12 ms·

The impact of hardware specifications on reaching quantum advantage

43 points by giuliomagnifico 5y ago

jacksondc 5y ago
13 million, not 130 million, no?
- giuliomagnifico 5y ago
  Oh yes sorry my mistake, I merged the two data and I made a bit of confusion, I thought it was 317 x 10(6) and 130 x 10(6), instead is 13 not 130. Sorry. By the way moderators have changed the title (but now I don’t know who will understand what this post is about)
- martyvis 5y ago
  Correct, article says 317M qubits to break encryption in an hour, 13M in a day. Title here is wrong.
bananarchist 5y ago
Is that a lot of qubits? I have no frame of reference on this.
- bArray 5y ago
  It wouldn't be that insane for a factory to be able to create so many qubits. Building one qubit is hard, building two qubits is not double the effort.
  - thebean11 5y ago
    I think the difficulty is putting them into one processor
  - ALittleLight 5y ago
    My, highly imperfect, complete layman understanding is that the challenge has nothing to do with the "manufacture" of qubits, but rather getting them to work in the same computer without interfering with each other. I believe it gets harder with each qubit, not easier.
    - shepherdjerred 5y ago
      Is it possible to scale it by building separate computers and using distributed computing techniques? e.g. would 100 1 qubit computers be equivalent to a single 100 qubit computer?
      - d_tr 5y ago
        The set of qubits needs to be an isolated system while the quantum computation happens, so no. By taking the qubits apart you would only make this much harder, if not impossible.
      - ben_w 5y ago
        No. Most of the benefits of quantum computing requires the qbits be entangled with each other, so, crudely speaking, the difference between 100 (1-qbit-computers) and 1 (100-qbit-computer) is ability to compute using the 2^100 different ways the latter qbits can be entangled.
  - ninkendo 5y ago
    Right, and I don't understand why it took the industry so many decades for 64-bit computing to become dominant. If a factory is creating bits, it shouldn't take 64x the effort to create 64 of them versus 1 bit...
    - bArray 5y ago
      64 bit computing became dominant because of the need to address memory larger than 32 bits. They have the capability to scale quite 'easily' to 128 bits or further if they wanted to, there just wouldn't be a benefit. The Play Station 2 for example has 128 bit SIMD [1], 128 bit computing has been possible for a long time. Once you have the ability to create a processor at 7nm with some bits, scaling is not so tough. Even if you cannot reliably create larger pieces of silicon, you just do something like AMD did with multiple dies connected by a fabric to mitigate risk. Absolutely worst case, you have a motherboard with multiple processors, or even computers in different buildings. In terms of qubits, it is very likely that the problem can be distributed over multiple quantum computers. A significantly incentivized actor could definitely pull it off. If you can reliably manufacture ~100 qubit quantum computers, it's just a matter of scale. [1] https://en.wikipedia.org/wiki/PlayStation_2_technical_specifications#Central_processing_unit https://en.wikipedia.org/wiki/PlayStation_2_technical_specif...
      - tsimionescu 5y ago
        > In terms of qubits, it is very likely that the problem can be distributed over multiple quantum computers. No, this is very wrong. Qubits are only different from classical bits of they can communicate before becoming entangled with the environment (decoherence). You can't run some kind of "quantum cable" between two separate QCs in a rack and get twice the qubits - the interactions with the wire will break the entanglement between the qubits, and you will just have an unreliable classical computer with 100 bits of memory. To perform a quantum computation, ALL the qubits (all your memory) must be in an entangled state together - this is the massive problem. Even worse, this state must be maintained while applying different transformations on the qubits from the outside.
        5y ago
  - tsimionescu 5y ago
    > Building one qubit is hard, building two qubits is not double the effort. No, it's much, much more than double the effort to build a QC with twice the qubits. The problem is that you want the qubits to interact with each other, but to be entirely perfectly isolated from the outside world for as long as necessary for signals from one to reach the others. The difficulty of achieving this isolation even for an instant at all increases by something like n^2 or n^3 (surface/volume of the isolated space) with the number n of qubits. Then, the more qubits you have, the more time you need for them to interact, so you multiply by an additional factor. The numbers above are very handwavy, of course, but the point is that it's MUCH harder to build a bigger QC than a small one. So hard that it's not even clear if the current approaches can actually achieve this even in principle - we may need a different kind of qubit to scale up.
  - deleted 5y ago
    [deleted]
- Jyaif 5y ago
  State of the art is in the order of a 100 qubits.
  - lodovic 5y ago
    I guess there isn't such a thing as Moore's Law for Quantum Computing
    - MattPalmer1086 5y ago
      Not as such, that was only ever an empirical observation anyway, not a law of any kind. Having said that, IBM just unveiled a 127 qubit machine, and their roadmap is to to to scale to 433, and then 1121 qubits in the not too distant future. https://newsroom.ibm.com/2021-11-16-IBM-Unveils-Breakthrough-127-Qubit-Quantum-Processor https://newsroom.ibm.com/2021-11-16-IBM-Unveils-Breakthrough...
- dr_zoidberg 5y ago
  Yes, that's a lot considering that large systems today have in the order of 100-1000 qubits. Mind you, the systems currently saying that are larger than 100 qubits are debated if they really are quantum computers in the broadest sense, or a subset (consensus is they are a subset of quantum computers, and not full fledged). So the largest, "really quantum computers" are in the order of ~100 qubits. Edit: for context, I'm referring to D-Wave, that some years ago said they had broken the 1000-qubit mark, but their systems aren't generic quantum computers, but rather computers tham implement quantum annealing.
- giuliomagnifico 5y ago
  > Is that a lot of qubits? Yes. Now the most powerful quantum computers have less than 100 qubits. We have to reach 130,000,000 qubits. Take a beer meanwhile =)
threshold 5y ago
AI will break SHA256. It’s probably backdoored already look who made it. But crypto won’t last long enough for that to be meaningful. I give bitcoin 3 months to the floor.
- HPsquared 5y ago
  If that's possible, can't another AI make an algorithm resistant to that kind of attack? Encryption is generally easier than cracking.
  - threshold 5y ago
    Yes, but the problem becomes who can evaluate it? Inevitably another AI system because of the complexity. And who has the most powerful AI? And what is their agenda? Ah! another backdoored algorithm. But the real issue is the loss of confidence in the “blockchain technology”. If bitcoin is cracked the cryptomania scam will be done for a generation.
- lvass 5y ago
  What are you waiting to become rich? I'll long you 10x leverage.
- kyruzic 5y ago
  This is perhaps one of the most ill-informed comments of all time. AI cannot magically make math not exist, but nice try.
  - f154hfds 5y ago
    Respectfully what math exactly protects SHA256?
    - digitalsushi 5y ago
      the same math that says without a map of my back yard, y'all aint finding the gold unless you grab a shovel for ten years
ysangkok 5y ago
There is no encryption in Bitcoin. It uses asymmetric cryptography for signatures, and it uses hashing. Encryption might be used by wallets, but that is not part of the consensus layer and therefore not part of Bitcoin.
- DSMan195276 5y ago
  You don't consider asymmetric key cryptography to be encryption?
  - drexlspivey 5y ago
    There are more to cryptography than encryption, in this case it’s just signature verification which is not encryption
    - DSMan195276 5y ago
      But the signature is an encrypted hash value, which is decrypted when verifying the signature. Maybe you could say signature verification as a concept is not encryption, but certainly Bitcoin's implementation uses encryption, and I don't think there's any definition of 'asymmetric cryptography' that is not also some form of encryption.
      - MattPalmer1086 5y ago
        Hashes are not encryption either. They're a one way function. Encryption has to be reversible.
    - ninkendo 5y ago
      I'm not an expert on BTC, but I'd guess that if you can derive the private key of a signature from its public key (which is what the paper is describing), you can use that to place transactions from said wallet on the blockchain (ie. spend that wallet's money), right? Genuinely curious if I understand this correctly, there's a lot I don't know about how bitcoin's protocol works.
  - 5y ago
deleted 5y ago
[deleted]
donclark 5y ago
What about Quantum computers?
- lvass 5y ago
  They're cool, absurdly cool in fact.
  - loopdoend 5y ago
    To spoil the joke, qubits presently operate at like 1 Kelvin or -273 degrees Celsius.
HPsquared 5y ago
Can someone give a quick rundown on why quantum computers so far only have small numbers of qubits? I remember reading something about errors creeping in somehow, and it's hard to build a large system, but don't really understand why. Edit: something to do with decoherence, I think: https://en.m.wikipedia.org/wiki/Quantum_computing#Quantum_decoherence https://en.m.wikipedia.org/wiki/Quantum_computing#Quantum_de...
- scythe 5y ago
  Current architectures aren't ready to operate enough gates fast/accurate[1] enough to attempt sustained (i.e. longer than milliseconds) protection of quantum data. So making more qubits would not be very useful until we can make them talk to each other. [1]: Qubits are always decohering, so fast and accurate are closely linked.
- dr_zoidberg 5y ago
  Decoherence is the answer. Veeeeery long story short, qubits have to be isolated from the world as much as possible to maintain their "magical quantum properties". Decoherence is when those ideal conditions break, and the qubits no longer behave as needed for the quantum computer to work. The more qubits you have, thet harder it gets to fend off the inteference from the outside world that decoheres the qubits.
  - amelius 5y ago
    Ok, so it gets N times harder, but you get M times more compute power. Is there a relation between N and M? Is at least M larger than N? Will N get lower with more qubits?
    - ben_w 5y ago
      Thinking about things being N times harder is probably the wrong approach at the current time. We’re so early in the engineering of these computers that it’s “we don’t know how to make more than X usable qbits in this configuration at any cost” rather than “X+1 qbits is Y dollars more expensive”. Worth noting that the value of X depends heavily on the configuration and the things holding the qbits; IIRC the D-wave design is scalable but also not a “universal” quantum computer. I’m unclear on the specifics of how and why.
scythe 5y ago
>and a physical gate error of 10^−3. Before you get too excited, it's important to remember that existing qubit implementations do not achieve a physical gate error rate of 10^-3 (best right now is more like 10^-2).
TheSocialAndrew 5y ago
If hypothetically this would happen, wouldn't gaining access to everyone's wallets render it useless since BTC would no longer have value? If so, the goal would just be to disrupt the financial markets, not necessarily to gain directly. Also, wouldn't we be able to restore everyone's wallets from the latest snapshot on a new blockchain?
- handmodel 5y ago
  If I had ability to gain access to everyone's wallet I'd probably attempt to siphon off a few million dollars a day worth of bitcoin. If people catch on that all is lost after awhile oh well - I've already cashed out significantly.
  - tims33 5y ago
    The Office Space approach
- yanmaani 5y ago
  > wouldn't gaining access to everyone's wallets render it useless since BTC would no longer have value It would only be useful for the wallets with known public keys. That's mainly old bitcoins, new ones only have its hash written to the chain. This would certainly crash the price, but not to zero. > Also, wouldn't we be able to restore everyone's wallets from the latest snapshot on a new blockchain? Yes, but what good will it do you if the private key is leaked?
- sharkster711 5y ago
  Yes to the first question. For the second, it would depend on easy/hard it is to mine to get to the point where you can replicate a snapshot, and how easy/hard it is to continue mining on from that point. It is very unlikely the new protocol will hold the same value as BTC would have had.
- rndphs 5y ago
  I think it's more that if someone builds a sufficiently large quantum computer for other purposes then it would also break bitcoin as a side effect.
nabla9 5y ago
Assuming Moore's law applies for quantum circuits, time limited attacks against ECDSA described in the article might be possible in year 2058 or so. (it would require 317M qubits at minimum, title has a typo)
Animats 5y ago
Well, DWave claims 5,000 qbits. Unclear if they can work on this problem. So, if you had 100 of those, you could break Bitcoin wallets in a year. Retrieve all those lost coins from the early days.
- MattPalmer1086 5y ago
  Dwave don't make general purpose quantum computers. They do something called quantum annealing, which is only useful for a very specific set of problems.
  - cwillu 5y ago
    The problem isn't quantum annealing, the problem is that what dwave is actually doing is throwing a ball of mud at a wall, and saying that if enough mud sticks, you can do quantum annealing with the spackle pattern.
    - MattPalmer1086 5y ago
      Interesting, are you saying that they don't even achieve quantum annealing? I haven't really paid much attention to them.

jacksondc 5y ago

13 million, not 130 million, no?

giuliomagnifico 5y ago
Oh yes sorry my mistake, I merged the two data and I made a bit of confusion, I thought it was 317 x 10(6) and 130 x 10(6), instead is 13 not 130. Sorry. By the way moderators have changed the title (but now I don’t know who will understand what this post is about)
martyvis 5y ago
Correct, article says 317M qubits to break encryption in an hour, 13M in a day. Title here is wrong.

bananarchist 5y ago

Is that a lot of qubits? I have no frame of reference on this.

bArray 5y ago
It wouldn't be that insane for a factory to be able to create so many qubits. Building one qubit is hard, building two qubits is not double the effort.
- thebean11 5y ago
  I think the difficulty is putting them into one processor
- ALittleLight 5y ago
  My, highly imperfect, complete layman understanding is that the challenge has nothing to do with the "manufacture" of qubits, but rather getting them to work in the same computer without interfering with each other. I believe it gets harder with each qubit, not easier.
  - shepherdjerred 5y ago
    Is it possible to scale it by building separate computers and using distributed computing techniques? e.g. would 100 1 qubit computers be equivalent to a single 100 qubit computer?
    - d_tr 5y ago
      The set of qubits needs to be an isolated system while the quantum computation happens, so no. By taking the qubits apart you would only make this much harder, if not impossible.
    - ben_w 5y ago
      No. Most of the benefits of quantum computing requires the qbits be entangled with each other, so, crudely speaking, the difference between 100 (1-qbit-computers) and 1 (100-qbit-computer) is ability to compute using the 2^100 different ways the latter qbits can be entangled.
- ninkendo 5y ago
  Right, and I don't understand why it took the industry so many decades for 64-bit computing to become dominant. If a factory is creating bits, it shouldn't take 64x the effort to create 64 of them versus 1 bit...
  - bArray 5y ago
    64 bit computing became dominant because of the need to address memory larger than 32 bits. They have the capability to scale quite 'easily' to 128 bits or further if they wanted to, there just wouldn't be a benefit. The Play Station 2 for example has 128 bit SIMD [1], 128 bit computing has been possible for a long time. Once you have the ability to create a processor at 7nm with some bits, scaling is not so tough. Even if you cannot reliably create larger pieces of silicon, you just do something like AMD did with multiple dies connected by a fabric to mitigate risk. Absolutely worst case, you have a motherboard with multiple processors, or even computers in different buildings. In terms of qubits, it is very likely that the problem can be distributed over multiple quantum computers. A significantly incentivized actor could definitely pull it off. If you can reliably manufacture ~100 qubit quantum computers, it's just a matter of scale. [1] https://en.wikipedia.org/wiki/PlayStation_2_technical_specifications#Central_processing_unit https://en.wikipedia.org/wiki/PlayStation_2_technical_specif...
    - tsimionescu 5y ago
      > In terms of qubits, it is very likely that the problem can be distributed over multiple quantum computers. No, this is very wrong. Qubits are only different from classical bits of they can communicate before becoming entangled with the environment (decoherence). You can't run some kind of "quantum cable" between two separate QCs in a rack and get twice the qubits - the interactions with the wire will break the entanglement between the qubits, and you will just have an unreliable classical computer with 100 bits of memory. To perform a quantum computation, ALL the qubits (all your memory) must be in an entangled state together - this is the massive problem. Even worse, this state must be maintained while applying different transformations on the qubits from the outside.
      - 5y ago
- tsimionescu 5y ago
  > Building one qubit is hard, building two qubits is not double the effort. No, it's much, much more than double the effort to build a QC with twice the qubits. The problem is that you want the qubits to interact with each other, but to be entirely perfectly isolated from the outside world for as long as necessary for signals from one to reach the others. The difficulty of achieving this isolation even for an instant at all increases by something like n^2 or n^3 (surface/volume of the isolated space) with the number n of qubits. Then, the more qubits you have, the more time you need for them to interact, so you multiply by an additional factor. The numbers above are very handwavy, of course, but the point is that it's MUCH harder to build a bigger QC than a small one. So hard that it's not even clear if the current approaches can actually achieve this even in principle - we may need a different kind of qubit to scale up.
- deleted 5y ago
  [deleted]
Jyaif 5y ago
State of the art is in the order of a 100 qubits.
- lodovic 5y ago
  I guess there isn't such a thing as Moore's Law for Quantum Computing
  - MattPalmer1086 5y ago
    Not as such, that was only ever an empirical observation anyway, not a law of any kind. Having said that, IBM just unveiled a 127 qubit machine, and their roadmap is to to to scale to 433, and then 1121 qubits in the not too distant future. https://newsroom.ibm.com/2021-11-16-IBM-Unveils-Breakthrough-127-Qubit-Quantum-Processor https://newsroom.ibm.com/2021-11-16-IBM-Unveils-Breakthrough...
dr_zoidberg 5y ago
Yes, that's a lot considering that large systems today have in the order of 100-1000 qubits. Mind you, the systems currently saying that are larger than 100 qubits are debated if they really are quantum computers in the broadest sense, or a subset (consensus is they are a subset of quantum computers, and not full fledged). So the largest, "really quantum computers" are in the order of ~100 qubits. Edit: for context, I'm referring to D-Wave, that some years ago said they had broken the 1000-qubit mark, but their systems aren't generic quantum computers, but rather computers tham implement quantum annealing.
giuliomagnifico 5y ago
> Is that a lot of qubits? Yes. Now the most powerful quantum computers have less than 100 qubits. We have to reach 130,000,000 qubits. Take a beer meanwhile =)

threshold 5y ago

AI will break SHA256. It’s probably backdoored already look who made it. But crypto won’t last long enough for that to be meaningful. I give bitcoin 3 months to the floor.

HPsquared 5y ago
If that's possible, can't another AI make an algorithm resistant to that kind of attack? Encryption is generally easier than cracking.
- threshold 5y ago
  Yes, but the problem becomes who can evaluate it? Inevitably another AI system because of the complexity. And who has the most powerful AI? And what is their agenda? Ah! another backdoored algorithm. But the real issue is the loss of confidence in the “blockchain technology”. If bitcoin is cracked the cryptomania scam will be done for a generation.
lvass 5y ago
What are you waiting to become rich? I'll long you 10x leverage.
kyruzic 5y ago
This is perhaps one of the most ill-informed comments of all time. AI cannot magically make math not exist, but nice try.
- f154hfds 5y ago
  Respectfully what math exactly protects SHA256?
  - digitalsushi 5y ago
    the same math that says without a map of my back yard, y'all aint finding the gold unless you grab a shovel for ten years

ysangkok 5y ago

There is no encryption in Bitcoin. It uses asymmetric cryptography for signatures, and it uses hashing. Encryption might be used by wallets, but that is not part of the consensus layer and therefore not part of Bitcoin.

DSMan195276 5y ago
You don't consider asymmetric key cryptography to be encryption?
- drexlspivey 5y ago
  There are more to cryptography than encryption, in this case it’s just signature verification which is not encryption
  - DSMan195276 5y ago
    But the signature is an encrypted hash value, which is decrypted when verifying the signature. Maybe you could say signature verification as a concept is not encryption, but certainly Bitcoin's implementation uses encryption, and I don't think there's any definition of 'asymmetric cryptography' that is not also some form of encryption.
    - MattPalmer1086 5y ago
      Hashes are not encryption either. They're a one way function. Encryption has to be reversible.
  - ninkendo 5y ago
    I'm not an expert on BTC, but I'd guess that if you can derive the private key of a signature from its public key (which is what the paper is describing), you can use that to place transactions from said wallet on the blockchain (ie. spend that wallet's money), right? Genuinely curious if I understand this correctly, there's a lot I don't know about how bitcoin's protocol works.
- 5y ago

deleted 5y ago

[deleted]

donclark 5y ago

What about Quantum computers?

lvass 5y ago
They're cool, absurdly cool in fact.
- loopdoend 5y ago
  To spoil the joke, qubits presently operate at like 1 Kelvin or -273 degrees Celsius.

HPsquared 5y ago

Can someone give a quick rundown on why quantum computers so far only have small numbers of qubits? I remember reading something about errors creeping in somehow, and it's hard to build a large system, but don't really understand why. Edit: something to do with decoherence, I think: https://en.m.wikipedia.org/wiki/Quantum_computing#Quantum_decoherence https://en.m.wikipedia.org/wiki/Quantum_computing#Quantum_de...

scythe 5y ago
Current architectures aren't ready to operate enough gates fast/accurate[1] enough to attempt sustained (i.e. longer than milliseconds) protection of quantum data. So making more qubits would not be very useful until we can make them talk to each other. [1]: Qubits are always decohering, so fast and accurate are closely linked.
dr_zoidberg 5y ago
Decoherence is the answer. Veeeeery long story short, qubits have to be isolated from the world as much as possible to maintain their "magical quantum properties". Decoherence is when those ideal conditions break, and the qubits no longer behave as needed for the quantum computer to work. The more qubits you have, thet harder it gets to fend off the inteference from the outside world that decoheres the qubits.
- amelius 5y ago
  Ok, so it gets N times harder, but you get M times more compute power. Is there a relation between N and M? Is at least M larger than N? Will N get lower with more qubits?
  - ben_w 5y ago
    Thinking about things being N times harder is probably the wrong approach at the current time. We’re so early in the engineering of these computers that it’s “we don’t know how to make more than X usable qbits in this configuration at any cost” rather than “X+1 qbits is Y dollars more expensive”. Worth noting that the value of X depends heavily on the configuration and the things holding the qbits; IIRC the D-wave design is scalable but also not a “universal” quantum computer. I’m unclear on the specifics of how and why.

scythe 5y ago

>and a physical gate error of 10^−3. Before you get too excited, it's important to remember that existing qubit implementations do not achieve a physical gate error rate of 10^-3 (best right now is more like 10^-2).

TheSocialAndrew 5y ago

If hypothetically this would happen, wouldn't gaining access to everyone's wallets render it useless since BTC would no longer have value? If so, the goal would just be to disrupt the financial markets, not necessarily to gain directly. Also, wouldn't we be able to restore everyone's wallets from the latest snapshot on a new blockchain?

handmodel 5y ago
If I had ability to gain access to everyone's wallet I'd probably attempt to siphon off a few million dollars a day worth of bitcoin. If people catch on that all is lost after awhile oh well - I've already cashed out significantly.
- tims33 5y ago
  The Office Space approach
yanmaani 5y ago
> wouldn't gaining access to everyone's wallets render it useless since BTC would no longer have value It would only be useful for the wallets with known public keys. That's mainly old bitcoins, new ones only have its hash written to the chain. This would certainly crash the price, but not to zero. > Also, wouldn't we be able to restore everyone's wallets from the latest snapshot on a new blockchain? Yes, but what good will it do you if the private key is leaked?
sharkster711 5y ago
Yes to the first question. For the second, it would depend on easy/hard it is to mine to get to the point where you can replicate a snapshot, and how easy/hard it is to continue mining on from that point. It is very unlikely the new protocol will hold the same value as BTC would have had.
rndphs 5y ago
I think it's more that if someone builds a sufficiently large quantum computer for other purposes then it would also break bitcoin as a side effect.

nabla9 5y ago

Assuming Moore's law applies for quantum circuits, time limited attacks against ECDSA described in the article might be possible in year 2058 or so. (it would require 317M qubits at minimum, title has a typo)

Animats 5y ago

Well, DWave claims 5,000 qbits. Unclear if they can work on this problem. So, if you had 100 of those, you could break Bitcoin wallets in a year. Retrieve all those lost coins from the early days.

MattPalmer1086 5y ago
Dwave don't make general purpose quantum computers. They do something called quantum annealing, which is only useful for a very specific set of problems.
- cwillu 5y ago
  The problem isn't quantum annealing, the problem is that what dwave is actually doing is throwing a ball of mud at a wall, and saying that if enough mud sticks, you can do quantum annealing with the spackle pattern.
  - MattPalmer1086 5y ago
    Interesting, are you saying that they don't even achieve quantum annealing? I haven't really paid much attention to them.