Transcript 0:00 Welcome back to Bitcoin Season two. Bitcoin is in danger of becoming a Rolex. Now, this sounds like a great thing, but what if Bitcoin were only accessible to the wealthy and the rich, like Rolex? 0:11 I talked with Eli Ben Sasson of StarkWare this week. A lot of fascinating topics: quantum, OPCAT, and technical things such as Collider Script. Stay tuned for this conversation. 0:22 Bitcoin Season two is brought to you by Arch Network, the platform building bridgeless apps on Bitcoin. More on Arch later on in the show. Let's kick it off. [on-hold music] Welcome back to Bitcoin Season two. 0:39 I've got Eli Ben Sasson, founder of StarkWare, and we'll be talking about StarkNet, OPCAT, quantum, some more interesting topics, existential questions about blockchains and even Collider Script. 0:53 Um, so, Eli, welcome to Bitcoin Season two. Thank you so much for coming on. Thank you, Charlie, for having me here. Uh, excited to be here. 1:01 So you guys are OGs in the broader crypto space, and I would say you're like a household name in Ethereum. 1:09 But for I think primarily this like Bitcoin audience, not a lot-- I think there's some unfamiliarity with StarkWare, StarkNet, um, like who you guys are and just general ZK tech and, you know, broadly. 1:23 So, um, if you can, give me like a little pre-history to this moment here. Where does StarkWare come from? Where does StarkNet fit in? Give me some context. Okay. So terrific question. Um, a bit of context. 1:38 First of all, about myself. So I'm co-founder, um, and CEO of StarkWare. Um, I fell in love with, uh, blockchain through Bitcoin. 1:48 It was in twenty-thirteen, uh, when I attended at the invitation of, uh, um, Gavin Andresen at the time, um, and with the backing of Greg Maxwell and Mike Hearn and a bunch of, uh, core devs at the time. 2:04 I, uh, joined, um, and spoke about my research. I was a professor of, uh, theoretical computer science back then, and, uh, I fell in love with Bitcoin. So 2:15 at that talk in twenty thirteen, that was the first time someone mentioned that ZK and cryptographic proofs can solve the scaling problem of blockchain. And that person was, uh, me. 2:31 So that also put me on a trajectory to, uh, scaling and also dealing with the privacy of blockchains. I was a, uh, a founding scientist of Zcash, which is based on academic work that I did. 2:43 And then in twenty eighteen, uh, based on a number of math breakthroughs that led to the, um, ZK Stark family of protocols, um, co-founded StarkWare. 2:55 So we've been, uh, around as a company since twenty eighteen, and what we've done is convince the world that, um, ZK Starks, which is a particular family of cryptographic proofs that's post-quantum secure, has no trusted setup, fastest to scale, is the end game for scaling, um, Ethereum. 3:16 But by extension, it's a very good technology for scaling blockchains in general. Um, now that's what StarkWare does. StarkWare is a pretty large team. We're over two hundred team size. 3:30 And, uh, we developed StarkNet, which is a layer two on Ethereum, um, which is, uh, very efficient, very good UX, and we're now bringing it over to Bitcoin. Sorry for the very long proof-- uh, answer to your question. 3:44 I think that's pretty succinct given the storied, you know, storied history of StarkWare and StarkNet. 3:53 And you know, it's interesting because I think that Satoshi themselves even like had referenced one or two references to zero knowledge, but the, the kind of, uh, evaluation at the time was like, well, it's probably not ready. 4:06 And this is fifteen, sixteen years ago. Here we are. You guys have pretty much led the field on these proof systems and, um, I'm not super qualified to get into the details of that. 4:21 But, [clears throat] um, this leads us into the most recent news, which you guys put out this past week or two, which is that, yes, you're a layer two on Ethereum, but you are going to now settle on both Eth and Bitcoin. 4:34 You announced a bunch of partnerships and grants and a whole campaign, but what does it actually mean to settle on both Ethereum and Bitcoin? 4:44 What it actually means is that we would like as quickly as possible and in the safest way possible at any given point in time to allow Bitcoin users and developers to, um, use, uh, StarkNet's technology. 5:01 Um, so what does it mean? Currently, the only way to use, um, um, you know, to scale, uh, to-- sorry, to use or connect StarkNet to Bitcoin is through a multisig. 5:15 But when looking at multisigs, we would like to work with the most, you know, pristine and most trustworthy teams building and operating such things, and we'll have a lot of announcements on that. 5:26 So that's like the very first thing that is already doable. Um, we're also already partnering with teams that offer things that are fully self-custodial, like, uh, atomic swaps. 5:37 Uh, for instance, you could use a StarkNet wallet called Braavos today to scan a QR code and immediately pay on the Lightning network through, um, an atomic swap built by Atomic Labs. 5:50 So this is something that you can already do today, and you have a very good UX for doing something that is extremely, uh, important in the context of, uh, Bitcoin, which is using Lightning and paying, uh, on it. 6:02 And, you know, they're actually-- uh, it's, it's a very good and easy-to-use interface. So that's stage one, um, connecting in the safest wayTo Bitcoin today. 6:13 Um, the next thing we're doing and working is we'll be partnering with very good, 6:20 um, BitVM teams in order to, uh, have StarkNet and connect it to Bitcoin through BitVM style, um, uh, bridges, which are-- They have, uh, economic security based on one-round fraud proofs. 6:36 Uh, it's, uh, safer and more self-custodial than using, um, a, uh, multisig. And longer term, we would like to... 6:47 Well, we are waiting for the day that some fos-- soft fork will enable, um, full Stark verification. Op_cat is one candidate. There could be others that allow this. 6:59 And when that day comes, uh, very shortly after it, hopefully at the same time even, um, StarkNet will be fully self-custodial, 7:09 connected to, uh, Bitcoin, allowing more expressibility, better UX, faster finality, things like that. Yeah. 7:16 I-- You've got this, um, chart on kind of the announcement of the, you know, StarkNet's going to be on E-Ethereum and Bitcoin, and it's a great, um... It's like the caterpillar evolving into a butterfly. 7:27 And a-- and you kind of get through. We're gonna start with a multisig. 7:30 We're gonna go, you know, further trust minimize BitVM, and at some point, if Op_cat or another type of soft fork happens, then we get to-- And I see the words unified layer two. 7:42 Is that what you're talking about, where the-- where there is minimal or no trust assumptions for, like, the user to go between Bitcoin and this StarkNet layer two? What does a unified layer two mean, do you think? 7:57 Just as you said, Charlie, it is a layer two that settles safely, uh, in a fully self-custodial way onto both, um, Bitcoin and to Ethereum, meaning that the only assumptions that you have, uh, on the side of Bitcoin are that, you know, Bitcoin has, uh, the security and finality that it, that it is, uh, you know, famous for having. 8:21 And, um, that is what it means. And the same thing on the Ethereum side. Um, that's our goal. I think a lot of Bitcoiners don't appreciate that the... 8:30 If you look across the other crypto landscape, you have, uh, a lot more autonomy for users to go between blockchains depending on, like, their technical capabilities, and we don't have that on Bitcoin. 8:42 I think my friends over at Bitcoin Layers talk about how, like, everything's a multisig, and, um, that's kind of been true for a long time. 8:50 We can minimize, we can federate those, we can add better trusted, vetted counterparties, but it's kind of like there's a-- there's really just, um, until recently, until BitVM or, like, something like ARK, like, very recently, like, you kinda just gotta trust that the signers are honest, and it's still pretty limited in the extensibility off-chain. 9:12 So, um, I wanna talk, you know, for the average user who's listening to this, they may have never touched StarkNet. Maybe they've just done Bitcoin for forever. What's the TL;DR on StarkNet like? What does it do? 9:25 I mean, why would somebody use it? Uh, you've had a decent amount of activity on there since launch, but what-- Like, what do people do on StarkNet? Okay. So what do you do on StarkNet? 9:36 First of all, you have, um, very good UX alongside. You have basically web two UX with web three security, meaning you have fully self-custodial wallets. 9:48 But because of a feature called, um, account abstraction, which basically means-- I mean, if you look at Bitcoin, right? There's only basically one way, uh, in order to sign and, and possess funds, right? 10:02 And it is a specific cryptographic protocol, okay? On StarkNet, you can choose whichever way to, uh, control your funds, which allows, in particular, the Bitcoin style, but you can have other things. 10:13 And this leads-- So for instance, if you want, you can choose to rely on biometrics or other things that are very UX-friendly and still be s-- fully self-custodial. So that's one thing that you have on StarkNet. 10:26 You have very good web two-like UX. 10:28 You also have expressibility, which means that developers there can do things if they so choose, like, uh, fully on-chain games, or they could have, um, DeFi protocols that are very efficient. 10:41 You have massive computation that is done on-chain, um, through, through this technology. So you have more expressibility, uh, a safer programming environment that is, uh, a next generation smart contract language. 10:55 You have good UX, and you have very, very low costs for transactions. StarkNet among the Ethereum L2s is the cheapest and has the highest scale. 11:05 So all of this, um, you know, translates into something that is very, very good for end users. Um, that's what you have on StarkNet. 11:14 So, um, maybe-- I don't know if this was defined in, like, the explanation of, like, the announcement you're gonna settle on both ETH and Bitcoin, assuming that someday we get CAT or other-- or some other soft fork. 11:28 Um, maybe this is an imple-implementation detail, but, um, help me understand, like, does this mean you'll be posting proofs to both chains, like the identical type of proof? 11:40 Or is there some differentiation between, like, the Bitcoin side of StarkNet and the ETH side of StarkNet? 11:45 M-- If I'm asking or framing this question incorrectly, feel free to, like, clarify and take it and explain it to me how you think it should be. 11:52 No, Charlie, you asked it perfectly correctly, and the answer is exactly what, what you said. 11:57 You will be using the very same, um, cryptographic proof, mathematical proof called the zk-STARK, which, uh, I co-invented.And, um, which has, you know, the safest assumptions. It is post-quantum secure. 12:10 There is no trusted setup, no toxic waste like w-we had in the Zcash protocol, um, or in Tornado Cash and stuff like that. 12:19 So you have a very, very robust mathematical guarantee of integrity, and it is, is the same proof type that will go both on, uh, Ethereum and on Bitcoin. 12:31 Now, in terms of what's called the data availability and the way you present that data, it will probably differ significantly, uh, between Ethereum and Bitcoin because of, you know, the format of, uh, of, of 12:44 the two environments. But our technology will be the same applied to both ends. 12:50 So I want to get into Opcat a bit and, and you-- I think what's interesting is, you know, you guys are huge supporters of Opcat, and anybody who's been paying attention to the research space in Opcat or just kind of Bitcoin research has seen you guys for the past year plus recently really lean into it, allocate a lot of resources, put out a lot of interesting proof of concepts or implementations on like Signet or just research papers, 13:18 um, as part of this kind of Opcat campaign. Give me the-- I-- You've said it before in other platforms, but let's do it here. Like, why Opcat? Um, why are you guys so supportive of this? 13:31 And we can get into some of the details under that. So the short answer is, um, we are supporters and observers of Bitcoin, and we hear that among the soft forks that could scale 13:50 Bitcoin, Opcat seems to be the most practical and the one that is receiving the most, um, support from many different parties, most importantly, core devs, but others as well. 14:02 So if, you know, Satoshi were to reach out and, and say, "Hey, Eli, what would optimize scaling on Bitcoin?" You know, what would be your, uh, suggestion? It would not be Opcat, I'll be honest with you. 14:17 It'd probably be a bunch of other things, um, that would go together. Um, having a finite field multiplication, a whole bunch of things, okay? Maybe Opcat is one of them. But-- A-and, and I'll say more. 14:31 If you look at how hard it is to settle, uh, stark proofs given Opcat, it's still pretty damn hard, but that's fine. 14:39 So it's, it's not like, you know, of all the things that I could wish for if Satoshi reached out and said, "Please, you know, offer your best," it would not have been Opcat. But, um, [lip smacks] 14:52 you know, the, the, the, the decentralized nature of, uh, upgrades in Bitcoin is, is beautiful, and we want to respect that and work with it. 15:02 And what we're hearing collectively, um, is that th-the Opcat is the one thing that has the most support. 15:11 For instance, there's this wiki page, I forgot who, who created it, asking a whole bunch of core devs, um, you know, what kind of, uh- It's the, it's the covenants table, I think. Yeah. 15:22 So yeah, and it's a famous table now. Exactly. So I, I just this morning tweeted, you know, "Do you see any pattern emerge?" And there are three, uh, suggestions that are pretty greenish, um, consistently. 15:36 Not fully green, but the most greenish. And, um, Opcat is the one that is the greenest, uh, just looking at all kinds of metrics. So, uh, the others are, uh, CTV and CSFS, okay? And which I also, I, I support. Yeah. 15:51 [chuckles] I would say that I support anything that prevents Bitcoin from being ossified and getting ossified and turning into a Rolex, right? 16:00 Something that the rich-- only the rich can sort of self-custodially own, and the rest of us are gonna need, uh, you know, BlackRock and other large financial institutions in order to access. 16:10 That to me would be a very depressing end game for Bitcoin. So to prevent ossification, I think almost any sort of, uh, upgrade in the form of soft fork is, is desired. 16:22 But it seems that Opcat is the one practical thing that, um, has the most consensus, which is why I'm very much in support of it. Yeah. 16:30 And that's been my impression too, is that, um, while Opcat may not be the optimal thing, uh, if we were all technologists being able to design the perfect, you know, system for this. 16:42 But Bitcoin and all these decentralized systems eventually really just become a, a social game of like commit-- you know, convincing all the different parties to buy into this idea. 16:55 Um, this gets into one of, I think, the most interesting, more narrow topics, which is Collider Script. 17:02 Basically, this idea that even if we don't get a soft fork or cat on Bitcoin, there are ways we can emulate it or implement it. They're even clunkier, but I think this brings up a really interesting conversation. 17:20 Can you explain to me what Collider Script is? Maybe to, maybe, maybe a high school level, if possible, um, just for the listener, and then we can talk about like maybe the implications of that. Yeah. 17:34 So first of all, let me say as a, um, as a mathematician, um, who now doesn't have as much time to do math, I have tremendous, um, appreciation of just the, you know, intellectual, uh, beauty of Collider Script. 17:52 Um, it's a beautiful piece of math and cryptography by four, uh, brilliant, uh, researchers, um, Aviv Levy, Victor Kolobov, both of them researchers at, uh, St- StarkWare, um-And, uh, Andrew Poelstra and Ethan Heilman, two protocol, you know, OGs. 18:13 So I think this is like a beautiful collaboration between four brilliant minds. So I just-- It's a very beautiful piece of math. Now, what is the problem? And then a little bit about how it's solved. 18:25 The problem, and this is related to this thing called covenants, you know, the ability or inability to impose any restrictions on a Bitcoin as you pass it on, right? Famously, [lip smack] 18:36 um, it seems that if I transfer a Bitcoin to you, um, then you, Charlie, can do with it whatever you want. Even if I would like to restrict you in some way, it would be impossible. 18:47 So that's exactly where they come in, these four brilliant mathematicians, and they say, "Well, actually, if I'm willing to spend enough money, I can today already send you, Charlie, a Bitcoin that you will be forced to comply with certain constraints when you spend." 19:06 This can already happen today. So covenants, whether you like them or not, they are a thing today. 19:12 And as the famous joke, uh, goes, we already established the fact, and now we are only, uh, negotiating the price of covenants. That is the TLDR of their brilliant paper. 19:26 Now, I can explain a little bit more about how it's done, but basically they show that already today, for a hefty price, you have covenants in Bitcoin. 19:37 [upbeat music] Let me tell you about one of the most slept-on opportunities in crypto. Arch is building fast, composable DeFi apps on Bitcoin. 19:46 Arch apps tap into the OG blockchain with by far the most liquidity and best brand in crypto. I've known the team for over a year. The tech they're building is solid, and they are racing towards mainnet. 19:57 There's DEXs like Saturn, meme coins on funkybit.fun, instant loans on Cha-Ching, and so much more. Plus, they're rewarding testnet users. So join me in trying out Arch while it's still early. 20:09 Okay, let's pin the-- this pri-- this int-- this price talk 'cause I think it does open up a really interesting conversation. Um, dive into just a, a second pass on like how it actually works. 20:20 Collider script, or we're, we're finding SHA-one collisions. You don't have to explain that, but like, again, try to, try to, you know, ex-- tease this out for me a bit. 20:32 So they, they beautifully explain it a little bit in the abstract in the introduction. 20:38 They're like part of the reason there are no covenants today in Bitcoin is that there's like, uh, when you process a Bitcoin transaction, there are two separates, uh, it's like, you know, left brain and right brain, and someone has just cut them in the middle. 20:53 And the left brain can do very elaborate things with very large pieces of information, but they're very limited. They can only compute a hash. 21:04 And the right side of the Bitcoin brain can do a lot of computations, but only with very, very small numbers. 21:11 So you have the left part that is like very smart and elaborate, but can only do one thing, but with very large pieces of data. And there's the right part that can do a lot of stuff, but only with very small numbers. 21:23 What the Kaleidoscript paper shows is that by brilliant cryptography, you can bring together and connect the left side of the Bitcoin brain and the right side, and suddenly you can do a lot of introspection and computations that look at a lot of data. 21:39 And that's-- once you have that, you can actually, you know, enforce or demand that certain constraints be enforced. 21:46 Now, the exact details of how you connect the left brain and the right brain has to do with something called the birthday paradox and collisions in hash functions. I can explain a little bit about that, but I'm not sure 21:59 we wanna go there. I don't-- Yeah, I think that's, that, that was a very elegant, simple way of explaining it. But the way we get these hash collisions w-- is we basically have to do a bunch of math with computers 22:12 to do this and to do-- run those computers, it costs money. And, um, I've seen some attempts at calculating like how much it might cost. 22:23 But again, this is in theory and in abstract, and we haven't-- I don't think we've implemented it. 22:29 Um, but this does bring up the existential question, which you brought up at the beginning, which we'll come back to now, which is, it's simply a matter of negotiating the cost. 22:38 Are we gonna spend all this compute running these computers? 22:42 I guess, I guess here's my first question, which is, um, if we never get CAT, do you think there will actually be financial incentive to try to run Collider script compute or other types of emulation? 22:59 Like, do you think this is eventually going to be in such demand that we, we, uh, actually just brute force these covenants on Bitcoin? 23:10 So, uh, I think that-- I think the short answer y-- is yes, and the longer answer is that, and again, as a mathematician, I can tell you that once we're in the business of negotiating a price of something, once we know that covenants are possible today on Bitcoin for a large cost, 23:30 I think it almost deterministically implies that someone is gonna come up with a new way that does it for, you know, half the price and then half the price. And these things, I think we'll see that they will go down. 23:45 So right now, I think maybe it's ten million dollars to get covenants. Um, I think it won't end there. This is the upper bound on the cost. So I think with time we'll get lower and lower costs. 23:56 Uh, so yeah, I think covenants one way or another over the years, even without OPCAT, will be arriving on Bitcoin. 24:04 And if you consider like the-- I haven't done the math on like what StarkNet spends to settle on Ethereum, but like you're getting-- I mean, that's well withinI would say the budget of just assuming activity today and not activity ten years in the future, like ten million dollars to get a covenant, there's people who would spend that. 24:23 There's probably someone who would spend that today. Maybe it's, maybe it's you guys. Um, so this is interesting because a lot of the conversation around Cat is the fear of what it might unlock. 24:36 And while this is, I think, more narrowly defined to emulating covenants, like, what do you think this does to this-- the conversation around fear of unknown or capabilities? 24:48 Um, this is a pretty broad topic, but I'm gonna throw it at you. Like, what, you know, people who say, "We don't want this because we're-- we don't know what it's gonna do, and we're not ready for it." 24:58 But yet it appears that that's kind of a moot point. What's your thought on this topic? Any soft fork that you do, could it be risky? The answer is always yes. But the question is: What is the alternative? 25:13 And I'm way more worried about the alternative because the alternative that we're seeing today, and it's dystopian to me, is the ossification of Bitcoin and the turning of it into something that is a Rolex, right? 25:30 Something that only the rich, uh, can own directly, and the rest can access it through the traditional financial institutions. 25:38 And, you know, Satoshi's-- the second section in Satoshi's white paper talks about the need for a cryptographic way for any two parties to transact with no intermediaries. 25:54 Now, unfortunately, today, this is not the case with Bitcoin, practically, and I'm much more afraid that we will ossify to the point of this never happening 26:06 much more than I'm afraid that a software-- soft fork, sorry, will have, you know, unintended consequences. 26:14 Because let me remind you that so much of our lives depends on software today, and there's almost no system of software that doesn't constantly go through upgrades. 26:24 And, um, do they introduce sometimes bugs and unintended consequences? Yes, surely. But usually you can address those, and it's not, it's not so frightening. 26:34 And, you know, we do these, we do these upgrades with things that our life depends on, you know, with systems that, um, control airplanes or the air traffic, with things that control, um, you know, um, medical devices. 26:50 We trust our lives with software that we constantly upgrade, and we have no problem with that. So I am not too worried about a soft fork in Bitcoin. 27:01 As much as I love Bitcoin and as much as I, I, I agree that there could be concerns about it, I'm way more worried about the ossification that is the result of, I think it's been two years since the last, uh, soft fork. 27:16 I think it's, it's much more frightening to me, and it's happening. Yeah. I mean, we can see it. We-- We're hosting a conference because-- a-and I'm kinda surprised. 27:24 Like, we're hosting a technical conference which is soft fork forward. 27:29 Pro-- You know, we invite progressives, and we invite conservatives in the technical community, and I can see this firsthand, the challenge it is to, to even when Bitcoin is a comparatively small ecosystem, to still even get some of these conversations going. 27:46 And so, uh, I very much see the, the challenge, um, in the modern Bitcoin era to, uh, to get even, I would say, narrowly defined, uh, changes through. 27:59 But on the topic of changes, you wrote a great op-ed for us a couple weeks ago on quantum, and this is a, this is maybe a little more fun topic because, 28:11 I don't know, like quantum allows us to imagine the theoretical and there's, I would say, probably fewer egos involved in the discussion yet, which is nice. 28:21 Um, and it-- we can almost entertain it abstractly right now, um, without having to argue about implementation or activation. But, um, let's talk a little about, about quantum. 28:35 Um, uh, I've had, uh, Hunter Macy wrote BIP360 on here a couple times, but there's a bunch of different angles on quantum we can take. 28:43 I want you to reprise again in a simple kind of high school way the quantum challenge facing Bitcoin and the, the theoretical risk versus practical risk. You do a great job framing this in your paper. What's quantum? 28:59 Breaking cryptography is about finding a needle in a haystack, right? Of all possible strings that could be my password, only one of them is correct, and an attacker needs to find that, that one, right? 29:17 If it-- and if he does so before me, then, you know, my-- he com-- uh, you know, he compromised my identity or took my Bitcoin. Okay, so breaking cryptography is always about finding a needle in a haystack. 29:31 Now, a quantum computer is like a very powerful magnet, which if you have a needle, a metal needle in a haystack, you bring this, um, magnet and it just sucks the, the needle efficiently. 29:48 So this is the threat of quantum computers. The nice thing is that not all cryptographic systems have metal needles securing them. Some of them have toothpicks securing them, right? 30:04 In which case, the magnet doesn't help at all. 30:07 So the broad distinction in the, in, you know, between things that are susceptible to quantum computers and things that are impregnable to quantum computers, um, is the difference between what's calledSymmetric, sorry, asymmetric cryptography or number theoretic cryptography, which is breakable by quantum computers, and then things that are symmetric cryptography that are pr- that are resistant to quantum computers. 30:33 Okay, why am I mentioning this? Things like hashes, like SHA-2, they are of the, um, of the safe kind. They are post-quantum secure. 30:45 Things that are, um, based on elliptic curves, Diffie-Hellman, RSA, public key cryptography, these things are like metal. So a quantum computer comes, it will break all of the number theoretic stuff. 31:02 Now let's look at Bitcoin. You have-- You sign stuff with things that are based on elliptic curve cryptography, so they're like metal needles. 31:12 But then sometimes you wrap that with a, um, pay-to-hash, which is, um, you know, turning it into a toothpick. Okay. 31:24 So first of all, even if tomorrow a quantum computer emerges and you look at Bitcoin transactions, some of them that expose the public keys, um, are toast, but some others are not. So first of all... 31:38 But we will still have to rescue the kind, you know, the toothpicks. Um, we still have to sort of do something about them because if you try to use them, someone can immediately, um, sort of break your system. 31:52 And this is where the ZK-STARK system, that I'm very proud to be among its co-inventors, comes in because it is post-quantum secure. It can sort of completely, um, fix for those things that are hash-based. 32:07 It can completely fix the situation and allow you to move your keys safely to something that will be in an everlasting way be p-post-quantum secure. 32:16 Yeah, you talk about the, like, the ZKP's family of cryptographic solutions, in particular ZK-STARKs. I thought that was very interesting. I would recommend people go just read your op-ed. 32:28 I do-- You have a section in there which I think does help frame the discussion pretty well, which is on you make this analogy to, like, quantum and nuclear fission, right? 32:38 'Cause, like, there's a lot of people who are like, "We should-- This quantum discussions, it's a total red herring. We should never, never do this. It's, it's just this useless professor thing." 32:46 And I'm like, well, I mean, uh, is it? 32:51 You make a very good analogy here for how to think about this from a risk and as we're in this theoretic phase to perhaps someday in an actual C quantum implementations. 33:05 What is this analogy you make, uh, and how does it help the listener think about quantum? 33:10 So in that analogy, um, we, we're at the phase where, you know, the rudiments of, let's say, nuclear, uh, physics have been invented, but we're still, uh, several years or even a decade or so before, um, a nuclear bomb arrives. 33:27 And the nice thing is that that gives us sufficient time to actually move to a system where the nuclear bomb just cannot explode and doesn't cause any harm. 33:39 Basically, by moving from, um, systems that are based on number theoretic assumptions that would be blown away by a quantum computer, you can move to systems, for instance, that are based on ZK-STARKs, um, that are completely impregnable to, um, quantum computers. 33:58 We have enough time to do that. 34:00 So it would be a very complex process because, you know, we're all used, you know, all the wallets, the hardware wallets, everything is like sort of made for the, um, existing systems which are breakable by quantum computers. 34:14 But if we put our minds to it, we could actually move to a system where, uh, you cannot break-- even a quantum computer cannot break, um, you know, any transaction on this new form of Bitcoin. 34:27 A couple, I would say, challenging questions on this topic for you. Um, and I'm not familiar with other, like, 34:34 algorithms to-- w-which, which might be quantum secure or on some gradient here, but I know there's, like, multiple different algorithms out here, um, that say we could do this and make Bitcoin quantum secure. 34:50 Why ZK-STARKs, um, over some of these other ideas? Well, how, what, how do-- Maybe... And feel free to be a little technical on this if you wish. Okay. 35:02 So first of all, for the new signature sq-scheme to which you move, yes, there is a large number of, uh, suggestions and different protocols that not all of them are based on post-quantum safe, um, ZK proof technology. 35:19 There are things based on lattices, there are things, uh, based on hash functions, and, and, uh, they're all viable approaches. 35:29 The nice thing of, um, or the one advantage that you have with a ZK-based system is that it allows you, even after, 35:41 uh, quantum computers are around, for those, um, transactions-- Sorry, for those Bitcoins that are secured currently by a hash, but that under that hash, something like a pay to 35:58 public key hash, right? And maybe Satoshi even has some of these transactions. So let's take a concrete case. 36:05 So I don't know if Satoshi has transactions that are secured by pay to public key hash, but suppose he or she does. 36:13 Okay, and now a computer-- quantum computer has come, and you have a whole bunch of transactions that haven't been ported over to the new format. So nowSatoshi comes around and wants to move to the new system. 36:28 Well, if Satoshi were to, um, do a, uh, a standard transaction, um, he would have to expose, um, a public key that is breakable by, eh, Shor's algorithm. 36:45 So that rules it out. 36:47 The only reasonable way to save the situation goes through a post-quantum secure ZK proof, where Satoshi would prove that he knows a preimage that corresponds to, um, a valid public key. 37:06 And that is exactly where something like ZK-STARKs shine in. So yeah, just summarizing. 37:13 For the new format for proving things in-- Sorry, for signing things in Bitcoin, there's a large number of suggestions, some of them based on ZK-STARKs, but many others not. 37:22 But for allowing someone like Satoshi to move, uh, things that are hidden under hashes in the existence of a quantum computer, I think ZK-STARK is pretty much your only option. 37:34 Hi, this is Charlie, and we at Blockspace are putting on OpNext, a technical scaling conference for Bitcoin. 37:41 It's coming up here very soon, April eleventh and twelfth at the Strategy, formerly MicroStrategy HQ in Tysons, Virginia. 37:49 Join us on April eleventh and twelfth for talks and presentations from the likes of Jameson Lopp, Jeremy Rubin, James O'Bern, John Attack, and many more on the most pressing questions for Bitcoin's future and technical development. 38:03 Tickets go up in price on April first. They're going fast. Get them while they're cheap, and we hope to see you all there in April. Go to opnext.dev, that's O-P-N-E-X-T dot D-E-V, to get tickets and learn more. 38:16 You gave me a great segue into my next question, which is, so we know that Satoshi has, uh, mined a bunch of Bitcoin back in the day, significant amount, estimates of, uh, a million or so Bitcoin, and we identify this by a pattern which we relate to Satoshi. 38:34 But we look at like that era, and you have a lot of those coins which are vulnerable to a, a quantum computer. 38:45 And this has sparked some discussion on like what should the Bitcoin network do if, um, if somewhere down the road, we-- these coins have not been migrated to a quantum, post-quantum secure signing scheme. 39:02 And, um, [clears throat] like it's been pretty interesting. 39:05 I've-- This has been a kind of a new conversation the past few weeks where I've seen, um, long-time well-known core dev, uh, Peter Willa, um, uh, Jameson Lopp, another big name in Bitcoin. 39:18 Both of them have argued for, um, uh, basically you might call it confiscation or you might call it burning of those legacy coins, those vulnerable coins. 39:32 And this has sparked some interesting discussion because folks like Hunter and my init-- my own, my own personal initial reaction was, um, to not do anything. 39:42 I don't know if you've thought much about this topic or if you have any opinions, but I'm curious, what's your-- do you have a take on this and what's your, what's your reasoning? 39:54 So I now realize I have to write a blog about it. But here's, uh- [laughs] Sounds like you do. 39:58 I haven't spent-- Yeah, I haven't spent a lot of time, but, uh, I spent a little bit of time, and here's, here's what I would suggest. Um, I really hope, and this is where I need to do a little bit of research. 40:09 I really hope that within this pattern, there's some place where, um, something Satoshi has done or stated, there's a hash that no one but Satoshi knows the preimage of which, okay? 40:24 And everyone agrees that that is a Satoshi thing. And hopefully, there are several of them. 40:31 So what I would suggest, right, if, you know, someone asked me, you know, "You dictate what should be done," I would say something like this. For a pretty long time into the future, 40:42 you know, in the-- And now we move to a Bitcoin-- sorry, to a post-quantum state. So within this huge transition, which will necessarily be a hard fork because all of the signature scheme will change. 40:53 So anyways, it must be a hard fork. Within that, um, the new protocol says, in order to spend any of Satoshi's coins, um, you need a ZK-STARK proof of knowledge of a preimage of one of those hashes, right? 41:09 And, uh, or maybe a few of them. So, so there will be some social discussion. 41:13 We agree what S-- what would make us identify Satoshi, and we would say if Satoshi proves to us, um, that he controls, you know, he knows the preimages of those things, then he gets, uh, all the coins. 41:27 But I would probably put a limit in time on it, and after some time, deprecate it, and then extend the mining, you know, halving thing so that we actually go back to twenty-one million coins, um, at infinity, right? 41:42 That's what I would do because, uh, I would just say, well, practically speaking, and it could be a pretty long time horizon, I don't know, thirty years, fifty years. 41:50 I would say that if in within fifty years Satoshi has not came, come back and, um, you know, then the only thing that could happen is he's somehow, you know, cryogenically, uh, frozen or maybe, you know, he's been, uh, taken by, um, you know, uh, extraterrestrials and will be brought back. 42:09 So I would say in that case, you know, by the time, uh, he or she comes back, well, they'll find some way to convince us, and I'm sure the world will reward them. 42:18 Already more than a decade ago, I said that Satoshi should receive both the, the Nobel Prize, you know, at least for economics, maybe also for peace, but also, uh, the Turing Award. 42:29 So likeUm, you know, he'll be commemorated in other ways if that happens. They'll, they'll come-- Yeah, that'll be, that'll be quite a day. 42:39 There'll be, uh, every single award ever by the time they come back fifty years from now. We'll just- Yeah. So, um, I think maybe to wrap this up, uh, really enjoyed this conversation so far. 42:50 Um, to wrap this up, one of my favorite analogies, and I actually sub-tweeted this, uh, um, that you mentioned, I think, a week or two ago, and I'd not heard this, and you, you mentioned here, is this 43:03 fear of Bitcoin becoming a Rolex analogy. And you did already talk about this, but I wanna revisit it because this very succinctly sums up my own personal views, 43:14 which is many of us who've been in Bitcoin a long time, I don't like to think I've gotten complacent, but I do, like, look at the Bitcoin of potentially the near future, and it does not look like the, the same Bitcoin that I got into or the reasons I got into Bitcoin. 43:31 Which is I feel that Bitcoin should be accessible to people without intermediaries. Um, and you say, and I agree with this, that we're headed to a future where it does not look like that's going to be the case. 43:49 I want you to revisit this topic, and maybe let's end with just you telling a-- you telling the listener, like, why, 43:58 like, why is Bitcoin headed to be a Rolex, if you will, and, and, and what are the ways we can avoid or prevent that future? Right now, Bitcoin is not accessible 44:15 to most of the world in its true form, which is by sending and receiving transactions through the Bitcoin protocol. It doesn't-- It is too costly, it is too cumbersome. 44:28 And now even if you're a Bitcoin max and you think it's the best invention ever, you have to face reality. Most of humanity does not use Bitcoin, period. It just doesn't. Now, 44:42 you could say, "Well, they just don't know yet." And, and I think-- But, but that's the reality, and we've been at it, you know, for more than fifteen years. 44:52 And the same applies to a lesser extent, but still applies to the Lightning Network, right? Which was supposed to be the way to scale, um, Bitcoin. 45:01 The reality is that, first of all, it also goes through centralization, um, and it is not, um, used enough. It is not convenient enough to use. 45:12 And I'm reminding that in order for it to be used, you have two issues with it. You need interactivity. You need to be-- have someone you trust be online all the time or else your tokens might be stolen. 45:26 And you have capital inefficiency because in a payment channel, both sides need to put up collateral that is higher than the amount they transact on. So those are probably the reasons that that's the way it is. 45:38 So the reality today is that those of us who want to use Bitcoin simply cannot for our daily groceries. Now, so, so where is Bitcoin heading? Certainly, it's making headlines. 45:51 You know, heads of states are talking about it. You're gonna have governments creating-- companies creating reserves for it. 45:56 And it could very easily turn into something that is held in a self-custodial true way on Bitcoin only by the rich, which is what I meant by a Rolex. 46:07 Whereas the rest of humanity, if you want to access it, you must do it through, you know, ETFs, through financial institutions, through things that then it just is another asset class to you. 46:18 So the whole purpose of Bitcoin, in my eyes, which was empowerment of individuals, allowing everyone to participate in a way that is with no intermediary. It's, it's just Satoshi's word, right? Words. 46:34 The second-- The first sentence of the second paragraph in the white paper, we need a way, uh, I forgot the exact quote, to cryptographic-- a cryptographic way to allow any two parties, any two parties to interact with no trusted intermediary. 46:50 Right now, Bitcoin is failing this. And I think if Bitcoin doesn't fix-- if we don't fix this, if the world doesn't fix this, then... 47:01 Well, personally, I am not interested in creating a new yet another asset class for the rich. 47:08 You know, in addition to the Picassos and Bansky pa-- uh, you know, pictures and all kinds, and the Rolexes and the diamonds and gold and other assets. I'm not interested in this. I don't care for it. I mean-- 47:21 And I think many people that are in it for freedom and for empowerment indivi- of individuals are not interested in just having created another Rolex. 47:33 And I think in order to, to prevent, pre-- to, to-- in order to prevent Bitcoin from turning into a Rolex, you must allow, um, true development of the infrastructure, and you must have a lot of, um, developers being able to contribute to it and build it. 47:50 And right now it's getting harder and harder, and people are losing faith, right? It's been two or three years since the soft fork has happened. 47:58 Can you imagine any other infrastructure, um, software that is a living system that doesn't have any upgrades to it and updates? I think it's-- And it's not even about Opcat. It just is-- 48:09 Well, I mean, I'm an optimist, so I think this will be fixed, but-- And I think the, um, you know, the, the, the sort of arc of history of freedom, of empowerment of individuals is stronger, and it will prevail. 48:24 But for that, we need soft forks. We need this thing to evolve and not ossify. That's very well said, Eli. I appreciate your emphatic words. You've been around in Bitcoin a long time. 48:37 I think a lot of us who've been in Bitcoin s-- a long time can sometimes lose that initial energy and kind of that romantic initial, like, discovery of Bitcoin that many of us first had. 48:49 Um, so I appreciate your, uh, words and thoughts on this. 48:55 Um, just to, to wrap this all up, um, if someone's listening to this, never heard of Starkware, never heard of you, never heard of you guys, where do they go to, to follow along with your stuff, your company, and your work? 49:08 Well, they can follow me on Twitter. They can follow Starkware and Starknet on Twitter. Uh, yeah, I will share a few links. There's a lot of resources about the math. Um, 49:19 you know, um, I once in a while do a Stark at Home webinar, and there's a bunch of them already out there explaining the math and the vision and stuff like that. Um, so I hope we can share some links there. But, uh- Yep. 49:32 You betcha... very easy to find us. Google ChatGPT, your favorite Perplexity, whatever. They all know about us. Great. Thank you so much, Eli, and I wish you the best. 49:42 And one of these days I'll see you in person, whether it be, uh, I don't know which continent it'll be on, but it'll happen. So I wish you the best. Thank you, Charlie. Thank you so much. Peace. 49:55 [outro music]
