Free Post-Quantum Cryptography – John Graham Cumming, Cloudflare

This is texturing TV. Hey everyone, welcome back to techstruck TV. I'm really happy to have as our next guest John Graham coming and John is the chief technology officer for cloudflare and I will give extra points to anyone out there who can tell me what city that is behind John in the background, but you could social media posted there and we'll see.

Hey John, welcome to Tech strong TV. Well, thank you for having me back because I think this is the second time. Yes, it is.

You're right. You're right. I don't think we had this background before though.

Maybe we didn't. Well, you know what the last time I did this I was not in this city. I was in London, so maybe I had on that ground so we have to go see So this is sort of our own version of where is Carmen Santiago?

Where's John? Where's John today? Anyway, hey, John, you know if you don't mind sure a little bit of your story with our audience.

So as you introduce, I'm the CTO of a company called cloudflare and I think cloudflare for for many people is the biggest internet company. You've never heard of we are the protection and the acceleration layer for about 20% of the web. So you've probably been to a website or used an app or maybe your company uses us and we've checked out that you're not a hacker.

We've made your experience faster and we do this from a joy gigantic Network 285 cities worldwide 100 countries where we have our machines and we use those to stop DDOS attacks stop hackers and make your general experience of the internet faster and you know because of that we do a lot of cryptography. We do a lot of things that roll out the latest protocols on the web and if you're in Tech you may have heard of us, but if you're not in Tech you probably are user of cloudflare ever knowing you're a user Absolutely, you know I had someone from cloudflare aren't I think it was you 20% Of websites about yes, right about right. Yeah, that's what the style of active websites that seem to be about what the statistic is and because we offer a wide range of services from you know, free service for the smallest individual blogger to the biggest Fortune 500 companies.

It is a range and and Azure I think a big part of what we do is we try to I think we're going to talk about this today a little bit democratize technology that is to say that the best protection the best performance shouldn't be restricted to, you know, just the apples and Amazons of Google's of the world, but everyone should get it and that's our job. Absolutely. I mean, look, I'm just gonna put the cherry on in this the breath of services from cloudflare from everything from from you know, kind of old school CDN to security delivery everything in there is just it's crazy.

So you mentioned we're going to talk a little bit about democratization today. But we're going to focus in on post Quantum cryptography. You know, we we live in interesting times.

It's it's an Irish proverb you live in interesting times. We have these, you know crazy technologies that can change the world AI everybody's talking about Ai and generative Ai and chat GPT and it's gonna put us all out of her jobs, and it may just decide to do away with Humanity or the security aspects of it. God knows another big kind of Great technology that's been turned into a boogie man.

It seems is quantum computing. Quantum Computing is going to come out and that's that's the end of our security. We no longer can use passwords.

We no longer can use pgp. We can't use Keys key fobs any of this. It's all gone.

Right? We we need we need to kind of reinvent ourselves. And and I'm not saying no, you know, we have blockchain and and all of this stuff what's quantum gonna mean John?

Why don't we start there by kind of? Putting the boogeyman back in the box if we can and telling people what it is exactly we're talking about. Yeah, although I was here to some truth in what you said.

It's not quite as dramatic as what you said, but there's a there's a negative truth in it. So, okay, you're always here. First of all Quantum Computing.

What is it? It's a different model of computing. And what do we mean by that?

We mean that the computers we have today, which we sometimes we refer to this cheering machines or classical computers. They do something with ones and zeros, and there's an absolute sense if there's other one or a zero, and in fact if there's any ambiguity your computer doesn't work, right? And contributions kind of the opposite it can deal with an uncertainty about whether some value is one or zero essentially and it turns out that that uncertainty is very very powerful and it's powerful in a way that classical computers are not and that allows us to solve some problems that are hard for current computers to do and what I mean by hard is take a really really long time or many of those problems you be you've been watching the sun fizzle and disappear before you got an answer to your Computing problem.

So we we would really like to have quantum computers because they will let us solve things. We can't solve today. However, A lot of the cryptography that most of the cryptography we use every day for secure internet websites for secure Communications of vulnerable to these quantum computers because the reason they are secure is that the problems the decryption problem.

They're breaking the code problem is one of these hard problems and it turns out that for quantum computers those hard problems become easy and can be done in a reasonable amount of time. So when someone has a viable quantum computer the sorts of cryptography we are using today is going to be breakable. And slightly worse than that.

If there is some organization government around the world, which is quietly sucking up internet traffic and storing it on lots of hard drives somewhere. Once they have a quantically do they can go back and decrypt all that stuff unless that particular algorithms already protected against that possible future. So, although we don't know when we're going to have a quantum computer a bit.

Like we don't know whether we're going to have and you know an AGI right a general intelligence coming out of one of these chat GPT systems. It feels for for the Computing. We feel like it's coming.

Maybe in five years maybe in 20. And so we have to protect against that now and luckily there are quantum safe cryptography algorithms that have now not only been worked on but have been standardized by nist in the US. And so we can actually roll out cryptography that will be safe.

Even though we don't have a quantum computer yet, which is a rather fascinating thing. We've we've done all the theoretical work. We can actually protect against the thing we don't have yet.

And so that's rude the Letterland now does it mean we're going to not be able to use passwords and also stuff of that. Not quite what it means is that we're going to have to change the cryptographic algorithms. We're using so that they are safe against quantum computers and then we can carry on as before but something underlined then the mathematics needs to change.

We know that what it is. We have an implementations. So now we need to get on with it and you know what it really reminds me of the Y2K problem.

If you're old enough like me to remember the Y2K problem, we knew that something was going to break and then at this with Y2K when you the exact date, right actually the date was a little bit more fuzzy than that because you might remember that before 2000s things started breaking things like mortgage calculators, which needed to calculate things past the year 2000, right? So we're in that situation right now where we have a deadline is a bit fuzzy and we need to update our software and our algorithms to be safe against this future. Absolutely, and yeah, just thinking about Y2K how many careers did that launch of people around?

You know our age China there was a there was a lot of a lot of business around that Y2K it was and you know, it's one of the good good points, right, which is that bucket if you go back to 2000. Open source software wasn't much of a thing. No, everything you were buying from vendors.

And so, you know vendors were creating updates for white UK and I the company I worked out I was the Y2K coordinator which means my job massive spreadsheet and go through every system as is it why it's okay. Is it being updated? Do we need to do something?

So for that? Well, we sort of need to do the same thing for this Quantum thing. But and what cloudflare announced was that we don't think you should pay for it.

We think that the world is very different, right? If you go back to 2000 we weren't most of using cryptography for anything. It was kind of like, you know spies used it and right governments and stuff like that.

We use it all the time this connection you and I are on right now talking is encrypted. Right? So we think it's a terrible mistake if companies starts selling Quantum safe cryptography.

So to what cloudflare analysis we are including the quantum safe algorithms in all of our products as whatever you're paying us with it's free or you're you know, a major customer. It's just thrown in bundle and that means any connection from us to one of those 20% of websites right between you and you and also between us and a website. I've been asking a business internally as well within cloudflare is going to be Quantum safe at no additional charge to what people are paying today, which in many cases is nothing.

That's fantastic. What if I mean that it's game changing right because now forces the rest of the industry to put up or shut up kind of thing right in terms of doing this John before we jump into the repercussions of this democratization when we talk about, you know, post-quantum algorithms if you will or Quantum safe algorithms, Can you give us yeah without giving up Trade Secrets or anything, but can you give us an idea of what goes into making a Quantum proof algorithm? is it I mean, you know from a workload from a kind of brains point of view Well, I mean, it's it's mathematics, right?

This is well that yeah, it is all mad. So it's mathematics and then I think the the key way to look at this is that and the algorithms we currently use so in particular RSA, which is the very well known public key product algorithm and the security of them relied on the fact that it was easy to do a certain mathematical operation in One Direction and hard to do it in reverse. So it's almost as if like multiplication was easy, but division was almost impossible.

But clearly that's not the case, but for some sort of mathematics you can have a situation or what was called a one-way function if you like or or something, which is very hard to reverse where it's really hard. To go one way, but it's really easy to get the other way. And so which is great, right?

So if you would do cryptography you want to make it really easy to encrypt but if you haven't got the key, it should be really hard to go back any other direction. So we know that for some of these really hard things and really hard actually has a mathematical definition. There are quantum algorithms though.

So it really what's going on here saying, okay, we need some other algorithms which are we know are not going to be solvable on a content creator. So a lot of high level mathematics to do that and we're there we we have we have these algorithms and we need to implement them safely. That's the other side of it.

Right which is you need to actually write code. So because the other thing you can go wrong in cryptography is you have the best piece of mathematics out there and then you write code which is meant to do that mathematics and there's something wrong with it and it gets broken because of the implementation which is not necessarily the same as the theory behind it. So we have to do the mathematics we've done that we standardize it and then we have to make the implementations that are secure and are we know are going to do exactly what the algorithm said and state-of-the-art now is we actually can we can actually prove that the code does what the math says we actually have systems for doing those proofs.

So we're way ahead of where we were the Y2K error or before with what we can do here. So this is the realm of mathematicians. And the realm of some very careful programmers.

Building implementations and using proof systems to say. Yes, we know this. This is probably the an implementation of that algorithm and I mean one of the one of the biggest ones is a thing called Khyber.

And Khyber is and say kyvr it's a way of what's calling capsulating a key. So getting a key and passing around and we know that that encapsulation can't be undone by a quantum computer because of the underlying characteristics of the mathematics involved. So we're actually it's time.

Yeah, you know, we're in the quantum era right? There are small quantum computers around but even more importantly we have implementations open source, implementations of quantum resistant cryptography. So I love this, you know, Johnny if you live long enough, I I remember I I guess it was probably three or four years ago interviewing someone.

I think they were from this if not nist Miner. about them, you know, they were trying at that point to kind of publish post Quantum or Quantum it era You know the algorithms. Well, not the algorithms themselves but guidelines.

Right for how to do encryption in a Quantum world. Yeah, and at that time the fella I I think he was from minor at that time. The fellow from miter said, you know, we're get we're for once we're out ahead of this because this is probably 10 years out.

right But it's internet time 10 years in Internet time is seven years in a dog's life. And I don't know how many people a lot years in real life. But how how I mean, we're in the quantum.

Error right now in that we do have working quantum computers, but I think commercially available. Are you seeing a lot of quantum traffic yet? What can even tag that so actually what's interesting is it's a weird we're gonna start reporting on this through cloudflare radar, which is the percentage of traffic we're seeing which is protected against a quantum computer and you're right that the real work around this area started around 2001.

So once we got Y2K out of the wood here, we had to fight just don't work. We started working on this post Quantum staff and Nest really Nest actually announced their competition. I believe back in 2016.

So it's like seven years ago that we started, you know taking something we are we are out ahead of it. But and we do know that they're great advances being made in Quantum Computing and what's the worst case here? Well the worst case here is this was all not necessary, right?

The quantum computers actually for some reason the two difficult to make and takes us 50 years to do it. Well, We did some math and we rolled out some new algorithms and yet this is yet another reason why this should be free. You shouldn't have to pay for this isn't the fear Monger anything.

It's like well, we'll throw this in as part of the thing because maybe we need to protect against this and maybe you know what you and I will be here another 20 years looking so significantly grayer than we already are and saying guess what it didn't work out or goodness me in 20 30, there was a fully full-scale contributor and we all had to rush. So I think time is now we can just do it. We have the algorithms we have this the open source software.

Let's let's go post quantum. I I agree with you right it'll probably work on our Apple Newton. So John.

I guess we should tell people who want to get more information or you know, do want to slide, you know, checking on this right now. Where are cloudflare. Can they go that'll help us it will help them.

Be accustomed I think because you certainly constant anything right right. It's included in every plan, right? The last thing no nobody.

Is there anything on this on the cloud fellow website? Yeah, absolutely. So on the on the cloudflare blog we've written about Quantum Computing many many times so you can read all that stuff.

com and they obviously have published a lot of stuff about post Quantum there and you can go read about that. So I would I would directly to the blog I do directly to the research page and you'll be able to find out about this stuff and if you're a cloud for their customer, what you have to do to get post Quantum is nothing. We love it.

Yeah, and that's it. Well, let's see out there who's matching it John because once it's free, you know, you can't compete on price anymore and it should be done. Which well, I I agree with you.

I agree with you you me everybody else using the internet needs a secure internet and we needed to be as secure as it can be and this is part of that. It shouldn't cost extra. I love it John.

Thanks for coming on today and getting us a little smarter. About Quantum Computing. That's my pleasure.

And thanks for cloudflare to make to make it for making this move. Right this this will I think Force the market? That this shouldn't be a Have and Have Not some kind of feature, right?

Everyone should have it good stuff. Coming Chief star CTO Chief technology officer cloudflare here on text on TV. We're gonna take a break.

We'll be right back.