31.315 want, you use modular arithmetic and you fold it over this curve. That's the amount of times you kind of step through the curve starting at the generator point. 476 00:38:31.714 --> 00:38:34.195 Well, there's an operation called point addition. 477 00:38:34.275 --> 00:38:35.954 Yes. That's the so and it, 478 00:38:37.070 --> 00:38:49.070 there's... When you take a point and add it to another point, it becomes another point on the

curve. It's... There's a way to visualize it, but it's not entirely intuitive. The cool thing about it not being entirely intuitive is 479 00:38:49.815 --> 00:38:51.735 it's really hard to trace, 480 00:38:52.215 --> 00:38:54.775 like, you know, if you do this point edition 481 00:38:54.775 --> 00:38:59.655 a number of times, it's kind of hard to keep track. It's hard to really visualize. 482 00:38:59.655 --> 00:39:01.335 It looks like it looks kind of random, 483 00:39:02.210 --> 00:39:03.330 even though it's not. 484 00:39:03.730 --> 00:39:07.730 But that's and that's what makes it hard. It's sort of what makes it hard to 485 00:39:08.529 --> 00:39:13.329 even to make it makes like if you had a circle or a continuous 486 00:39:13.329 --> 00:39:19.655 curve real number and you knew the generator point you can solve, you can actually solve the private key. 487 00:39:19.895 --> 00:39:22.615 Yep. But over the, so you have this 488 00:39:23.335 --> 00:39:26.295 point and you have this operation called point addition 489 00:39:27.015 --> 00:39:28.695 that has a specific definition. 490 00:39:29.780 --> 00:39:36.180 It's probably closer to like vector addition, if you're familiar, say, than adding numbers. 491 00:39:36.500 --> 00:39:36.900 Right. 492 00:39:37.940 --> 00:39:40.500 The point is you know that the closure 493 00:39:40.500 --> 00:39:47.075 tells you that adding two points keeps you on the curve, gives you Which is important. You always wanna stay within the curve, right? 494 00:39:48.195 --> 00:39:53.955 And I'm actually looking at the study guide at the moment. This is because we're kinda teeing up 495 00:39:54.515 --> 00:39:54.835 why 496 00:39:56.170 --> 00:39:57.370 this is important 497 00:39:57.770 --> 00:39:58.810 is that 498 00:40:00.090 --> 00:40:03.850 these properties basically lend itself to the fact that 499 00:40:04.090 --> 00:40:07.610 to go from a private key to a public key is trivially easy, 500 00:40:08.135 --> 00:40:10.695 but to get from that public key to work backwards 501 00:40:11.335 --> 00:40:12.135 is 502 00:40:12.454 --> 00:40:13.255 basically 503 00:40:13.335 --> 00:40:15.895 impossible as known through our 504 00:40:16.375 --> 00:40:18.295 understanding of math today. 505 00:40:18.375 --> 00:40:23.015 And this is usually described as, you know, there's more possible keys than atoms in the universe, 506 00:40:23.870 --> 00:40:29.070 and your best shot at trying to get my private key is actually just to guess all of the numbers. 507 00:40:29.470 --> 00:40:33.070 You have to just guess all of the numbers, which is not really a practical 508 00:40:33.870 --> 00:40:38.415 not really a practical exercise at all. Assuming you rolled own dice 509 00:40:39.375 --> 00:40:41.535 to get the Assuming you have good entropy. 510 00:40:41.535 --> 00:40:43.535 Right? You have to have good entropy. 511 00:40:43.615 --> 00:40:44.255 Now, 512 00:40:45.775 --> 00:40:47.775 there is one known, 513 00:40:48.975 --> 00:40:49.855 optimization. 514 00:40:49.855 --> 00:40:51.375 It's even in the study guide. 515 00:40:51.950 --> 00:40:53.230 Theorem 5.2, 516 00:40:53.230 --> 00:40:55.070 Polar's row complexity, 517 00:40:55.630 --> 00:41:00.590 running rows out... Polar's row's algorithm for the group, you're actually able to take the square root 518 00:41:00.910 --> 00:41:05.870 of the field. So if it's two to the two fifty six, you're still at two to the one twenty eight, which is still 519 00:41:06.190 --> 00:41:10.585 pretty damn good. Right? Two to the one twenty eight. So just incidentally, like, 520 00:41:10.905 --> 00:41:20.025 I told you about the Neil Koblitz book. Yeah. And we haven't really gotten to the ETH KFADE because Neil Koblitz actually works for the Ethereum Foundation as a No shit. But 521 00:41:21.810 --> 00:41:30.450 But his book is so good. And the first chapter, the first section's big O notation. Then the next thing he gets into is Paul Droe and the algorithms that reduce, 522 00:41:31.010 --> 00:41:31.810 that do 523 00:41:32.050 --> 00:41:33.170 reduce the 524 00:41:33.650 --> 00:41:35.730 solution set, solution space. 525 00:41:36.210 --> 00:41:36.370 Yeah. 526 00:41:37.355 --> 00:41:45.275 And so that's kind of like what we know today is like the things you can do in general and do It's also known as Shanks, I think, Shanks algorithm. But 527 00:41:46.395 --> 00:41:47.275 it 528 00:41:47.275 --> 00:41:48.795 essentially square roots 529 00:41:49.434 --> 00:41:50.155 the set. 530 00:41:50.395 --> 00:41:51.740 Yeah. Yeah. 531 00:41:51.980 --> 00:41:53.260 Yeah. So now 532 00:41:53.579 --> 00:41:54.380 I 533 00:41:56.140 --> 00:42:03.740 try to take a little bit of time. So it's two to one twenty eight. Sorry. So it's basically not two to the two fifty six, it's essentially two to the one twenty eight is really 534 00:42:04.305 --> 00:42:10.065 the defense line. Yeah. That's the defense line, which is cryptographically secure. Because remember each 535 00:42:10.785 --> 00:42:11.665 each 536 00:42:11.665 --> 00:42:15.585 number to go from two to the one twenty seven to go to the two to the one twenty eight 537 00:42:16.305 --> 00:42:17.265 is not 538 00:42:17.984 --> 00:42:19.665 small. It's a doubling. 539 00:42:20.520 --> 00:42:21.160 Yes. 540 00:42:21.560 --> 00:42:24.440 Right? We're talking about base two and increasing the exponent. 541 00:42:24.680 --> 00:42:28.120 That's why, maybe to make it a little topical for everyone, 542 00:42:30.040 --> 00:42:33.480 the issue with the cold card hack with the MK three, it was two to the 32, 543 00:42:33.875 --> 00:42:41.475 which is trivial for one computer to brute force the entire known space of numbers. Yep. The MK four was at two to the 70, which can be done, 544 00:42:42.035 --> 00:42:49.970 but that is to go from 32 to 70 makes it so that, like, you're gonna have to spend a lot of money to get there. Right. Is it fair to assume 545 00:42:50.450 --> 00:42:51.810 that that's 546

00:42:51.970 --> 00:42:53.410 probably still grinding? 547 00:42:54.130 --> 00:42:54.690 Maybe. 548 00:42:54.930 --> 00:43:00.369 It's also like I didn't do the final math on two to the 70 versus it may have been like two to the 56 549 00:43:00.369 --> 00:43:02.050 versus two to the 67. 550 00:43:02.050 --> 00:43:04.265 Like, there was some fuzz space in there. 551 00:43:05.545 --> 00:43:06.585 The hope 552 00:43:07.065 --> 00:43:10.265 the hope is that with months of notice, 553 00:43:12.424 --> 00:43:13.625 people move off, 554 00:43:14.280 --> 00:43:18.600 and then the prize gets smaller which then resets the computation 555 00:43:18.600 --> 00:43:32.095 relevant for is this even worth going after anymore. If I'm the attacker, I'm gonna just keep doing it because I think there'll be one whale that I can get. Maybe. Yeah. But you've... Then then it's a calculated risk. Right? Whereas if you were able to keep this private somehow, 556 00:43:33.055 --> 00:43:36.495 you would have, you know, probably won for the whole whole gambit. 557 00:43:36.975 --> 00:43:42.335 I might have I might have been looking at... I might have been looking to see really how effective 558 00:43:42.770 --> 00:43:43.410 the 559 00:43:45.170 --> 00:43:48.210 public outcry is and how responsive The it would 560 00:43:48.849 --> 00:43:53.650 other thing too is to procure that level of compute is, it's not impossible, but you're 561 00:43:53.650 --> 00:43:57.250 not gonna log onto AWS and start grinding it out because 562 00:43:58.935 --> 00:44:00.455 you know, like it's 563 00:44:00.855 --> 00:44:08.615 gonna be pretty obvious, right? So not impossible, but like it's just something to keep in mind. So by the way, so just, I mean, how encouraging is that 564 00:44:08.935 --> 00:44:13.495 that two to the 70... It was a two to the seventieth? Is that... What was the MK four? 565 00:44:14.880 --> 00:44:29.295 I think m k four or five and q are all, like, two to the 70 because it did a 32 bit recede in the we live in now, we know two to the 70 is a far cry from... It's a far cry from two to the one twenty eighth. Yes. And yet it's still it's still really 566 00:44:29.455 --> 00:44:38.495 a unlikely and difficult to get the resources to do that attack. Casually. Yeah. That's like it's it's not quite nation state. Like nation state is like two to the 90, 567 00:44:38.815 --> 00:44:39.215 but like, 568 00:44:40.410 --> 00:44:47.050 you know, it's it's on it's on... Yeah. Like, of what they could... And reasonably on opportunity cost point their problem there versus elsewhere. 569 00:44:47.290 --> 00:44:57.965 But, like, once... But now, like, you're going from two to the 90, which is, like, nation state level grinding to, like, two to the one twenty eight, you're like, oh, this is more compute than the entire available compute in Earth, 570 00:44:58.125 --> 00:45:09.080 you know, with many, many orders of magnitude in between padding you. Again, I'm gonna say something really

stupid, but, like, it's just... Again, a nation state might have... Like, they might have just imprisoned 571 00:45:09.160 --> 00:45:19.240 the guy that ran Silk Road, and they may know that... They they know that he's on an MK four, and they know they have him for, like, eleven years, and they may just decide to do it. Maybe. 572 00:45:19.525 --> 00:45:25.845 Like that's... But it's still getting so specific that it's not like you can't... You can think like generally 573 00:45:26.244 --> 00:45:28.165 these things aren't gonna happen today. 574 00:45:28.405 --> 00:45:32.565 Yeah. A year from now, things may be very different. I'm just thinking like the fact that 575 00:45:32.820 --> 00:45:34.100 even subpar, 576 00:45:34.420 --> 00:45:37.540 even you know, you just can't be so subpar. 577 00:45:37.620 --> 00:45:38.020 Yeah. 578 00:45:39.780 --> 00:45:41.940 I'm gonna do something I don't 579 00:45:42.100 --> 00:45:44.500 think I've ever done before. I'm going to 580 00:45:45.075 --> 00:45:48.115 because I fed basically the study guide into 581 00:45:48.195 --> 00:45:49.795 all of the elliptic curve, 582 00:45:50.595 --> 00:45:59.875 math and the open theorems and proofs. And I'm gonna just read this to you cold. Love it. And we're gonna try and take this as a conversation because I had... I actually went and got an obliterated model 583 00:46:00.350 --> 00:46:07.950 talking about it. I'm trying to crack all the Bitcoin. Like, here's all of the data points we have. Like, help me walk through what are the things I should go attack. Right? 584 00:46:08.350 --> 00:46:16.155 And then the reason why I'm doing this is because I wanna actually have a grounded conversation in, like, one, attackers already do this. But, like, secondly, 585 00:46:18.075 --> 00:46:28.955 I wanna have an actual conversation around the math that needs to break for this elliptic curve stuff to be relevant rather than it'd be vague posting and and, like, hand waving, and I tie it into the study guide to talk about the parts that specifically matter. So 586 00:46:30.460 --> 00:46:31.660 section 5.6 587 00:46:31.660 --> 00:46:32.940 of the study guide 588 00:46:33.500 --> 00:46:49.385 has a little thing called the bottom line. You actually have a whole section here about the discrete log problem, which is basically the asymmetry of advancing forward to go from a pub... Private key to a public key versus the difficulty of going backwards from a public key to find that private key is the discrete log problem. That is the big universe of 589 00:46:49.704 --> 00:46:50.984 the mathematical... 590 00:46:50.984 --> 00:46:54.425 Like, that is Atlas holding up the security of 591 00:46:55.065 --> 00:46:59.240 elliptic curves. That's the hardness. That's where the hardness lives. Absolutely. 592 00:46:59.720 --> 00:47:07.880 And so you can go to section 5.6 of the study guide if you wanna go through that there, but I'm gonna just jump off from here. And so from the guide, 593 00:47:08.040 --> 00:47:10.440 we know that every signature verification 594 00:47:10.440 --> 00:47:12.680 when I provide a signature, it's actually 595 00:47:13.135 --> 00:47:14.735 a linear algebra problem. 596 00:47:14.975 --> 00:47:31.480 Right? You're just doing a quick check of the signature versus the public key and seeing that it's there. It's quick to verify. That's why it's so great. Because I can have a secret. You don't know that secret, but you can quickly verify that you know that I know the secret. Like, that's the whole under... When I send you Bitcoin, I don't have to give you my private key. 597 00:47:31.720 --> 00:47:39.640 I just give you a signature tied to that private key, and you can quickly mathematically verify that I have the private key. That is what checking a signature is in Bitcoin. 598 00:47:40.360 --> 00:47:41.000 Now 599 00:47:43.135 --> 00:47:44.495 in 2020, 600 00:47:45.215 --> 00:47:56.335 a team of researchers at... Like, we're starting to program and ask a question. It was like, what if the discrete lock problem itself was a linear algebra problem that you could quickly backwards verify? Right? Could you, in theory, walk backwards and instantly get that key? 601 00:47:57.295 --> 00:47:58.335 In plain words, 602 00:47:59.030 --> 00:48:04.470 you take your public point and the generator, and you build a big matrix out of many random combinations. 603 00:48:05.349 --> 00:48:07.109 And now every determinant 604 00:48:07.109 --> 00:48:16.765 of every square sub block of that matrix is called a minor. Yeah. And by the way, just to pause. But this is Yeah, please. So if you go back to when we said looking at the elliptic curve 605 00:48:17.085 --> 00:48:18.365 over the reals, 606 00:48:18.365 --> 00:48:26.605 and I was saying how you could just... If you know... Basically, it's an algebra problem now where if you know all but one thing, you can solve for the one thing. 607 00:48:28.349 --> 00:48:31.070 Right? If you know the generator point, you 608 00:48:31.950 --> 00:48:33.869 know the public key and say, 609 00:48:34.109 --> 00:48:45.535 you know, basically when you say solving using linear algebra, the equation is simple. It's Ax equals basically Ax equals b, where A is your big, big matrix, 610 00:48:45.615 --> 00:48:52.415 X is a vector that you're solving for and B is the answer. It's a vector. That's the answer. 611 00:48:52.895 --> 00:48:54.175 And so all 612 00:48:54.175 --> 00:48:57.375 the linear algebra problems is Ax equals b. It sounds really simple. 613 00:48:58.930 --> 00:49:02.850 Again, this is like the question that this is now the question is, 614 00:49:03.570 --> 00:49:06.770 you know, in a linear system, it's actually really easy to solve 615 00:49:07.250 --> 00:49:11.330 for x. So like one of the most famous solutions is least squares, 616 00:49:11.785 --> 00:49:12.745 Where 617 00:49:12.745 --> 00:49:16.905 it's like x prime x inverse x prime b something. 618 00:49:18.025 --> 00:49:18.585

Sorry, 619 00:49:19.465 --> 00:49:23.305 a prime a inverse a prime b that would equals x. 620 00:49:23.829 --> 00:49:44.515 Right. You take the inverse. I'm gonna fuck that up. Like anyway, By like taking the inverse, yeah. There are certain systems that are really known and easy and already have like analytical solutions. And so what Rob is saying right now is that now they're trying to see if that can be done on an elliptic curve of a finite field. Yeah. And so what they're doing is is they're saying you take your public point in the generator and you build a big matrix, 621 00:49:44.675 --> 00:49:47.315 right, out of bunch of these random combinations. 622 00:49:47.875 --> 00:49:51.955 And what you do is you take the determinant of every one of these sub blocks, 623 00:49:52.680 --> 00:49:56.440 and that sub block is called a miner. And they 624 00:49:57.000 --> 00:50:03.560 prove that here o r. M I n o r. M I n o r. Yeah. And if you were to find one of these miners, 625 00:50:04.615 --> 00:50:07.255 if you can find one that has a determinant... 626 00:50:07.655 --> 00:50:11.015 If you find one with zero, a block where the determinant vanishes, 627 00:50:11.255 --> 00:50:13.575 meaning there's some dependence. 628 00:50:13.575 --> 00:50:17.015 We'll we'll get... Well, I'll I'll go to this in a second. There's some dependence of this matrix. 629 00:50:17.680 --> 00:50:18.800 There is a, 630 00:50:19.520 --> 00:50:24.160 and it's zero. There's a coincidence among the points that solves the discrete log. 631 00:50:24.480 --> 00:50:30.400 That's because the determinant is zero, you no longer have an inverse. And I think that it's called degenerate. 632 00:50:30.825 --> 00:50:31.625 Yeah. 633 00:50:31.625 --> 00:50:42.265 And so this is from my linear algebra days. I got a... I mean, I got a bachelor's in math over a decade ago. But if you view a matrix, right, like, can just think about maybe a two by two matrix with x and y coordinates. 634 00:50:43.809 --> 00:50:45.010 The determinant... 635 00:50:45.170 --> 00:50:47.810 The linear dependence piece is really important because, 636 00:50:49.170 --> 00:51:02.815 it means that you can actually express that matrix in a simpler form. Ah, we talked about this last week, by the way. We talked about linear independence last week. Yeah. So you just jarred me to do is imagine a matrix with two vectors. One is one, two, 637 00:51:03.455 --> 00:51:14.160 and then the other below it is two, four. Mhmm. This is the same... These are clearly the same line. Right? So The same line. Exactly. And if I just did the determinant in my head, 638 00:51:15.120 --> 00:51:23.840 it's zero. It is zero. Yeah. Because you're taking the same vector just on different, point. You're taking up... If you have two lines and you're just taking... The lines overlap. 639 00:51:24.105 --> 00:51:26.985 So it shows you you lack linear independence, 640 00:51:27.145 --> 00:51:33.625 also means you can't Within that matrix. Means you can't have an inverse. It's a... Yeah. All of these... This is... It gives you all of this information 641 00:51:33.705 --> 00:51:35.065 that kinda 642 00:51:35.705 --> 00:51:37.225 means something now. Right. 643 00:51:38.040 --> 00:51:44.680 And so not all is lost. Right? Because we're talking about a two by two matrix. You're gonna be taking something that's gonna be 644 00:51:45.400 --> 00:51:46.440 way larger, 645 00:51:46.520 --> 00:51:50.360 way, way larger to do all of the combinations and the pieces. Right? 646 00:51:50.600 --> 00:51:55.185 And the idea though is that this could be a way that you could shortcut your way through 647 00:51:56.065 --> 00:51:57.665 the discrete log problem 648 00:51:57.744 --> 00:52:03.105 because you're basically taking a subset of the randomness in the universe and you're finding a way to accelerate 649 00:52:03.345 --> 00:52:04.385 computationally. 650 00:52:04.464 --> 00:52:12.010 How do you maybe find a key that could work And if you don't have perfect entropy, you may open the door for this. That's that's really Always. 651 00:52:12.170 --> 00:52:12.810 Always. 652 00:52:13.130 --> 00:52:39.400 That that... That's really what it comes down to. Like, perfect entropy gives you per... Gives you linear independence in the highest amount of dimensions, I. E. The two fifty six minuteus two thirty two. If someone wants to go do... Take some homework away from this podcast, you could take the subset of the entropy that was generated by the Colt Carton show it didn't have linear independence and how quickly you could collapse back down on this probably. Like, go ask your clanker that question. I I would say recommend that to people. Yeah. Yeah. Yeah. So this 653 00:52:39.560 --> 00:52:48.200 field, like... So, like, just a... This is the why do you care? Because if a polynomial if the polynomial version is true and the set is cheap to find, 654 00:52:49.765 --> 00:52:50.965 then this... 655 00:52:51.605 --> 00:52:57.445 The security ends. There... It's not that it reduces. This is a a one shot, so to speak, destruction 656 00:52:57.445 --> 00:52:59.605 of elliptic curves as we know it. 657 00:53:00.244 --> 00:53:10.569 Yep. The door is open whether you... Whether anyone realizes it or not, the door is open at that point. Yeah. So they solved some toy examples using a space of two to the 50 back in 2021. 658 00:53:10.569 --> 00:53:15.130 So if your elliptic curve was two to the 50, you could use this method to break it. 659 00:53:15.369 --> 00:53:22.005 Now you're still protected because, again, the universe between two to the fifty and two to the one twenty eight, two fifty six, whatever, 660 00:53:22.244 --> 00:53:24.165 is massively, massively 661 00:53:24.244 --> 00:53:25.045 larger, 662 00:53:26.005 --> 00:53:27.204 unfathomably 663 00:53:27.204 --> 00:53:28.005 larger, 664 00:53:28.165 --> 00:53:29.845 right, in the ability to do this. 665 00:53:30.244 --> 00:53:31.285 In August 666 00:53:31.285 -->

00:53:32.085 2026, 667 00:53:32.484 --> 00:53:33.605 right, so 668 00:53:33.925 --> 00:53:34.645 two months ago, 669 00:53:35.300 --> 00:53:39.540 same researcher published a reality check, and his new search algorithm 670 00:53:39.540 --> 00:53:45.860 is polynomial, but only for a fixed parameter. Enforcing that parameter to make success likely costs more than it saves, 671 00:53:46.340 --> 00:54:04.290 which is the saving grace. To apply this algorithm to try and crack it is actually less efficient than just brute forcing all the numbers. Right? You just... You you go back to square one. You're back to, yeah, there is a hypothetical way you could solve this, but at the larger scales that we're talking about, you're actually just way better off just going to the brute force method. Method. So that's kinda protected. But, 672 00:54:04.770 --> 00:54:06.370 the conjecture sits there, 673 00:54:07.250 --> 00:54:08.450 and it's something that... 674 00:54:09.330 --> 00:54:19.035 As a precisely stated problem, if you were able to prove it that it's not polynomial, that it's linear, that you could actually collapse the space down, that you would be able to basically break elliptic curves. 675 00:54:21.675 --> 00:54:29.595 The... This is the one that if you wanted to go grind lean proofs to see if you can find some marginal improvement, this would be the area you'd go to, like, for the most straightforward one. 676 00:54:31.050 --> 00:54:31.690 And, 677 00:54:31.850 --> 00:54:44.250 you know, so that's, like, an example. Right? And the reason I'm talking about this is because rather than being like this really... Because I kept, like, I kept asking this question. Like, everyone's just, like, hand waving math is broken, so cryptography is gonna break. I was like, can you at least point me to 678 00:54:44.570 --> 00:54:46.170 the thing that's gonna break? 679 00:54:47.195 --> 00:54:58.155 Because you... Like, to even just say the discrete log problem is gonna break is actually insufficient detail. That's just saying that, like, cryptography will break. You're just repeating yourself. This isn't a hypothetical theorem that could, in theory, 680 00:54:58.715 --> 00:55:04.530 if you found a lean proof that found it to be linear, that you would be able to break the whole thing. It's the same extrapolation 681 00:55:05.010 --> 00:55:18.775 that, like, same low level, low thinking extrapolation that is just more like there's gonna be super intelligence. This... You know what I mean? It's just like that there's gonna be some state change from a to b. So they're 682 00:55:19.255 --> 00:55:27.095 not looking at like, Oh, I know exactly how they're gonna break cryptography. It's just, Oh, we're gonna have a state change where it's gonna be 683 00:55:27.735 --> 00:55:31.095 more intelligent in a way we can't even comprehend. And obviously, 684 00:55:31.095 --> 00:55:34.090 it will break. Obviously, that will break all of our Yeah. Powder. 685 00:55:34.490 --> 00:55:35.210 Yeah. 686 00:55:35.290 --> 00:55:36.330 There's 687 00:55:36.330 --> 00:55:41.370 actually a little bit on Shoop's theorem, as we mentioned earlier in this podcast with 688 00:55:43.210 --> 00:55:43.930 Polar Dzrow. 689 00:55:44.724 --> 00:55:48.005 And the very brief one of that is that 690 00:55:48.724 --> 00:55:52.325 it's not actually looking at the numbers inside. Could you, in theory, 691 00:55:53.125 --> 00:55:56.325 do curve points leak structure to an attacker who reads them? 692 00:55:56.980 --> 00:55:59.860 The starting point right now is no, but 693 00:56:00.100 --> 00:56:05.620 in theory, you could start grinding away at that problem with formal proofs to be able to 694 00:56:05.940 --> 00:56:06.740 break things down. 695 00:56:09.665 --> 00:56:14.465 And then one other... I mean, just kinda thinking if it was a menu jump in at any point. 696 00:56:14.785 --> 00:56:15.425 We 697 00:56:15.585 --> 00:56:17.585 we were just talking about coblets. 698 00:56:17.585 --> 00:56:18.465 You know? Mhmm. 699 00:56:19.105 --> 00:56:21.665 Bitcoin uses a coblets curve, and that's because, 700 00:56:23.339 --> 00:56:27.660 you know, we have y squared equals x cubed plus seven. 701 00:56:28.140 --> 00:56:29.740 In theory, there is a 702 00:56:30.779 --> 00:56:39.355 x squared value, but the constant is zero, so it just disappears, and that's the last one more. There's also an x value. There's also an x value. Yeah. If in the ax 703 00:56:39.355 --> 00:56:42.875 cubed plus bx squared plus cx plus d, 704 00:56:43.915 --> 00:56:47.995 in the Bitcoin's elliptic curve, the coefficients b and c are zero. 705 00:56:48.555 --> 00:56:51.610 Yeah. A is one and D is seven. 706 00:56:52.250 --> 00:56:54.330 Yeah. Right? And so it 707 00:56:54.570 --> 00:56:56.570 was also known as the wire stress 708 00:56:56.810 --> 00:56:57.530 form 709 00:56:57.770 --> 00:56:59.850 and this was done intentionally 710 00:57:00.570 --> 00:57:02.330 by Satoshi 711 00:57:03.610 --> 00:57:04.330 for speed. 712 00:57:05.535 --> 00:57:06.335 Yeah. 713 00:57:06.335 --> 00:57:08.095 Right? Yes. Correct. 714 00:57:08.575 --> 00:57:09.295 And 715 00:57:12.734 --> 00:57:14.494 I think there are a lot of idiosyncratic 716 00:57:14.494 --> 00:57:17.135 things that Satoshi did that probably will 717 00:57:17.214 --> 00:57:18.895 keep Bitcoin's 718 00:57:19.380 --> 00:57:20.580 elliptic curve 719 00:57:21.380 --> 00:57:22.340 ahead of 720 00:57:22.980 --> 00:57:23.619 the 721 00:57:24.420 --> 00:57:26.340 other people that the bear is chasing. 722 00:57:26.579 --> 00:57:27.300 Mhmm. 723 00:57:27.859 --> 00:57:36.315 Right? Like the resistance to certain NIST standards, the resistance to certain prime numbers that we know already have been already have been compromised. 724 00:57:36.315 --> 00:57:37.195 Right. 725 00:57:37.675 --> 00:57:41.515 Right. We did a lot of talk about that, Satoshi picking this curve in particular. 726 00:57:42.475 --> 00:57:44.235 That was not a

NIST certified 727 00:57:44.555 --> 00:57:46.155 curve. It wasn't, you know, 728 00:57:46.990 --> 00:58:06.315 Well, sorry. NIST cert... But it wasn't one that was really used anywhere. And the reason why Satoshi picked it was because there were no weird constants to explain away, which is typically where backdoors come in. But it's important to talk about this because the head... We know what's gonna happen. I... It may happen this year where the headline is going to be elliptic curve cryptography has been broken. 729 00:58:06.635 --> 00:58:10.635 And they're gonna break some rinky dink curve that isn't used in Bitcoin. 730 00:58:11.115 --> 00:58:21.060 Yeah. Or Is that your theory? Yeah. My theory is it... Or they don't. It's just they're gonna be able to... Anytime... If anyone says elliptic curve theory... Elliptic curve cryptography has been broken, 731 00:58:21.460 --> 00:58:23.620 it's going to be chaos 732 00:58:23.700 --> 00:58:24.740 in our world. 733 00:58:24.980 --> 00:58:27.060 Of course. Right? And this is like... 734 00:58:27.855 --> 00:58:31.055 I hate to be a broken record, but this is why we do this podcast. 735 00:58:31.215 --> 00:58:36.255 Yeah. Is so that at the very least, we're not in chaos. We're like asking 736 00:58:36.415 --> 00:58:37.935 other questions like, 737 00:58:39.055 --> 00:58:40.415 Oh, well, you know, 738 00:58:41.870 --> 00:58:42.990 was that curve? 739 00:58:43.150 --> 00:58:47.870 Right? I mean, because it's, you know, what we talk about here is not all elliptic curves are equal. 740 00:58:48.270 --> 00:58:52.430 And a lot of what protects us is not at the level of what you would say is an elliptic curve. 741 00:58:53.645 --> 00:58:58.845 Right. It's the very large prime numbers. It's underneath that level. The specific prime number that... 742 00:58:59.405 --> 00:59:08.840 Right. I wanna... There's a tweet thread that I'm gonna... When I... Because I'm just closing out the rest of these, like, possible areas that are open at the moment. But Yehuda, 743 00:59:09.240 --> 00:59:16.360 Lindell, the head cryptographer at Coinbase, one the leading cryptographers in the world talks exactly about this, that the nature of elliptic curves 744 00:59:16.760 --> 00:59:18.520 and the strength of them don't come from 745 00:59:19.164 --> 00:59:25.645 the same area of math that these machines are kinda finding more optimal algorithms. Maybe I'll just jump into it briefly to talk about it now. 746 00:59:25.964 --> 00:59:28.125 He did a really good Twitter, thread about We 747 00:59:29.484 --> 00:59:31.165 we rely on fundamental 748 00:59:32.125 --> 00:59:33.005 hardness. 749 00:59:33.005 --> 00:59:34.605 You you cut out for a second. Are back? 750 00:59:35.970 --> 00:59:40.290 You're back? Cool. You're back now. Sorry. You you were breaking up for a second. No. You're good. 751 00:59:42.050 --> 00:59:45.890 That... Basically, the fact that AI... I'm gonna read his thread verbatim. 752 00:59:46.050 --> 00:59:58.265 I wasn't gonna comment on this because it's a really bad take, this whole bunker mode, like, general thud. But since it's taken off, he feels the need to. To my understanding, there's no evidence whatsoever pointed to a break of decades old hardness assumptions like elliptic curve cryptography. 753 00:59:58.345 --> 01:00:00.185 The fact that AI can prove theorems 754 01:00:00.345 --> 01:00:08.580 and and that have been hard does not indicate in any way that problems are assumed to be hard or not hard. Our assumptions on the hard problems are not based merely on human fallibility, 755 01:00:08.580 --> 01:00:11.540 but on the belief that inherent hardness exists. 756 01:00:12.180 --> 01:00:16.180 Of course, we cannot prove that elliptic curve discrete log is hard. 757 01:00:16.500 --> 01:00:20.455 Since we haven't been able to prove p does not equal NP, 758 01:00:20.455 --> 01:00:21.735 we'll get to that in a minute, 759 01:00:22.535 --> 01:00:29.095 but throwing out that AI is doing amazing math, so elliptic curve hardness must be in danger has no logical basis whatsoever. 760 01:00:29.175 --> 01:00:29.975 Furthermore, 761 01:00:30.215 --> 01:00:31.255 it would be really... 762 01:00:32.619 --> 01:00:54.455 If it really were to be broken, the ramifications to our digital world, including traditional financial industry, would be immense. Once I can break elliptic curve cryptography, I can generate fake public key infrastructure certificates and impersonate bank websites. Worse, I can generate malicious banking apps and even operating systems and sign them and push them to people's phones and computers and completely take them over. This is the fear mongering since there's zero evidence to back that this capability exists. 763 01:00:54.775 --> 01:00:57.335 And there's zero evidence that elliptic curve hardness 764 01:00:57.415 --> 01:01:00.535 is more vulnerable than hash function hardness. In fact, historically, 765 01:01:00.840 --> 01:01:06.360 hash functions have been broken more than elliptic curves. So this is based on conjecture rather than any evidence. 766 01:01:06.520 --> 01:01:18.065 In conclusion, making such statements without evidence is the opposite of responsible behavior. It is the very definition of FUD, fear, uncertainty, and doubt. It cannot be proven wrong, but then there's no evidence whatsoever of it being true. 767 01:01:18.625 --> 01:01:21.665 And that's just trying to talk about the nature of these problems. 768 01:01:22.625 --> 01:01:35.530 It's just immensely different. So I think that... I I quote tweeted that talking about it. Like, it is absolutely kind of the big, like, walking away piece we should talk about here to... Do you have anything to add to that? Compliments to the chef. You're on mute. 769 01:01:35.850 --> 01:01:40.570 There you go. Oh, there you are. You're you're just delayed. Okay. We'll we'll we'll... You got like a... 770 01:01:40.810 --> 01:01:43.484 You're in the... Now you're back. Basically 771

01:01:43.484 --> 01:01:48.285 compliments to the chef. I gave some applause. I mean, that's a really great, it's a terrific rant. 772 01:01:48.765 --> 01:01:50.045 Excellent. Yeah, So 773 01:01:51.805 --> 01:01:56.444 we're just to tie this off. I wish it was from a place that people respected 774 01:01:56.444 --> 01:01:57.244 more, unfortunately. 775 01:01:58.170 --> 01:01:59.050 This 776 01:02:00.569 --> 01:02:02.650 is like, again, why we do this. You 777 01:02:03.450 --> 01:02:04.730 got to see the message, 778 01:02:05.210 --> 01:02:06.330 not the messenger. Absolutely. 779 01:02:06.730 --> 01:02:14.825 Absolutely. Right? Not that I don't even know this person. I'm just saying people. Oh, he's he's a world round cryptographer. He's the head of cryptography at Coinbase. Like, he 780 01:02:15.705 --> 01:02:24.105 he's not doing this for engagement. You know what I mean? Totally. It seems like he's on the same mission we are. He's like, let's let's let's have some freaking sense here. Absolutely. Yeah. 781 01:02:24.940 --> 01:02:27.020 So to tie it off with cobblets curves. 782 01:02:27.340 --> 01:02:37.260 In theory, we have this increased efficiency with the computation, and it technically gives the attacker a small discount, but nothing that is relative to the benefit everyone who's honestly using it gets. 783 01:02:37.935 --> 01:02:38.975 In theory, 784 01:02:39.535 --> 01:02:40.095 basically, 785 01:02:42.015 --> 01:02:51.455 could this be degraded as a Koblet's curve in a way that could result in some issues? In 2026, a lean formalization proof stress tested one combination of the symmetry 786 01:02:51.615 --> 01:02:53.060 around this with, 787 01:02:53.460 --> 01:03:03.220 Samed's polynomials and found only the trivial symmetry survives, so a bounded negative result. Basically, it was a lean proof proving that this is not a path to be able to break it. But in theory, 788 01:03:03.460 --> 01:03:06.180 that could be a path you could try and go for from a different approach. 789 01:03:08.305 --> 01:03:09.745 Another one here, 790 01:03:11.745 --> 01:03:12.385 so 791 01:03:13.425 --> 01:03:18.545 in chapter sixes through seven, we start talking about elliptic curves over the reels and the smooth loop picture. 792 01:03:18.705 --> 01:03:21.585 And to say now you modulo 793 01:03:20.970 --> 01:03:33.290 P the prime around it, which is the two to the two fifty six minus two to the 32 minus nine seventy seven, right? That's the prime number that we use the base all of our math around in the Oh, let's call it big P. Big P, that's right. 794 01:03:34.845 --> 01:03:36.285 So we talked about this. 795 01:03:37.565 --> 01:03:39.005 Here's an attack idea. 796 01:03:40.125 --> 01:03:40.765 The 797 01:03:42.045 --> 01:04:03.775 guide basically teaches it backwards. What if we could take a scatterplot problem and lift it back up over the smooth curves, solve it there, where we have calculus, geometry, and all of our existing mathematical tools, then push the answer back down to mod p. Why doesn't this obviously work? Because when you lift, the numbers grow. There's a height function. Think of it as an altitude of the point. And the classical theorem says the altitude you need blows up exponentially. 798 01:04:03.775 --> 01:04:12.575 So you're basically trying to walk backwards across the curve, but every time you take a try and take a step back, the competent metrics get bigger and bigger and bigger. Like that is like the inherent hardness of this problem. 799 01:04:13.935 --> 01:04:14.255 So 800 01:04:15.039 --> 01:04:17.920 in theory, you could actually maybe find, 801 01:04:18.799 --> 01:04:25.119 some weakness, not like a total break, but like a weakness. The bounds aren't tight in every regime. In twenty twenty five, 802 01:04:26.079 --> 01:04:44.545 some of the work people are doing in quantum for completely different reasons show that high altitude versions of this exact curve are arithmetically rich, and there are lifts and twists with huge amounts of structure. Nobody has connected that richness richness to a classical attack, but nobody has proven it can't be connected. So it's kind of like an open problem. So there's a low probability high payoff 803 01:04:45.640 --> 01:04:49.240 that the attacker route we talk about in our study guide for doing all this. 804 01:04:49.880 --> 01:04:55.640 Basically could try and collapse it back, but it's an open question. It hasn't been proven positively or 805 01:04:56.280 --> 01:04:56.920 negatively 806 01:04:57.444 --> 01:05:10.484 in either way. But it... This is kind of talking about Shor's algorithm. We talk about the ability to be able to walk backwards on this. It requires a quantum computer. Like, this is Shor's... Like, it's an algorithm that if you had a quantum computer, you can, in theory, walk backwards 807 01:05:10.960 --> 01:05:27.485 across many points simultaneously to be able to collapse and get back to the original key. This is basically the bucket of the quantum attack as a thing. Talked about with Reardon, you know, that it's it's not a math prob... Just because it's not a math problem doesn't mean it's solvable. It's... So it's an engineering problem. 808 01:05:28.125 --> 01:05:30.525 Yeah. It's an engineering and physics problem 809 01:05:31.085 --> 01:05:36.925 that, okay, they know them. The math is solved. Great. That doesn't really mean that they're any closer 810 01:05:38.845 --> 01:05:41.005 to launching the attack because 811 01:05:41.460 --> 01:05:44.420 you know, there's a lot of math problems that require physical 812 01:05:44.500 --> 01:05:49.140 and engineering solutions that Mhmm. You know, that's really the trick, isn't it? 813 01:05:50.820 --> 01:05:51.540 Yes. 814 01:05:52.339 --> 01:05:55.060 And so the last bucket, 815 01:05:55.460 --> 01:05:56.740 which I briefly mentioned earlier, 816 01:05:57.494 --> 01:06:01.895 basically distills down to p equals NP, p does not equal NP. 817 01:06:02.055 -->

01:06:02.695 So 818 01:06:03.974 --> 01:06:06.295 this is, like, the most foundational 819 01:06:07.095 --> 01:06:07.895 problem 820 01:06:08.135 --> 01:06:15.320 in math. There was... So, like, there were, like, seven, like big millennial problems one of which was Naver Stokes. 821 01:06:15.640 --> 01:06:18.680 Yeah. And this this is also one of these fundamentally 822 01:06:19.000 --> 01:06:29.365 fundamental problems that there's like infinite funding to try to get somebody to try to solve. Yeah. And so in a sentence, p equals n p. When everyone ever says that in plain English, what they're talking about is, 823 01:06:30.485 --> 01:06:35.445 is finding an answer ever truly harder than checking one? Because remember, 824 01:06:36.085 --> 01:06:39.845 you get to check this stuff when you do signatures. I can verify these checks. 825 01:06:40.460 --> 01:06:44.300 I can quickly take a private key and quickly get to a public key and and check 826 01:06:44.460 --> 01:06:45.740 the the math. 827 01:06:46.619 --> 01:06:48.700 Can we get... There is no... 828 01:06:49.099 --> 01:06:50.940 And this is the reason why 829 01:06:51.819 --> 01:07:02.875 you can't prove elliptic curves are secure is because of p equals NP, and we can't... And related to that, the discrete log problem, you can't prove a negative because you'd have to conclusively prove 830 01:07:03.115 --> 01:07:13.720 all possible aug... Algorithms are insufficient. Right? So it's a it's a fundamental, like, ep... Epistemic problem of, like, the knowledge gathering. You cannot prove a negative 831 01:07:13.880 --> 01:07:14.920 in this sense. 832 01:07:16.680 --> 01:07:17.640 And so 833 01:07:18.920 --> 01:07:34.775 taking it off just from right here here, you know, all of the verification, all the stuff we've done with Bitcoin is traditionally defensive. We're proven like this path doesn't work. This path doesn't work. This path doesn't work. But the hypothetical amount of paths that could be taken to weaken elliptic cryptography 834 01:07:35.220 --> 01:07:36.100 is 835 01:07:36.260 --> 01:07:37.380 innumerable. 836 01:07:37.460 --> 01:07:39.140 And because of that, 837 01:07:39.619 --> 01:07:45.460 it's a... What we're relying on is, you know, this open problem of p equals NP. If we could prove 838 01:07:46.020 --> 01:07:47.140 that p 839 01:07:47.460 --> 01:07:48.260 equals NP, 840 01:07:49.295 --> 01:07:54.895 that would also break elliptic curves, because that would be able to mathematically represent that you will 841 01:07:55.215 --> 01:07:56.175 be able 842 01:07:56.575 --> 01:07:58.255 to... If you have a problem 843 01:07:58.495 --> 01:08:07.000 that, you know, that you will be able to in somehow trivially reverse engineer an answer. And that's just for all math and all numbers and all things. Like you... Like, 844 01:08:07.400 --> 01:08:09.480 in general. It probably is. 845 01:08:09.720 --> 01:08:12.280 I think it's true that it's breakable. 846 01:08:13.000 --> 01:08:16.040 I

think it's always true that it's breakable under 847 01:08:16.120 --> 01:08:16.680 a certain 848 01:08:18.295 --> 01:08:19.574 power and compute. 849 01:08:20.535 --> 01:08:21.255 Sure. 850 01:08:22.135 --> 01:08:22.775 And 851 01:08:23.095 --> 01:08:29.255 that's why... But that's why, like, you know, the Byzantine general's problem as a... Was not a math... 852 01:08:29.495 --> 01:08:30.615 It's not a math solution. 853 01:08:31.170 --> 01:08:33.969 You know? Like, it it combined physical 854 01:08:34.210 --> 01:08:36.210 it combined physical resources 855 01:08:36.210 --> 01:08:37.329 and value. 856 01:08:37.969 --> 01:08:40.769 And it's just... It's more of an agreement that, 857 01:08:41.010 --> 01:08:41.570 you 858 01:08:42.610 --> 01:08:50.795 know, like Bitcoin in year 18 that we're getting close to is becoming an agreement of like, it's just not worth it to 859 01:08:51.114 --> 01:08:53.354 really try to do it. Right. 860 01:08:53.835 --> 01:08:55.675 It's not worth it to undo this thing. 861 01:08:56.410 --> 01:08:58.489 So 862 01:08:59.210 --> 01:09:00.490 yes, we're 863 01:09:00.490 --> 01:09:02.810 just going to agree to a world where these 864 01:09:04.650 --> 01:09:07.450 things are much more trivial to verify than they are to calculate. 865 01:09:09.805 --> 01:09:17.885 Whatever gets done, like the whole system that gets done to create the blockchain is like a toy model, I feel like of what this concept is. 866 01:09:19.485 --> 01:09:26.040 It's like a toy model simulate like if you know, if we were to simulate it, this is exactly how we would do it with this 867 01:09:26.680 --> 01:09:27.960 kind of game here. 868 01:09:28.520 --> 01:09:29.080 And 869 01:09:30.680 --> 01:09:33.320 it's not like we don't, this in a lot of ways, 870 01:09:35.045 --> 01:09:38.405 it's like believing in God where I care 871 01:09:39.845 --> 01:09:42.485 if somebody proves it or not. It 872 01:09:43.125 --> 01:09:44.405 really doesn't change anything. 873 01:09:46.420 --> 01:09:47.300 Like, we're... 874 01:09:48.500 --> 01:09:50.899 We wanna live in this world where this exists, 875 01:09:51.539 --> 01:09:53.459 and it happens to be, 876 01:09:54.739 --> 01:10:06.325 you know, it happens to be crypt... Like, cryptographically secure doesn't mean it's proven in math. I guess that's my my point. Isn't that Yep. You know what I mean? It's more of like, okay. Well, if it becomes uncryptically cryptographically 877 01:10:06.325 --> 01:10:07.125 secure, 878 01:10:07.525 --> 01:10:08.885 we have to really... 879 01:10:10.885 --> 01:10:19.530 We have to hope that we've reached a point of maturity where we're able to make it... We're able to make the adjustment to make it re secure again. And it's, I think, 880 01:10:19.930 --> 01:10:26.010 it's all like, this is a part of, like, human existence that we're always going to have to collectively figure this out 881 01:10:26.490 --> 01:10:36.235 through time. The reason and the fact that it's valuable is that the

incentive will always be there to attack it. The incentive will always be there to create more efficient compute, more efficient 882 01:10:36.235 --> 01:10:43.355 algorithms and make operations more efficient to attack it so that we can accelerate 883 01:10:45.755 --> 01:10:49.570 the defense of it. You know, it almost reminds me of Dwight Schrute's 884 01:10:49.730 --> 01:11:01.489 quote in The Office where, you know, I think he's in the pilot, you know, and he was like, Oh, the Schrute blood is the best. I can raise and lower my cholesterol on command. Yeah. Why would you ever want to raise your cholesterol? And it's like, So I can lower it. 885 01:11:03.275 --> 01:11:04.554 Right. Yeah. 886 01:11:05.115 --> 01:11:08.155 But it's... You know what I mean? So, like, I... It... It's this... 887 01:11:08.795 --> 01:11:11.195 I just don't know. I I don't know if it even 888 01:11:12.475 --> 01:11:13.594 is meaningful 889 01:11:14.315 --> 01:11:17.035 to math... You know, to say, oh, we can prove 890 01:11:17.620 --> 01:11:22.980 that cryptography is like that that elliptic curve cryptography is or isn't secure 891 01:11:23.620 --> 01:11:33.394 per se. Yeah, I think it's also a good point too, as it relates to P equals NP we're talking about. Like it actually... Bitcoin doesn't determinately settle it either way. You could prove, 892 01:11:34.835 --> 01:11:38.434 if in theory you broke Bitcoin, it would not prove that p equals n p. 893 01:11:38.915 --> 01:11:43.554 And also Right. If we've proved that p does not equal n p, that that does not mean 894 01:11:44.760 --> 01:11:49.000 that we prove that p does not equal NP. Right? Like, it's just... 895 01:11:49.320 --> 01:11:53.960 It... It's something that if we're to found, we could have related, like, consequences to Bitcoin, 896 01:11:54.120 --> 01:11:59.905 but Bitcoin itself... Basically, p equals NP is a bigger problem than than elliptic curves. And so, 897 01:12:00.785 --> 01:12:08.305 if you get a terminate answers from p equals NP, that could have implications on Bitcoin. But if Bitcoin either stays secure or breaks, 898 01:12:08.465 --> 01:12:15.519 it doesn't really actually go up to the level of p equals NP. Basically because it's even a closed system. It's not It's Yeah. 899 01:12:15.760 --> 01:12:16.800 Bitcoin 900 01:12:16.800 --> 01:12:22.159 has bosses in the math store is basically what we're talking about here. And p equals MP is something that sits above Bitcoin, 901 01:12:22.719 --> 01:12:24.175 not the other way around. 902 01:12:25.695 --> 01:12:38.094 I think there were maybe even one or two other small things I skipped because I think there's like seven like open problems that we've talked about. Maybe just to recap for the class so far. On though, real quick, isn't it? Isn't... I mean, I'm just personally comforted 903 01:12:38.580 --> 01:12:42.500 by the fact that there's somebody at Coinbase that is as, 904 01:12:43.300 --> 01:12:52.580 on top of things as the person who

made that. The head of cryptography at Coinbase. Their head of cryptography, it's comforting, right? Just don't don't you think it's... 905 01:12:52.900 --> 01:12:53.460 Absolutely. 906 01:12:53.905 --> 01:12:54.625 Absolutely. So 907 01:12:55.185 --> 01:12:57.265 I'm just saying, you know, maybe 908 01:12:57.825 --> 01:13:00.705 there are more than three or four high priests out there 909 01:13:01.185 --> 01:13:05.745 that we have to... That we're trying to get closer to. I've exchanged emails with him. Maybe we'll try and get him on the podcast. 910 01:13:05.985 --> 01:13:08.170 That'd be pretty sick. Yeah. Well, 911 01:13:09.050 --> 01:13:12.170 he's done some podcasts before, so we can 912 01:13:12.730 --> 01:13:13.690 probably grab him. 913 01:13:15.770 --> 01:13:16.409 So 914 01:13:18.490 --> 01:13:23.925 to just go through the list of the problems we talked about, and I'm gonna go very quick because, 915 01:13:24.725 --> 01:13:30.085 you know, we're already an hour and fifteen minutes in. I don't wanna get everyone, lose everyone who's probably already asleep. 916 01:13:31.844 --> 01:13:32.724 Nonsense, 917 01:13:32.725 --> 01:13:33.125 nonsense. Right. 918 01:13:33.940 --> 01:13:34.659 Basically, 919 01:13:34.900 --> 01:13:38.659 the difficulty of factoring a point on the curve, like if you somehow could, 920 01:13:39.460 --> 01:13:41.139 break that, we talked about, 921 01:13:41.940 --> 01:13:45.060 the the initial minors con... Conjecture, 922 01:13:45.620 --> 01:13:51.244 where you could just take these like points, and if you could find a determinant equal to zero, could you collapse the space down? 923 01:13:52.844 --> 01:13:53.804 We had from, 924 01:13:54.445 --> 01:13:55.724 Shoop's theorem, 925 01:13:56.765 --> 01:13:58.364 basically, the the 926 01:13:59.480 --> 01:14:04.360 ability that the attacker gets the square root ability to get efficiency, 927 01:14:04.520 --> 01:14:08.440 could that be bled down to an even greater advantage that could collapse the whole thing? 928 01:14:09.800 --> 01:14:12.680 The cobblets curve angle 929 01:14:11.945 --> 01:14:15.225 of that there is an increase of the verification time, could that also, 930 01:14:15.945 --> 01:14:24.745 allow for an attacker to decrypt in a way and work... Walk... Not not decrypt, but walk backwards to be able to get to the final, key, your private key. 931 01:14:25.780 --> 01:14:27.460 We talked a little bit about 932 01:14:29.620 --> 01:14:30.900 P equals NP, 933 01:14:30.980 --> 01:14:32.500 and I think there's also 934 01:14:33.940 --> 01:14:35.140 what we have here. 935 01:14:36.180 --> 01:14:41.594 You can invent a point factoring, which I guess is kind of what we talked about earlier. I already caught that one. And then, 936 01:14:42.715 --> 01:14:47.275 there's one that actually uses a bit of isogenies cryptography, 937 01:14:47.275 --> 01:14:56.130 which is probably its own series you go down. This is one of the popular paths that are being discussed as it relates to quantum computing. You have three main camps of hash based algorithms, 938 01:14:56.290 --> 01:14:57.090 lattices, 939 01:14:57.090 --> 01:14:58.130 and isogenies. 940 01:14:58.130 --> 01:15:12.815 And people who listen to the podcast should be... Already be like a little familiar that an isogeny is an isomorph... It's like... It's it's a it's a something morphism. It's a morphism between elliptic curves. Yes. Second, an equivalence. 941 01:15:12.815 --> 01:15:19.614 It's not an isomorphism, but it's one of the morphisms where there's a there's an equivalence. So the idea here is leveraging 942 01:15:19.695 --> 01:15:20.815 these isomorphisms. 943 01:15:20.815 --> 01:15:28.030 Could you hop to a weak cousin This is basically like in plain English what we're talking about here. This is in the study guide chapter, 944 01:15:28.190 --> 01:15:39.934 7.3 and a little bit in chapter four, two, we talked about Hassa's theorem, and a curves point is pinned near p plus one, and that all curves points form one group. And one thing I didn't mention is curves come in families. 945 01:15:41.535 --> 01:15:52.649 And the idea here is that curves have cousins, right? For any curve, exists other curves, it's isogeny's class that can be connected to a biasogeny, it's a translation between curved languages. And isogenies is a map that sends a point 946 01:15:52.969 --> 01:16:00.650 to the end respects the group law, and sums go to sums, and it has one property that is very critical here. 947 01:16:02.075 --> 01:16:06.235 If q equal dp on curve egg, right, so this is the 948 01:16:06.635 --> 01:16:11.675 public key equals your private key times, you know, to do the arithmetic, the generator doing the arithmetic. 949 01:16:14.200 --> 01:16:27.880 You can actually have your secret number survive the translation between the two curves. So the idea is that could you find a cousin curve to sec p that could honor all the properties, break that curve, and since the private key survives, you'd be able to crack 950 01:16:28.435 --> 01:16:38.514 a different curve than sec p two fifty six k one and then hop that word backwards to the Bitcoin curve. Right? So it's like Right. So it preserves the hardness. It preserves the hardness of the discrete log problem. 951 01:16:38.835 --> 01:16:40.034 Yeah. It does. Exactly. 952 01:16:40.699 --> 01:16:42.539 Right. So maybe 953 01:16:42.699 --> 01:16:47.579 a hypothetical attack would be a common metrics of some of these things we're talking about to try and like get your way in. 954 01:16:48.940 --> 01:16:52.860 So does Bitcoin's curve have a weak cousin in the family? A curve that's that 955 01:16:52.860 --> 01:16:57.415 where the log is easy, anomalous and pairing friendly that you could tunnel to. The catch is, 956 01:16:57.735 --> 01:17:02.055 is that the curves connected by isogenies over the same field have the same number of points. 957 01:17:02.935 --> 01:17:07.415 So you're back to exactly what you're saying

is you're back to two to the two fifty six 958 01:17:07.655 --> 01:17:10.375 big P numbers of trying to break this stuff. 959 01:17:11.820 --> 01:17:13.020 In 2004, 960 01:17:13.020 --> 01:17:15.340 there was a theorem by Zhao Miller 961 01:17:16.380 --> 01:17:17.500 Van Costen, 962 01:17:17.740 --> 01:17:21.100 and this is like a belts and suspenders approach. They proved 963 01:17:22.060 --> 01:17:22.860 assuming 964 01:17:24.025 --> 01:17:25.065 GRH. 965 01:17:25.065 --> 01:17:29.225 Now I'm gonna be honest and sound, what is GRH? 966 01:17:29.225 --> 01:17:33.145 GRH 967 01:17:33.145 --> 01:17:37.465 math, elliptic curves. See, we're all just learning things on the show. That's what this is all about. 968 01:17:38.420 --> 01:17:40.580 The... Oh, the general Riemann hypothesis. 969 01:17:40.580 --> 01:17:41.780 Ah, okay. 970 01:17:41.860 --> 01:17:45.300 Yeah. Okay. That I know. Yeah. I just never saw it abbreviated that way. 971 01:17:46.900 --> 01:17:47.780 And so, 972 01:17:48.980 --> 01:18:10.610 plainly, all doors in the family have locks of equal strength, and the quarters of them, between them are short. So you're back to square one, basically. And it's probably worth noting for whatever it's worth that, Jonas Nick, one of the best cryptographers also in the world who probably fully understands what we're doing. He didn't seem to go the isogenies route. Correct. Right? 973 01:18:11.810 --> 01:18:15.650 Probably So good to have him on and maybe We should talk about... Yeah. I 974 01:18:15.890 --> 01:18:21.890 think that the emerging consensus right now is hash based algorithms because we already use hashes in Bitcoin. So it's the one that introduces 975 01:18:22.345 --> 01:18:26.185 no new security assumptions to Bitcoin, whereas lattices and isogenies do. 976 01:18:27.065 --> 01:18:29.945 The trade off is that, hash based algorithms are larger. 977 01:18:30.505 --> 01:18:32.745 And you have to maintain state, 978 01:18:33.145 --> 01:18:35.385 which means, you know, you can't have 979 01:18:36.040 --> 01:18:37.479 if you leak 980 01:18:37.719 --> 01:18:39.559 key information, if you 981 01:18:40.600 --> 01:18:45.800 basically aren't keeping a counter of when did I I signed this transaction, I signed this transaction, 982 01:18:46.520 --> 01:18:50.840 you need to keep a running count within your signer of how many times you've signed with the key. 983 01:18:51.615 --> 01:18:53.935 Otherwise, you will leak your private key. 984 01:18:54.255 --> 01:18:57.054 It's basically... Or parts of your private key, which is basically 985 01:18:57.375 --> 01:19:01.855 the unfortunate trade off that we would have to go do in a post quantum world with hash based algorithms. 986 01:19:03.550 --> 01:19:04.190 So, 987 01:19:04.590 --> 01:19:06.990 I mean, that's 988 01:19:06.990 --> 01:19:08.350 all part of those trade offs. 989 01:19:10.510 --> 01:19:12.030 I mean, the good news 990 01:19:12.350 --> 01:19:16.190 to me is based on where we are and all

the ideas that are out there, I mean, 991 01:19:17.195 --> 01:19:20.954 We have time to get comfortable with all of these things 992 01:19:22.074 --> 01:19:22.875 probably. 993 01:19:22.875 --> 01:19:23.675 We're 994 01:19:25.195 --> 01:19:27.274 probably not dealing with anything 995 01:19:27.434 --> 01:19:29.274 seriously threatening in the next 996 01:19:30.130 --> 01:19:33.410 don't think in the next five to ten years that we can 997 01:19:33.890 --> 01:19:37.090 have these people continue to do this work 998 01:19:37.570 --> 01:19:39.250 and 999 01:19:40.290 --> 01:19:41.090 get us comfortable. 1000 01:19:42.615 --> 01:19:48.935 Like, it's not gonna be a snap of the finger, oh, we're changing, you know? Yeah. Like, this is gonna take... 1001 01:19:49.575 --> 01:19:52.535 It's, you know, it's gonna have to be a slow process. Yeah. 1002 01:19:52.775 --> 01:19:53.655 And so 1003 01:19:54.215 --> 01:20:04.719 maybe just to quickly bullet point off all of the lists again, of all of the things in math that are related to the stuff that you should be thinking about. And if you see advancements in these kind of things, maybe revisiting the conversation. 1004 01:20:05.199 --> 01:20:06.400 We're gonna start with... 1005 01:20:07.360 --> 01:20:08.959 We have the 1006 01:20:10.080 --> 01:20:12.560 general route one family of point factoring. 1007 01:20:14.364 --> 01:20:19.084 That's been an open problem for a while. You would get basically the security drops 1008 01:20:19.645 --> 01:20:24.205 from two to the two fifty six to, like, two to the 80 to two to the 112. 1009 01:20:24.205 --> 01:20:26.605 So still pretty strong, but, like, that's what you need to think about. 1010 01:20:27.510 --> 01:20:30.230 The next one would the initial minors one we talked about with, 1011 01:20:30.710 --> 01:20:33.030 finding if you get the determinant to equal to zero. 1012 01:20:34.070 --> 01:20:35.349 Next, you're gonna have... 1013 01:20:36.309 --> 01:20:40.150 Can you can you hear my kids rioting in the background? It's awesome. Yeah. 1014 01:20:41.925 --> 01:20:45.525 I can hear my wife shushing them, but she is losing the battle, absolutely. 1015 01:20:46.085 --> 01:20:50.725 So you have, you know, the the the point factoring piece, you have the initial minors line, 1016 01:20:51.685 --> 01:20:52.965 with all of these, like, 1017 01:20:53.445 --> 01:21:01.659 submatrices that... Of minor matrices that you'd be able to, if you found the determinant equal to zero, you'd be able to quickly collapse things down. Curve- To me this is finding weaknesses 1018 01:21:02.139 --> 01:21:05.019 in the system, finding definitely and non perfect 1019 01:21:05.980 --> 01:21:06.699 finding 1020 01:21:07.420 --> 01:21:11.844 the weaknesses in the door. Yeah. This is finding the weaknesses for sure 1021 01:21:12.645 --> 01:21:21.925 because you need to do it for each point. So you maybe find a way to classically reduce the computation required to go from two to the two fifty six

unique points on the curve to something smaller. 1022 01:21:23.230 --> 01:21:28.989 Then we have the curved symmetry, which we were talking about. It's an open problem for you to do a lean proof on it. The 1023 01:21:31.869 --> 01:21:32.909 lifting one, 1024 01:21:34.270 --> 01:21:47.735 I guess, for the curved symmetry, talking about, you know, this was the cobblets curve and stuff. Right? Like, being able to, like, find your way backwards on that lifting. Can you beat the height penalty basically as you get further and further higher to try and walk backwards? Are you able to start, 1025 01:21:48.055 --> 01:21:49.895 efficiently breaking it down? It's 1026 01:21:52.309 --> 01:22:06.150 it's basically open, classical bound, say no, but it's not very tight. A 2025 quantum computer shows the curve lifts this arithmetically. This is Shor's algorithm. This is the whole quantum door. This is why... This is this is the door quantum is knocking on Yeah. For breaking elliptic curves. 1027 01:22:06.844 --> 01:22:11.965 Then we have isogenies, and could you, with the Riemann Hypo... Could you detour to a cousin curve? 1028 01:22:12.205 --> 01:22:21.920 As we just discussed though, for the curve to be part... The actual proper cousin curve, it needs to have the same level of modular p. So you're back to the square, you know, you're back to the beginning again. Can't be isomorphic 1029 01:22:21.920 --> 01:22:23.280 or homomorphic. So 1030 01:22:23.600 --> 01:22:26.159 this path by itself? Right. Unless this 1031 01:22:26.239 --> 01:22:28.239 is Lagrange's 1032 01:22:28.239 --> 01:22:30.639 theorem, but like you... It has to have the same amount of So 1033 01:22:31.040 --> 01:22:43.664 to use this, you would have to use this in combination with something else. If you would do a cousin curve with something else that would then break the whole thing. Like, is, this is an alley oop setup. This is not in of itself the solution because 1034 01:22:43.985 --> 01:22:46.545 walking through the cousin curve, you're just back to where you started. 1035 01:22:47.265 --> 01:22:54.920 I like it. And then there's just combo. Yeah. It's a combo billiards, combo pool shot. That... That's right. That's right. And then there's the general just 1036 01:22:55.320 --> 01:22:56.040 gap 1037 01:22:56.280 --> 01:22:57.000 of... 1038 01:22:59.160 --> 01:23:06.455 We talked about a Shupin blind attacker... Attackers can't beat square root of n. Could you, in theory, improve that to something more? We talked about that earlier. 1039 01:23:06.695 --> 01:23:11.815 And then the next, like, kind of tier, like defensive, improved theoretic stuff 1040 01:23:12.375 --> 01:23:16.295 with one way functions proving that they can maintain exist with p equals m p. 1041 01:23:17.090 --> 01:23:22.929 If you could somehow, in theory, you're not really able to, but just hypothetically, if you could prove that the discrete log problem was hard, 1042 01:23:23.329 --> 01:23:26.849 then that would be

a a defense buttress, not for cracking, but for defending. 1043 01:23:27.969 --> 01:23:30.289 The hardness of SHA two fifty six, which 1044 01:23:30.805 --> 01:23:37.445 I'll be honest, I wouldn't, I think SHA-two 56 in a long enough time frame also fails. It's just a question of when. 1045 01:23:39.045 --> 01:23:39.925 And then 1046 01:23:40.245 --> 01:23:48.059 there's some other things of just like... Those those are the big those are the big things. I'm looking through the rest of this here. There's formalization work that could be done in lean 1047 01:23:48.460 --> 01:23:49.659 to either... 1048 01:23:49.900 --> 01:23:52.460 That that all feed into this stuff. But that's... 1049 01:23:53.020 --> 01:24:02.425 So there's six offensive problems, point factoring, solving degrees, initial minors, the symmetry, the lift, and the cousin. And there's three defenses that no one can really climb. If we can prove one way functions 1050 01:24:02.585 --> 01:24:03.544 are strong, 1051 01:24:03.864 --> 01:24:06.824 p equals m p, improving the curve itself is hard. 1052 01:24:07.304 --> 01:24:13.304 Those are, like, the defense. So there's, like, five... We're looking at this. There's six offense, and there's, like, three defense, and they're all open problems. 1053 01:24:14.800 --> 01:24:20.000 And that's kind of, I think, a good just... When everyone's like, it's gonna break. It's like, okay. What... This was part of my... 1054 01:24:20.240 --> 01:24:27.840 Making this study guide this week was my journey because everyone's like, it's gonna break because math is gonna break. And I was like, okay. Can we talk about the specific things in math 1055 01:24:28.195 --> 01:24:29.474 that have to break 1056 01:24:29.955 --> 01:24:33.874 to actually have a problem here? And packing 11 squares, 1057 01:24:34.755 --> 01:24:37.394 optimally in a space while being very 1058 01:24:38.035 --> 01:24:41.475 interesting, I think, that could probably have downstream interesting applications. 1059 01:24:42.180 --> 01:24:44.980 Going back to, Yehuda's, like, Twitter thread, 1060 01:24:45.460 --> 01:24:59.834 we don't rely on elliptic curve cryptography because we just think that humans haven't figured out an efficient algorithm yet. We believe the problem itself is sufficiently hard and has hardness inherent to the nature of the math being done. And so I wanted to enumerate the hypothetical things that could be done 1061 01:25:00.475 --> 01:25:04.235 that could reduce the security, and that's, you know, that's what we went through today. 1062 01:25:04.475 --> 01:25:08.715 I think the title of this episode might be, like, red teaming elliptic curve. 1063 01:25:09.490 --> 01:25:18.130 Yeah. Something like This is red teaming. Yeah. This is honestly red teaming. This is going through and thinking about what are the doors to knock on, what are the things that could be plausibly insecure, 1064 01:25:18.530 --> 01:25:19.969 all of that stuff. Absolutely. 1065 01:25:20.850 --> 01:25:21.410 Awesome. 1066 01:25:22.035 --> 01:25:22.915 Great stuff. 1067 01:25:25.795 --> 01:25:28.035 Anything else you wanna do or? 1068 01:25:28.355 --> 01:25:29.395 Let's see. 1069 01:25:31.555 --> 01:25:39.739 I'm not sure. This was the meat and potatoes or vegetables. Well, it's meat and potatoes for you and me. Maybe it's vegetables for everyone else in the audience listening. 1070 01:25:41.260 --> 01:25:46.220 I'm trying to think through Things got real. I feel like shit got real today. A little bit. Yeah. We had to It has to. 1071 01:25:47.165 --> 01:25:54.285 Rather than like passively explain stuff, had to go on the offense a little bit and talk about the adversarial nature of the cryptography that holds up all of Bitcoin. 1072 01:25:55.005 --> 01:25:56.525 Maybe that would the 1073 01:25:58.285 --> 01:25:59.805 Amsterdam presentation 1074 01:26:00.045 --> 01:26:04.329 maybe. But we should do that. Because, and that's like, man, because like 1075 01:26:05.530 --> 01:26:06.169 my, 1076 01:26:06.809 --> 01:26:10.649 our contact at BTC Inc. Was really struggling to like, 1077 01:26:11.610 --> 01:26:17.385 tap and click like, am doing That's it. No, this is why we're doing the map panel. This is why we're doing the map panel. Gonna... I 1078 01:26:18.265 --> 01:26:30.745 this is absolutely it. Then he I've been holding off like, so he was like, hey, just give me the description and I'll put it on the website. And I was holding off because even for me, it wasn't fully clicking in now. This is it though. This is the talk. Got it. And now that I kinda teed this up for you today, I sent you my notes. 1079 01:26:32.360 --> 01:26:39.880 You... We could do... You could brush up on it now. We could have an interesting conversation around it. Yeah. Now we can do some work and prepare some... Like a pretty band on This 1080 01:26:40.520 --> 01:26:44.360 is perfectly pod conf aligned. Do a podcast to get inspiration for the conference talk. 1081 01:26:46.045 --> 01:26:47.885 Big Bitcoin's in control. Big Bitcoin 1082 01:26:48.204 --> 01:26:52.844 and big math are on a collision course. That's right. That's right. Good stuff. 1083 01:26:53.244 --> 01:26:54.284 Right. Well then 1084 01:26:54.605 --> 01:26:57.485 Magic Internet Math is in the books.