5 ms·

I always assumed the obvious application was for Google to make a QaaS (Quantum as a Service) for factoring large primes. One obvious big customer would be inte

I always assumed the obvious application was for Google to make a QaaS (Quantum as a Service) for factoring large primes. One obvious big customer would be intellegence agencies, especially the NSA.

thehappypm 2y ago
Can you imagine? Send us a number, we send you the factors. And a bill. With lots of zeroes
ilya_m 2y ago
The only problem with this business model is that once you factored one number, you kill your market - people will stop using pre-quantum crypto. (The obvious retort is that NSA would have harvested a ton of RSA/EC-encrypted traffic by then and would keep cracking ciphers going back decades. Unfortunately, old secrets is a rapidly depreciating asset class.)
- fooker 2y ago
  That's why it won't be a public market.
- r0m4n0 2y ago
  Partially true. If you copy a ton of encrypted data today, you can maybe decrypt it tomorrow
- red_admiral 2y ago
  If you can get a quantum computer to take discrete logarithms on secp256k1 or mess with SHA256, then you can either get $$$ very quickly or you nuke almost the entire crypto market. For the former, you'd have to keep your discovery secret but just be unusually good at minting new coins. Getting crypto coins to move over to post-quantum seems to me to be a much harder problem than e.g. rushing out a new version of TLS or SSH. The key to Satoshi's original coins is a rapidly _apprecicating_ secret at the moment, but paradoxically also one that might immediately crater out if someone actually discovers a generic way to break the crypto involved. I'm not an expert on this angle of things but: as far as I know, Shor's quantum algorithm breaks both RSA (factoring) and DSA (finite-field discrete logarithms). But I'm not sure if it works the same way against elliptic curves - or at least you'd probably need a bigger computer to attack the same level of security. It's not clear to me if a quantum computer could effectively attack SHA256, either: Shor definitely does not help, Grover cuts the search space from 256 to 128 bits but that's still not practical to iterate over.
  - kevvok 2y ago
    > But I'm not sure if it works the same way against elliptic curves - or at least you'd probably need a bigger computer to attack the same level of security. Elliptic curve cryptography is also based on the difficulty of computing discrete logarithms, which makes it vulnerable to Shor’s algorithm. Unfortunately, while the increased difficulty of brute forcing ECC with a classical computer allowed it to use smaller key sizes to achieve security equivalent to older algorithms like RSA, the smaller key sizes make ECC attackable with fewer qubits.
sampo 2y ago
> I always assumed the obvious application was for Google to make a QaaS (Quantum as a Service) for factoring large primes. We are decades and decades away from the technology to be able to do that. The problem for Google is trying to find a practically useful use case a bit sooner than that.

I always assumed the obvious application was for Google to make a QaaS (Quantum as a Service) for factoring large primes. One obvious big customer would be intellegence agencies, especially the NSA.

thehappypm 2y ago

Can you imagine? Send us a number, we send you the factors. And a bill. With lots of zeroes

ilya_m 2y ago

The only problem with this business model is that once you factored one number, you kill your market - people will stop using pre-quantum crypto. (The obvious retort is that NSA would have harvested a ton of RSA/EC-encrypted traffic by then and would keep cracking ciphers going back decades. Unfortunately, old secrets is a rapidly depreciating asset class.)

fooker 2y ago
That's why it won't be a public market.
r0m4n0 2y ago
Partially true. If you copy a ton of encrypted data today, you can maybe decrypt it tomorrow
red_admiral 2y ago
If you can get a quantum computer to take discrete logarithms on secp256k1 or mess with SHA256, then you can either get $$$ very quickly or you nuke almost the entire crypto market. For the former, you'd have to keep your discovery secret but just be unusually good at minting new coins. Getting crypto coins to move over to post-quantum seems to me to be a much harder problem than e.g. rushing out a new version of TLS or SSH. The key to Satoshi's original coins is a rapidly _apprecicating_ secret at the moment, but paradoxically also one that might immediately crater out if someone actually discovers a generic way to break the crypto involved. I'm not an expert on this angle of things but: as far as I know, Shor's quantum algorithm breaks both RSA (factoring) and DSA (finite-field discrete logarithms). But I'm not sure if it works the same way against elliptic curves - or at least you'd probably need a bigger computer to attack the same level of security. It's not clear to me if a quantum computer could effectively attack SHA256, either: Shor definitely does not help, Grover cuts the search space from 256 to 128 bits but that's still not practical to iterate over.
- kevvok 2y ago
  > But I'm not sure if it works the same way against elliptic curves - or at least you'd probably need a bigger computer to attack the same level of security. Elliptic curve cryptography is also based on the difficulty of computing discrete logarithms, which makes it vulnerable to Shor’s algorithm. Unfortunately, while the increased difficulty of brute forcing ECC with a classical computer allowed it to use smaller key sizes to achieve security equivalent to older algorithms like RSA, the smaller key sizes make ECC attackable with fewer qubits.

sampo 2y ago

> I always assumed the obvious application was for Google to make a QaaS (Quantum as a Service) for factoring large primes. We are decades and decades away from the technology to be able to do that. The problem for Google is trying to find a practically useful use case a bit sooner than that.