Against Cryptographic Doomerism
文章目录
Two days ago, OpenAI dropped 722 simultaneous mathematical manuscripts, supposedly "the most significant moment in mathematical history." Foundational problems that have eluded mathematicians for over a century are falling, with OpenAI having spent only 3 hours of compute per problem. Mathematicians are in shock. They can no longer predict what's coming.
It looks like cryptography is next.
Scott Aaronson claims OpenAI is now pointing their lasers at breaking cryptography
The moment has now come for blockchains to think seriously about the "mathocalypse." What happens when superintelligent AI swarms are pointed at foundational cryptography?
Let me make clear here: what we're talking about is not the risk that AI speeds up quantum timelines. That is obviously possible, but quantum requires a lot of physical engineering, which AI cannot do overnight. That will take time and be publicly visible. Preparing for quantum is critical, but it's relatively straightforward.
What we're talking about is some kind of unexpected mathematical breakthrough. Something that overturns the foundational assumptions of classical cryptography, allowing ordinary computers to compute discrete logarithms and break modern public key cryptography.
This would be an existential disaster.
As @drakefjustin and @matthew_d_green have both intimated, we are about to see decades of mathematical progress happen in front of our eyes. We don't know what will come out the other side.
In his now viral "bunker mode" post, Justin has advocated essentially this: save yourself. Protect your own coins. Disaster might befall everyone else, but at least you know you'll be safe.
This is cryptographic doomerism. It's the equivalent of advocating that now that you know there's a tail risk, you should start hoarding cans of soup.
The problem with doomerism is not its core claim. Of course there is some tail risk of things going catastrophically wrong. You cannot definitively say the risk is zero.
The problem with doomerism is the response: if that's true, what should we do about it?
We don't really know what the odds are of some fundamental weakness in public key cryptography. It's probably low, but it's not 0%. Let's say, for the sake of argument, it's 5%. That means there's a 95% chance that everything is totally fine. We'll write blog posts about this, hem and haw, and nothing bad will happen.
Indeed, in that 95% scenario, probably what AI does is confirm what we already believed, that public key cryptography is sound!
But if I told you, hey, I have this cryptographic scheme that's 95% likely to protect your funds, you'd laugh at the idea. Cryptographers measure security risk in more like 2^-128.
Some people respond: yes, but if ECDSA were to be broken, society would have much bigger problems than just blockchains! Think of banks, TLS, certificate authorities—blockchains would be the least of your problems.
But you should not take that as consolation. Banks can recover. TLS can recover. Certificate authorities can recover. They can re-KYC everyone and switch to a new cryptographic standard.
We, blockchains, cannot recover from a failure in public key cryptography. In a worst case scenario, anyone could compute anyone else's keys, meaning anyone could take anyone else's money. We wouldn't know who owns what, and we'd have no way to prove anything. That's no longer a currency, that's a graffiti wall. We would have to throw the entire blockchain in the trash and start over.
Therefore we must insure against this failure. We cannot guarantee that mathematics won't break, but we can guarantee that it doesn't destroy the blockchain. That inoculation must happen at both the protocol level and the social level. Doing this demands immediate effort and coordination.
The usual line is "this is not a drill." But actually, this is a drill.
It's an absolutely essential drill.
We are like one of those countries that must now conscript everyone into the army and teach them how to fire a rifle. War might be coming. It's true that you probably won't be called to the front lines. But if you are, we need you, in your bones, to understand why, and to be ready.
The opposite of doomerism is a decisive plan of action. Instead of retreating, we must stand ready to protect ourselves against a potential disaster. And that means we must implement those changes now.
Why governance must change
Historically, our confidence in cryptography has rested on a social process.
Cryptographers try to attack a construction for several years. If it survives, we call it probably okay. After a decade of survival, we say it's almost certainly okay, and trust it in production. But almost all cryptography wears down over time as attacks build up and security bounds get weaker, and eventually we rotate them out for better constructions.
That pace has always been slow enough for blockchains. Migrations could happen over years, and social consensus could keep up with the rate of cryptographic change.
That assumption is now uncertain. We are about to have cryptanalysts better than any human who has ever lived, examining these schemes more rigorously than anyone ever has. The total number of competent cryptanalysts in the world is probably numbered in the thousands; we're about to scale that up by orders of magnitude.
The amount of human cryptographic analysis done over the last 40 years might pale compared to what AIs will soon do. What used to take a decade could happen in months.
Or overnight.
The pacing we use for blockchain governance doesn't work in that world.
It's now cryptographic wartime. Peacetime norms no longer apply. We have to be able to move extremely fast, because things can change extremely fast. If social consensus can no longer keep up with the pace of technological and cryptographic change, then social consensus must adapt immediately.
But wouldn't that incite a panic?
Panic is also not the answer. I agree with Vitalik that if we encourage people to panic, they're more likely to hurt themselves with a rushed migration, which is worse than any actual risk of getting their ECDSA keys sniped.
So-called "bunker mode" also not a real solution to the problem. If you, an individual, migrate your keys to a fresh address, then maybe you'll be safe. But then what? Bunker mode means you can't move your coins. It only protects your coins as long as you stand still. And what consolation is it if the blockchain around you has fallen apart? Your coins will be worthless if all of the other coins are being hacked and mass-sold. Even if your address is fine, who cares?
No, the solution must be a systems-level solution. It is no help to encourage people to individually fend for themselves.
At the same time, "the most important thing is that people don't panic" is an idea that has not aged well. We should be honest and direct about the risks so that people take them seriously and are moved to action.
I keep coming back to the Cold War. During the Cold War, it was instilled into Western societies: there might be a nuclear war. For most people the drill was silly. Crawling under your desk would not save you from a nuclear bomb. But because everyone participated in the drill, all of society understood the seriousness of the risk. We shifted political attitudes to avoid war at all costs, and just in case, we built bomb shelters. And indeed, we got close several times to a nuclear war. We were genuinely lucky. The Cuban Missile Crisis and Stanislav Petrov show us: the probability was not zero.
We might get lucky with cryptography. We probably will. But we should be prepared in case luck is not on our side.
So how must governance adapt to this?
-
Speed beats decentralization in a crisis. Chains that can coordinate quickly will do the best. Decentralized social consensus runs on timescales that don't fit hyper-rapid technological change. Governance needs to adapt as soon as possible. If that means relaxing norms around decision-making, let's do that. If it means giving more power to validators, let's do that. A potential crisis calls for a rapid and decisive response.
-
The whole ecosystem has to mobilize. Not just protocol devs, but wallets, exchanges, RPC providers, apps, asset issuers, and end users, they all need to work in lock-step to develop an ecosystem-wide response.
-
The plan has to exist before it's go-time. If we have no plan once things have already broken, we are fucked.
Markets will be watching which chains take this seriously. I am already getting questions from big investors about this. They understand why this is worrying, and they want to know that we, as an industry, have an answer.
So let's produce one.
Cryptographic Recovery Mode
I propose that every major blockchain quickly implement a mode I call "Cryptographic Recovery Mode." This is the nuclear-ready strategy that it will adopt in an absolute worst-case scenario.
Here's a sketch of how it might work:
In the next protocol upgrade, there is a new and extremely simple hash-based public key system. (Hash-based signatures generally have the simplest cryptographic assumptions.) This is like Cold War level austerity cryptography. The scheme is slow, expensive, and awful to use. We REALLY don't want to use this signature scheme. If we could, we'd choose almost anything else. If we actually use this, the chain will run like molasses, DeFi will be basically unusable, block speed will slow to a crawl, everything will absolutely suck.
But it works. Technically, it works, and it's something.
Everyone creates a backup key using this horrendous signature scheme as a backup. ALL USERS are pushed into creating a mapping between their normal address and this hash-based backup key. At first it's optional, and then, a couple months later, it's forced. Once it's forced, no new transactions can be signed using your ECDSA key until you have set up your hash-based backup key. Transactions literally fail if you have no backup key in place.
Every exchange will now start creating backup keys for their addresses. Coinbase, Metamask, Ledger, on seeing you don't have a backup key, will prompt you to make one before it'll let you sign a transaction. Everyone now has a backup system in place. But of course, we all keep using ECDSA, because it's awesome and we're not lunatics.
We pre-deploy a kill switch. If disaster hits, and AI discovers a vulnerability in ECDSA, then validators can agree to break the glass and enter crisis mode. *Entirely through signaling and without a protocol upgrade, *validators can vote to flip the kill switch.
The kill switch forces all addresses into cryptographic recovery mode. Now ECDSA is dead. Full stop. The bomb has gone off. Discrete logarithms are not coming back.
Now what?
Now the chain sucks. Nothing runs well. It's almost impossible to use. But technically it still works. Devs now get to work trying to figure out what the damage was, what cryptography remains intact, and figure out how to rebuild a new chain transition plan that can actually run at acceptable performance. But at least for now, everyone's balances are secure, and there's a path to recovery.
What about people who didn't migrate? Almost certainly there will be a large minority of addresses who are stragglers.
For those who still have their seed phrase, they can, at any time, generate a hash-based ZK-proof of their seed phrase (a la @VitalikButerin's 2024 proposal) and assign themselves a new hash-based address. Or if they've never signed any transactions with their address (so-called "bunker mode"), then recovery is trivial using ZK.
But many will not be able to do this. For them, a timer has now started, and here's how recovery works for them: they must both generate an ECDSA signature AND solve a PoW hash puzzle to unlock their address and migrate their assets. This PoW difficulty is scaled by the amount of native assets held in their address. I.e., if you hold 100 ETH, your PoW has difficulty 100N.
But this N scales exponentially. After 1 day, it costs 100N. After 2 days, it takes 200N, then 400N, then 800N. Validators can vote to throttle N, or throttle the growth rate, depending on what the vulnerability looks like and how they model the risks. Maybe we have months, maybe we have hours.
To be clear, in a real attack scenario, this becomes a race. If there's a way to efficiently break ECDSA keys, the only advantage the true owner has is that the attacker has to break the key first and then do the PoW, while the true owner only needs to do the PoW and should be able to go faster than the attacker. This makes large-scale theft difficult. If large-scale theft is observed, then validators can exponentially speed up the scaling rate to prevent more funds from being siphoned (or, in a total disaster scenario, raise it to infinity to permanently orphan all vulnerable coins).
I'm sure I'm missing a lot of critical details here. This is just a proposal, and I'm not a cryptographer or a protocol designer. But the general idea is that something like this should be implemented in every single blockchain as soon as possible.
Markets will, before long, demand it. Given everything happening in mathematics, every blockchain needs a backup recovery plan, and it has to be agreed upon in advance, so that when the moment comes, nobody is debating how a transition happens.
In a crisis, speed is everything.
This is the kind of situation where the perfect should not be the enemy of the good. If OpenAI is working on this right now, we don't know how long it will take before we start seeing unexpected cryptographic breaks. The first version of cryptographic recovery mode can be terrible (it probably should be!) but it can be iteratively improved once something is in place. (Note that if there's a sudden quantum breakthrough, this works for that too. But it's most needed for a fundamental cryptographic break.)
The important thing is that we don't sit around debating or getting into Twitter fights, and we do something.
Nothing gets to ossify
A few weeks ago I argued that Zcash should ship its post-quantum migration and then "ossify."
I was wrong, and I take it back. When the mathematical ground under us is as wobbly as it is now, nothing gets to ossify.
Maybe in a few years we'll be more confident in the foundations of cryptography. But right now, everything is in flux.
This demands more nimbleness, more trust in protocol teams to act wisely, and more honesty about the tradeoffs in front of us to keep crypto secure in the face of rapid and accelerating technological change.
The mathocalypse is coming for cryptography, and we need to be ready.
I want to be clear: most likely, nothing will happen. Most likely, everything will be fine. AI will spend person-years of superhuman compute on these systems, and it'll conclude: all of the cryptography you guys invented is rock solid. Good work, cryptographers.
But we need to make absolutely damn sure that even if cryptography is not fine, even in an absolute worst-case scenario, that blockchains will be fine anyway.
Disclosure: investor in many assets mentioned, this is just my personal views, I'm an expert in nothing.
