"Cybersecurity: Analyzing the Threats from Quantum Computing," Banking on Blockchain Podcast, Episode 2

DWT partners Steve Gannon and Michael Borgia continue their discussion of cybersecurity in the digital asset ecosystem, focusing on the potential impact of quantum computing. They examine how quantum technology could affect the cryptography underlying digital assets, the transition to post-quantum protections, and the challenges of securing decentralized networks.

Topics Covered

• How quantum computing could affect private keys, blockchain security, and digital communications.
• The risks of "harvest now, decrypt later" attacks and the uncertain timeline for quantum threats.
• The challenges of implementing post-quantum cryptography across decentralized networks and the broader financial system.

Banking on Blockchain is a podcast exploring how blockchain and digital assets are reshaping financial services. Subscribe on Spotify or Apple Podcasts.

Episode Transcript

Steve: Let's get to a topic that you mentioned right at the beginning and is highly interesting, which is quantum computing and the threat that comes along with quantum computing. And maybe you can sort of define what quantum computing is for us in plain English as best you can do.

Mike: I think what's important to understand is cryptocurrency runs on cryptography. The name would suggest that's true. And it is essential to it in a number of ways. Now, that's also true of the internet, and we'll talk about some of the broader issues here. That just, digital communications also depend on cryptography. So the crypto industry is not alone in this problem. There's a number of ways in which this is true, that cryptography—this is so hard to say—cryptocurrency depends on cryptography, to, I think the most obvious one of the three—is one, the digital signatures.

Asymmetric public-private key cryptography. You have a public key that everyone can know, and you have a private key that only you know, that you sign a transaction with your private key. A cryptographic algorithm is applied that generates a public key. Everyone can say, "Yes, that's the public key." The only way that public key could've been created is with your private key, therefore that must be you. It doesn't necessarily mean it's a particular individual, but that that's an authorized transaction, we can trace that, and we have some confidence that these transactions are happening the way they're supposed to.

The hash functions also, what makes the blockchain is, hash functions that are created, again, through cryptographic algorithms that can establish that each transaction follows correctly from the transaction before. And if any transaction in the chain is tampered with, even by a little tiny bit, right? It's got $1 and it's $1 and 1 cent, right? It doesn't matter. Everything about that hash changes. Completely different hash. Everything is now broken, and given the many different copies of a blockchain that are maintained around the ecosystem, it is going to be very obvious that this blockchain has been tampered with, right? So this is very important.

The third one is, it's still the public and private key cryptography, but it's encryption to maintain your secrets, to maintain the private key, to make sure that only you have that, that that is not being spread around because once that's being spread around, then anyone can claim to own your crypto, right? The owner really, and if you want to look at it practically, isn't a person, it is whoever holds that private key. We can talk about sort of legally who owns it, but the practical reality is if someone has the private key to a wallet, they own the crypto. They can do what they want with it.

So how does quantum come in? So cryptography, a technologist or a cryptographer would grimace at all this, but that's okay. That's good enough for our purposes today. Cryptography is just really hard math problems, essentially, right?

And the way that it works, in general, in a public-private key setting, is that you have a private key, a long string of information, and you apply an algorithm to it, which is again kind of like a big hard math problem, and that creates a public key, and that's pretty easy to do that way, right?

But it's very, very hard to do it the other way, and even powerful, normal computers would take tens of thousands of years to take any given public key and say, "Okay, this is the private key from which that was derived."

And it's very hard to conceive of that, but a simple example would be, if I say, "What's 50 times 50?" And you're like, "Okay, well, that's..." I'm sorry, "50 plus 50." Like, "That's 100." Okay, got it. Easy to do, right? Okay. I took two numbers and I added them together and I made 100. What are the two numbers? Now, in this case, that's still not that hard, a computer can figure that out, right? But you can see that it's materially harder. Yeah. And that's the underlying concept here.

So normal computers work on, people must know the bits, zeros and ones, and for any value, there's either a zero or a one. It's kind of on or off, one, zero.

Quantum computing, people will often say, "Oh, it's faster." That's not exactly true. Like, it can be true, but it's not faster across the board, and in some ways, it's actually not better than current computers. But rather than just using the bits that are either one or zero, they use what's called qubits, and those can hold combinations of states at once. They could be on and off at the same time, and which again, is very theoretical. And I don't know how to explain it more than that, but I think it's good enough for today.

So for some computing tasks, that doesn't really matter, but it can matter a lot for certain types of math problems that involve a lot of trial and error, and that is what we have in cryptography, and being able to figure out way, way faster what a private key is. As I mentioned, this is a problem that affects digital communications at large. Cryptography underlies when you communicate with a website, and it's HTTPS as opposed to the old HTTP. That's all encrypted. The data on the laptop, it's encrypted. All of this works. How do we know that I'm communicating with the real website if I go to a website, right? Well, it's cryptography and digital signatures and hashing and all of these things that we use across the internet to protect the confidentiality of information, and also integrity, to know that it's correct, it's true, we should trust what it says, is based on cryptography.

So if quantum computing becomes widely available, that's obviously a very big problem because all of these things that we use to underlie the security and integrity of our communications are potentially compromised, because now we would have computers in this hypothetical scenario that could derive the private keys or otherwise break the algorithms, and then we don't really know what's secure.

A risk that people have thought about a lot in this space is what's called, in various ways, it's kind of different terms, but like "hack now, decrypt later," right? And that means steal data. I can't hack the data today. It's encrypted and I can't get into it, but I'm going to steal it. And I'm going to keep it in a repository, and once quantum becomes more available, I will hack it and I will have all this stuff. Sometimes it's called "harvest now, decrypt later." Okay. So this is a very hard problem for a number of reasons. One of the reasons, is it's scary, right? It's just not a sort of gradual, it gets worse over time problem. At some theoretical point, this will become kind of widely available.

Maybe it's not the point where we say, oh, a Google lab or something has developed this capability. But it will come after that when we say, we think that some bad actors may have this capability as well, maybe it's a state actor or maybe it's others, right? But they can do this. Then there's a precipice, because then now we don't know that any of this security actually works anymore. That's a really hard problem. And even in that situation, if it's very few people that can do this, we don't know who they are, we don't know the prevalence, and it's very scary.

The other thing that makes this hard is it's still theoretical. We don't know when this actually will be possible. I guess the current estimates, if I could put one time on them, are like the 2030s, but that does seem to creep down. The federal government has a big push to move towards PQC, post-quantum cryptography—cryptographic algorithms that are resistant to quantum computing, and they're trying to get that implemented by basically 2030, 2031. There's some interim deadlines as well for their systems. So that's kind of what people are shooting for, but it could be sooner.

So this is obviously a big challenge for everyone across the internet. It's a challenge for crypto because of the money, because of the value, because of what's at stake. But also, this is a time when decentralization shows some disadvantage. There is not one central actor who can say, "We are going to upgrade all of the algorithms to PQC, post-quantum cryptographic algorithms, so we'll be good." Right? If you're a software vendor, you're a cloud service provider, you say, "Okay, well, it's not easy, but we're going to do it, upgrade all the stuff, and we'll be fine."

So there have been various efforts by many actors. Probably the furthest along right now, it's hard to say exactly, but the Ethereum Foundation has been doing quite a bit to move towards post-quantum cryptography throughout 2026. And there's been an effort by Coinbase as well. Right now, there's not a global Bitcoin solution, but there are people trying to figure one out. But this is going to be the difficulty, is figuring out what is the right solution, how do we all agree to it, and how do we all migrate to that solution.

Steve: So here's a question. This is a bit of a surprise. We haven't talked about this yet. But if I bought Bitcoin in, say, 2012 or 2014, at a pretty low price, and now obviously I've got some very attractive gains in it, but I just am holding it. I don't intend to do anything with it. And I've got it in a cold wallet. It's air-gapped. It's not moving. And it's not hooked up to any computer. If I eventually, post-quantum computing, if I decide, okay, I want to transfer my Bitcoin, I want to send it to my heirs, or I want to just sell it and take the gains...is the mere act of hooking it up to a new set of computers that have post-quantum cryptography on it, does that in and of itself create a vulnerability?

Mike: It could. It's hard to say, I think, but it's possible.

I think that hopefully, the entire network, if you want to call it that, moves to post-quantum cryptography. And that should be, at least if there is a vulnerability, it should be a small one, and you should be hopefully forced to move onto a secure solution. And it raises questions about backwards compatibility as well, right? My personal infrastructure doesn't have this. Is that okay? But lots will have to think about that, right? What about people who have been sitting on this and have a bunch of crypto that's been sitting there and are not active users of the network. And of course, it could affect everyone, too, in that crypto is based on trust, right? It's based on, not trust as in like we hope and pray, but trust as in we believe that the system works.

Steve: It's trustless, but it's a form of trust.

Mike: Exactly. It's an interesting thing, right? Because it is trustless, but also trust is established through the system. The system works in a certain way, and that produces trust. So we don't have to have any faith, right? And if, just like in the normal financial system, if there's even small questions about like, are these numbers correct? Are these transactions authorized? It cascades quickly, right? Similar to the financial system, we can also say is based on trust in the same sense. It's not based on faith or belief, but it's based on a set of systems that create trust by verifying, by creating, certain outcomes. And if those outcomes are compromised and we're like, well, we think you have this amount of money, but we're not totally sure... it's a huge problem simply because that trust is lost, even if in reality, there's only a few differences here and there.

Steve: Well, one of the things that's going to make it even more challenging is by the time quantum computing comes around, the prevalence of AI agents in assisting and moving cryptocurrencies across blockchains to do essentially commercial work and trading is going to be very, very prevalent. And agents only can, because they have to move so much data, and oftentimes in such small amounts, but almost like literally thousands of transactions a second, if not tens of thousands...they're going to be very prevalent, and it's going to be very hard for them to slow down. So engineering this shift to "quantum-protected computing," if you will, is going to be a real challenge.

Mike: It is going to be a challenge. The value and the risk, although ironically in some ways they make it scary, but they also give me some hope, right? That there are some people who are very, very incented to make this thing work. People's entire companies and businesses depend on it. As cryptos become even more integrated into the normal financial system, we've got very, very major players in the traditional finance space that also really need to get this figured out. So it's easy sometimes to still think about crypto as just a bunch of people out there, but the reality is it's a very, very complex ecosystem of players at many different levels of sophistication, and a lot of them have a big incentive to make this thing work.

Steve: Yes. And then, by the way, just to mention a few, DTCC is tokenizing its work. The New York Stock Exchange, NASD, Swift, exchanges overseas. The tokenization boom is happening. It's accelerating at an unbelievable pace. And so as that happens, it's going to transform the infrastructure of financial services. And so there's going to be a compelling, very compelling reason to make sure that it can continue to exist as it is in a post-quantum world with the same efficiencies that it has. So Mike, maybe you can wrap it up. We've covered a lot, and this has been a fantastic discussion. Maybe you can wrap it up with a comment or two about what we should be expecting to see in the crypto and cyber world.

Mike: Sure. Well, we're following, we mentioned the Genius Act and the OCC proposal. It has a bunch of cybersecurity elements to it. And they're worth looking at. If you are at a GLBA-regulated financial institution, nothing here is going to be super surprising to you. There are some kind of cryptocurrency twists, tweaks to it. But it's a lot of stuff you're going to be familiar with. But still worth looking into because this is going to be the closest thing we have to crypto-specific cyber regulation.

And just to cap off from our previous point, and one of the first things this requires as you read the proposal, is a security program approved by the board. This is a very common trend in cyber in general. So the board needs to be involved. There's going to be a direct obligation to do that, as well as other kind of more programmatic level requirements around handling and inventory of assets and systems and things like that.

So yeah, I think that's where this is going. As this becomes even more prevalent, even more normalized and used by traditional finance, we're going to see more security proposals like this. We're going to see more applications of traditional cybersecurity laws here, either through traditional finance or we'll just see more creative efforts to take standard cybersecurity, reasonable and appropriate standards, and apply them to the crypto industry. We've seen that already, and more of that will happen. And I think the biggest thing I think we'll look for in the next few years is this push towards post-quantum. How will it go? Where will it be effective?

And it's going to be a big differentiator. The blockchains that do this quickly and well are going to have an advantage over the ones that struggle a bit.

Steve: Well, Mike, thanks very much. This was incredibly interesting. I've got a lot out of it, and I think our audience did as well. And of course, as always, if we can help any members of the audience, just feel free to reach out to your DWT contact, and we'll be happy to make sure that we connect with you and can assist you going forward. So Mike, thanks very much.

Mike: Thanks for having me. It was a great discussion.