May 12, 2026 • 40 mins
In Episode 140, Patrick and Ciprian are joined by Yoon Auh, founder of NUTS Technologies & BOLTS Technologies. The team discuss the unique approach to cryptography designed to future-proof data against quantum threats. Discover how his protocols enable dynamic encryption, adapting to evolving security needs. This conversation highlights the urgency of innovation and the strategic role of adaptable cryptography in today's rapidly changing landscape.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_03 (00:40):
Hey Tiffreen, how are you doing?
SPEAKER_01 (00:42):
Hey Patrick, I'm doing well looking forward to
another great episode ofEntangle Things.
SPEAKER_03 (00:47):
Yes, this is a timely one.
So we're joined by Yoon.
Yoon, do you mind introducingyourself to our audience?
SPEAKER_02 (00:53):
Sure.
I'm Yoon Al, and I'm the founderof uh two companies, Nuts
Technologies and BoltzTechnologies.
Um we deal with appliedcryptography and delivering
cryptography where it's needed,when it's needed.
SPEAKER_03 (01:07):
So we've talked before.
Um this is about handling, andcorrect me if I'm wrong, this is
about handling the transition ofencryption types because we
haven't had to do that indecades.
We haven't had to fundamentallychange from RSA, elliptical
curve.
Those have been around for along time.
But now, because of post-quantumcryptography, because of Q Day,
(01:31):
people have to migrate to a newencryption.
And I I think your philosophy,if I'm reading it correctly, is
why would you do that in a waythat makes it inflexible in the
future when you can do it in away that makes it flexible so
you could change every month ifyou had to?
Because we don't know whatquantum's gonna bring and what
threats, which which NISTprotocols are gonna get debunked
(01:52):
or or or hurt.
Does that sum it up a littlebit?
SPEAKER_02 (01:56):
That is correct.
That that is the gist of what wedo.
And um our approach really camefrom not even, you know, I I
don't think we were smart enoughto even um anticipate this
quantum problem.
Um when I started on thisproject back in 2013, my main
(02:16):
problem was theincompatibilities and the lack
of interoperable um things thatyou could have from just even
like products that say that umthey are AES 256 compatible.
Um when you even have uh twoproducts like that, they don't
even talk to each other out ofthe box.
(02:38):
You have to actually have aconsulting company or
integration effort that makesthose two things talk.
Because unbeknownst to you knowpeople who don't dabble in the
actual cryptography of uh youknow encrypting data, AES, the
family of AES algorithms come inalmost innumerable variants
(03:00):
based upon what parameters youpick, right?
And we we all know about thethree key sizes, like 128, you
know, 192, and 256.
But there's like five or sixother critical parameters you
have to pick.
And when you talk to twodifferent applied
cryptographers, they will havevarying opinions, very, very
(03:21):
passionate, about which onesthey feel are better and why
they don't want to use the otherone and things like that, right?
And so so it's like those arethe hidden garbage and and and
details of of cryptography, andthat's not really delved into
too much at all, and that causesa lot of problems
programmatically.
(03:42):
And um and that's the problemthat we were solving is how do
you how do you create a API anda library set and encapsulate
data in such a way that theencrypted or digital signature
stuff that you're doing arecompatible to one another
without all of these manualadjustments and and
(04:03):
configurations.
SPEAKER_03 (04:04):
So we saw very similar effort that was very
successful with XML, where datacould be moved from one place to
another and it wasself-describing.
And it's that's that's what yourtechnology is accomplished.
SPEAKER_02 (04:19):
We're doing self-describing at the message
level for the cryptography thatwas used on that message.
Now, we have you know um JWE andall of those stuff, but I think
they're still very primitive.
What we do is we allow for thesequencing and um multiple
(04:41):
operations on that same message,which you would typically do um
in a program that usescryptography.
So um, and then what the otherunique thing that we do is um in
this, we we call it atransmutation command set where
we normalized um datatransformation commands along
(05:03):
with applied cryptographiccommands.
And as far as we know, that'snever been done in one command
set, right?
And that is the essence of mostcryptographers' jobs.
SPEAKER_05 (05:16):
Yeah.
SPEAKER_02 (05:17):
Is you go into code and then you go, hey, how do I
massage the data so that I canprepare it middleware to be
encrypted or signed, you know,and stored.
Um and then and then they gottado the flip side, right?
They gotta do the write routine,which is how do I turn that into
something encryptable?
And then on the on the flipside, you gotta do, you gotta do
(05:38):
the read side, right?
You gotta say, how do I take theencrypted data, what did I use,
and um what were the parameters,and you can do it the reverse
process.
And you know how many errorshappen between developing those
read and write pairs, right?
So what we did was we said, ifwe had these simple, normalized
transmutation command set thatdescribes what you do to data in
(06:02):
order to take it from a datastructure in memory all the way
to encrypted message, um, youknow, why don't we just run the
whole thing backwards?
That way you only have to do theright part of the application,
right?
SPEAKER_05 (06:18):
Right.
SPEAKER_02 (06:18):
So you say this is the one way of creating the
message, and then when youreceive the message, you go run
it backwards.
And that that that is an areathat's called reversible
computing.
And that was developed by I IBMresearchers maybe, you know,
forty, fifty years ago, and andthey did that for the purposes
(06:40):
of there was a theory that allof computing, the heat generated
from computer chips when they'rerunning comes from changing
data.
And um they they were trying tofigure out if they could do
reversible computing, can youactually conserve the heat, you
(07:01):
know, and and reduce the heat.
And I I thought it was veryinteresting, but the one
practical thing out of I got outof that research paper was that
you know, they have this conceptof reversible computing
languages, and we took that ideaand transformed it for a very,
very specific and small usecase, which is the
(07:24):
transformation and encryption ofmessages.
And uh within that smallcontext, it's a very
well-defined problem.
It's not a uh so when you gointo reversible computing, you
got major problems if you talkabout the types of instructions
you could have in a computinglanguage, uh, and it gets very,
(07:44):
very messy.
Uh but in a in a tight set ofdata transformation and applied
uh applied cryptographicfunctions, that uh universe
shrinks drastically, and it's avery closed system, and we could
control it better.
Um and so that's the essence ofwhat we do, which is compact
language called transputation uhcommands, and the ability to
(08:08):
encapsulate that alongside themessage you just created.
SPEAKER_03 (08:14):
And that gives you encryption at rest.
Because you encapsulate the theobject.
SPEAKER_02 (08:19):
That's a great thing because you're you're bringing
up something that's critical towhat we did was we saw
incompatibilities,interoperability problems.
The the you know, one questionwas where do you put these
parameters that you chose?
Right?
And if you've ever programmed,it starts as a global variable
or some configuration setting,it goes into a you know a CFG
(08:42):
file or some text file, then itends up in being some database
or the worst case, worst case ishard-coded, right?
unknown (08:49):
Yeah.
SPEAKER_02 (08:50):
He said, shove this all into the actual
transmutation command set andput it alongside the message you
just created, that becomes themessage, right?
And what that does is that weunify data at rest and data in
transit modes of applyingcryptography to data.
(09:13):
And and so that sounds kind of aweird thing for people who don't
know the uh cybersecuritylandscape, but in cybersecurity,
when somebody says, Hey, I needthis data to be encrypted,
applied cryptography teams, thefirst question they're gonna ask
is, is that in transit or isthat at rest?
That's right, right?
Because they have two totallydifferent ways of approaching
(09:36):
it, totally different sets oftools to use.
And we said that's stupid,right?
That's like, why are you doingtwo twice the amount of work?
And then um, when you want totake data at rest and move it, a
lot of times they won't justmove it because it's not in the
right format to be moved.
You know, because if you moveit, you you're implying that the
(09:58):
recipient knows how to processthat data, and that may not be
necessarily true.
So what happens a lot of timesis the data gets decrypted by
another program, re-encryptedfor transit, and then on the
other side, another processencrypts it in the system that
they know how to uh encrypt anddecrypt um data at rest.
(10:21):
So that's a major amount ofwork.
There's a lot of uhtransformations going on, and
then what we consider is thatthe transformation points, both
at the sending part and therecipient part, they are
cybersecurity weaknesses thatyou're introducing.
Right?
So anytime you have secret dataand you have a process that
(10:45):
decrypts it or re-encrypts it tosomething else, um, you know,
you're you're just you're you'reintroducing slowness, uh,
inefficiencies, and possiblevulnerabilities uh to your
sensitive information.
So we wanted to just removethat.
So with our um we we call thistechnically we call this
structured data folding withtransmutations, and for our
(11:08):
bolts technologies effort, we'vewe've ref rebranded it as QFlex.
Apparently, my team did not likeSDFT as a popular thing.
So they they said we needsomething that rolls a little
better, and we called it QFlex.
And um, and so that's what wedid was we we did we created
this protocol.
(11:29):
It's good for both messages andtransit and data to be saved on
your long-term storage andpersistent storage.
And persistent storage, Ibelieve, is where the real
problems, the longer-termproblems, are going to be.
So if you look at dataencryption systems that deal
with massive amounts of storeddata, um there is no standards,
(11:54):
there are no compatibilities,everybody has their own systems.
SPEAKER_03 (11:57):
Well, and things change over time.
SPEAKER_02 (11:59):
Key sizes over time, um, that requires massive
amounts of downtime to upgradeand and re-encrypt stuff.
SPEAKER_03 (12:07):
And in our debt.
SPEAKER_02 (12:10):
Absolutely.
And and for us, it's like if youdo it on an object basis, which
is a file, um, it'sself-describing.
So you could just, upon somebodytouching it, it'll it'll
re-encrypt itself, right?
And then um, and then others,you could just do it
periodically with a like aspider program in the
background, right?
And then just touch things alongthe way, and it'll just do it
(12:32):
incrementally.
So it's built for the dynamicnature of uh data lifecycle,
right?
That it doesn't end with one uhstate being re-reached, that
state may continually changeupon different requirements.
SPEAKER_03 (12:46):
Right.
So there's a lot of talk about Qday, and we've covered it here
before and talked about itbefore, and post-quantum
cryptography, quantum safe.
There's lots of different wordsfor it.
And I imagine that this it'scausing a lot of agita in places
because one organizations don'teven know where they're using
different types of encryption.
They don't have they need anaudit.
(13:07):
They need uh and and we talk topeople at IBM and others.
Is i is there a consulting phaseto figure out where they're
using encryption?
How how does this get rolledout?
Is it is it a big lift?
SPEAKER_02 (13:22):
It's a huge lift because we've had the luxury of
using a handful of algorithmsfor nearly 50 years.
SPEAKER_05 (13:30):
Right.
SPEAKER_02 (13:31):
Um I I think that's a very unusual thing that's
happened because uh in theearlier times, like in the 70s,
80s, 90s, I think you will seethat cryptography changed quite
rapidly.
Right as as as microprocessorsincreased in their uh
capabilities and speed andmemory, um, we changed
(13:52):
cryptography quite often.
And um and and but that was lostas soon as we reached AES and a
certain you know chip level umand and RSA and and ECC, I think
people settled on, hey, youknow, this stuff seems pretty
good, everybody start using it,and now it's all over the place.
(14:14):
And and the world, the digitalworld, on the value that it
holds in terms of information,from the year 2000 to now, I
think we could all agree that itis exponentially greater in
terms of the amount of datathat's that's exposable and
that's been collected.
(14:34):
So the um, you know, the thedebt is huge.
The the thing to change is isjust monster.
And the changes that we may havehad to do back in year 2000 no
longer even applies now becausethere's so much work to be done.
And I think that's where theproblems are, is that we've been
so accustomed to this methodthat everybody and anybody had
(14:58):
to use some variant of it whenthey want to build secure
systems.
So it's it's ingrainedeverywhere, right?
And and um that is a nationalstandard.
The Department of Commerce'sNIST, the National Institute of
Standards and Technology, hasenjoyed um sort of this
figurehead and authorityposition around the world uh
(15:21):
because they developed theexperts and the methodologies to
evaluate and and analyzecryptography.
And they were at the top of thisfood chain of cryptography for
the last like 30, 40 years,easily.
The entire world follows thesestandards, and now it's about to
(15:42):
change in a dramatic way, yeah,right?
Because a lot of things havehappened during that time.
I mean, if you remember thecourt cases of the PGP uh, you
know, being public and not, youknow, and and and and the
government kind of losing thatcase, then you also go to the
cases of uh the Clippert chip,right?
(16:03):
And um you look at kind of uhinterference by government to
try and get ahead and get a peekat everybody's stuff.
It did not do anything to gaintrust in whatever we say as a
country and as a as an agencythat says that wink wink,
whatever we say is a standard isgood for everybody, right?
(16:26):
So it kind of like everybodystarts taking a step back.
And you'll see the evidence ofthis because China and South
Korea have each declared thatthey've set up their own
post-quantum cryptographystandards agencies, uh, which is
parallel to the NISD's PQCstandards agency, right?
(16:47):
Uh department.
And uh and then you have someEuropean countries taking a look
at that as well.
I mean, you know, what do we dowith the remember the uh the
revelations of Merkel'sconversations being recorded and
you know, whatever?
It didn't engender a lot oftrust.
So they're also thinking aboutputting in different departments
(17:10):
or taking on the responsibilityof having their own PQC
standards.
And as I mentioned, with justlike with AES, standards on uh
from PQC may be that we're usingthe same algos, but they're
picking different parametersets.
Right.
That's all that means, right?
(17:30):
And sometimes they'll change thealgo a little bit, but um you
know, these days, uhcryptographic methods are
generally free.
Um, they're generally notcreated by one or two
individuals, they're a groupeffort across the world.
Um, you'll see evidence of it ifyou take a look at who's behind
(17:52):
these first three NIST PQCstandards.
There are groups of academics,corporate experts, and
scientists behind it.
So it's no longer an individualeffort, it's generally available
to the public.
And, you know, the old saying isright now I think cryptography
is like a dime a dozen, right?
(18:13):
You will find new cryptographywhen you need it.
There's many differentapproaches.
Um but here's the here's theproblem.
Like I think you going back towhat you just said, we've
enjoyed this period of a handfulof cryptography for decades,
serious road testing, right?
Enough road testing that peoplesay, hey, you know what?
(18:36):
I think it's pretty safe, right?
SPEAKER_03 (18:38):
Um and it has been.
SPEAKER_02 (18:40):
Yes.
And all of these PQC algos, noroad testing.
These are brand new tires you'reputting on that on that car.
And uh how do you figure outwhether it's really safe?
Right?
I think that's a centralproblem.
One thing that's not reallymentioned a lot is that I think
(19:01):
in in all of cryptography,there's only been one provably
secure cipher.
And what I mean by provablysecure is management.
SPEAKER_03 (19:11):
The one-time pad, I think, is what you're talking
about.
SPEAKER_02 (19:13):
The one-time pad is the only algorithm that has a
mathematical proof that it issecure.
But for digital commerce, it'svirtually useless.
And so they don't really use it.
Um you've seen variants of it inthese uh apocalyptic war movies,
right, where they crack open thecode and and you gotta have a
(19:35):
physical thing, right?
SPEAKER_05 (19:37):
And and check the number.
Yeah.
SPEAKER_02 (19:39):
Yeah.
Um but um, you know, I I thinkthe if you look at the flip side
of that statement, that there'sonly been one time pad is the
only one that's provably secure,what it says is all the rest are
guesses.
SPEAKER_03 (19:54):
Yeah.
SPEAKER_02 (19:55):
Including stuff that we've been using.
SPEAKER_03 (19:57):
So Cyprian and I have discussed in the past if
Shore hadn't come up with hisalgorithm when he did, if
instead he came came up with itin 2032 and there were already
sufficiently powerful quantumcomputers to leverage it, it
would have been a very differentstory.
Absolutely.
And we're we're one mathbreakthrough or one realization
(20:19):
or one AI, you know, stepfunction away from, oh, we
thought this was secure and it'snot.
Right.
And so I think the flexibilitythat you're talking about is is
pretty critical.
SPEAKER_02 (20:32):
Yeah, so you know, that's where uh this comes in,
is that when we um we developedthis technology in the pursuit
of creating better encapsulatedprotection for data, and we call
we developed it in NutsTechnologies, that's a company
that we formed for it.
Uh, we used this SDFT QFlexprotocol to create very complex
(20:57):
data structures to store andprotect um unstructured data.
Um and then we saw this um NISTuh grant program, which is a
SIBR grant, SBIR.
SPEAKER_03 (21:10):
I know the SIBR program very well.
SPEAKER_02 (21:12):
Right, that's a federal thing where they uh it's
called Small Business InnovationResearch Grants.
And the NIST as an organizationcovers most of the foundational
uh scientific fields, right?
From from measurements all theway to chemicals to
cryptography.
And um they they give out about10 or 12 of these across all of
(21:34):
their science science fields.
And um we happened to put one inuh and we got selected for in
2024.
SPEAKER_05 (21:42):
Cool.
SPEAKER_02 (21:43):
We got you know, here's here's some money, you
got a six month project.
We'd like to see what youproposed.
And what we proposed was that wesaid we realized that you guys
are saying that there's a uh PQCtransition problem, right?
How do you equip Coordinate allthese transitions across all of
these systems and all thesecommercial and government
(22:04):
vendors.
SPEAKER_03 (22:05):
The heavy lift we talked about.
SPEAKER_02 (22:06):
Right.
And uh and we said, you knowwhat, if you're gonna go through
the pains of doing this once,why don't we just do it in such
a way that it never gives usthat problem again for
transition?
And we have a protocol thatallows you to change
cryptography per message if youwanted to.
(22:27):
And um therefore, theoretically,it's so granular, you can never
have this transition problemagain.
We could transition on uh everymessage.
And they selected us and and weactually were overseen by um one
of the leaders of the uh PQCselection committee.
(22:47):
Um and um I asked him, I said,Hey, you know, uh you must get a
lot of uh proposals.
Why did you pick us?
And he said, you know, it wasvery interesting because we were
kind of we didn't know if thiswas even possible to this extent
and we wanted to see it.
Now the the the difference inour proposal for SIBR phase one
(23:13):
projects is that if you'refamiliar with the SIBR program,
simp phase one program projectsuh any last anywhere from three
to six months and the endproduct is usually a research
paper or PowerPoint.
Okay, there is no work beingdone except thought process and
and and maybe some prototypesthat you do.
(23:40):
Right.
But it may or may not be uhreal.
Um what we told him in ourserver phase one proposal, we
said, we actually have thisworking, and uh what we'd like
to do for you is prove by takingyour PQC candidate algos at any
standards that you've come outwith, incorporate it into our
(24:03):
QFlex library, and show you andprove to you that we could
change cryptography per message,including all your PQC variants.
And so it's a very differenttype of phase one where we're
actually producing phase twolike work, right?
SPEAKER_05 (24:19):
Right.
SPEAKER_02 (24:20):
Uh so for them I think it was a great bargain,
right?
They're like, oh, these foolsare willing to do the work for
phase one money.
SPEAKER_03 (24:27):
And they and they don't give you a ton of money,
but they gave you some so youcould actually do something you
had to do anyways.
SPEAKER_02 (24:33):
Yeah, I mean, you know, it was a$100,000 check, so
that's great, right?
Um uh, you know, it I I don'tthink it pays for the work, but
it's it's a nice recognition.
SPEAKER_03 (24:42):
Yeah.
SPEAKER_02 (24:43):
And um it's a nice it's like a nice tax refund,
right?
But anyway.
SPEAKER_03 (24:48):
So Cyprian, you know, you you're a great
representative of somebody who'snot based in the United States.
I'm not sure of you, and but I'msure many of our audience
haven't heard of the SIPRprogram.
The SIBR program is thegovernment's attempt to, the
U.S.
government's attempt to findtechnical solutions to problems
that they've found oranticipate.
Kind of like if you know aboutum DARPA, it's kind of like a
(25:10):
low, low version of DARPA.
So if I'm in uh you know acolonel in the Army and I can
say, you know what, I got thisproblem, I need a a portable,
you know, shed that is like uhlike radio frequency blocking.
And somebody might say, hey, Igot an idea about using a
refracting paint, and I can makea shed for you, you know, in the
(25:31):
field really quickly.
And and they fund this, but thea big part of it is they want it
to be both for the militarypurpose but also commercial.
So a company like you know, nutsand bolts, they they that's
perfect for them because theywant to see that money they
spend also benefiting thecommercial market and driving
the economy.
I don't know.
Have you ever heard of that,Cyprian?
SPEAKER_01 (25:53):
Yeah, yeah.
Actually, I I I did.
But there's there's one thingthat that I I like to bring up
when we when we do thisdiscussion, so I really want to
get your perspective on it.
Like we understand very well thechallenges and the complexity,
right?
What do you see as being thelevel of perception and
(26:14):
understanding um out there, likein various organizations, in
various kind of uh structuresout there?
Because what we are seeing isthat in some cases they are
aware and they're taking steps.
In some cases, they currentlydon't care because they think,
oh, the quantum threat is notthat close.
(26:35):
So, what do you see out there interms of is there like a sense
of urgency for folks, or it'ssomething that they still think
they have enough time toaddress?
And I'm talking obviously aboutthe transition because I love
what you are talking about.
Having a solution that willprevent the problem in the
future is probably a solutionworth having, yeah, instead of
(26:59):
just going because I've seen alot of talks also,
unfortunately, about let's dolike a big bang transition from
whatever we have today tosomething else, which will
essentially just put us maybe 20years from now into the exact
same position.
SPEAKER_02 (27:14):
Right.
SPEAKER_01 (27:15):
Exactly.
SPEAKER_02 (27:15):
It's it's you know what you're saying is the
equivalent of taking NyQuil fora flu, right?
You're you're you're treatingthe symptom rather than the
cause, right?
And and and and so I thinkthere's a difference in in how
we approach the problem.
In terms of what we see outthere, it's like it's like
politics, right?
There's like there's likethere's conservative and there's
(27:37):
like you know, the other side,right?
And and the it's very few uh arein the in the area where they're
taking it very seriously, right?
Um and in that area, I thinksome are motivated by doing the
right thing, which is addressthe risk when you see it and
when you know that it istheoretically possible and it's
(28:00):
coming.
And then there's others whereit's mostly for like, you know,
they want to run a business andgrow a business in this area.
Now we're kind of doing both inthat we we happen to stumble on
this particular solution not bydesign.
We we were solving a t a verydifferent problem.
(28:21):
But towards the end of that NISTproject, um the cryptographers
overseeing the final report,they asked us, they said, hey,
you know, this uh SDFT protocol,which we call QFlex now, might
be a pretty good solution forblockchain.
Have you taken a look at that?
(28:41):
And we're we weren't reallyblockchain people, right?
And and we said, oh, that soundsvery interesting.
Well, we will take a look atthat.
We did a little, you know, quickresearch, and it's like, oh my
god, you know, a blockchaintransaction is a uh is a QFlex
message.
And we could equivalent, youknow, equate the two, and if we
(29:02):
do it the right way, we willallow an architectural change
within blockchains that they'venever seen before or even
thought it was possible, right?
So even you know, I don't knowwhat you've uh heard about
blockchains, but blockchains isum decentralized and you know
(29:22):
distributed, but they it isautocratic in a in a in a weird
way when you think about what'sthe essence of blockchain that
they're protecting, and it's theindividual users' assets, which
is just a number, right?
And um, how do they protect it?
(29:44):
That method of protection isdictated by whoever or what
group governs that blockchain.
And right now, 99% of all thevalue in blockchains is pretty
much protected by one algorithm,elliptical curve.
SPEAKER_05 (29:59):
Elliptical curve, yeah.
SPEAKER_02 (30:00):
Right?
So I'm like, my money, I want tochoose my lock, and I can't.
Right?
I I that's uh so that's kind ofabsurd, right?
It's like going back to highschool when you could lock your
locker with any lock as long asit's provided by the principal,
right?
Yeah, because he has the masterkey, right?
(30:23):
So so I'm like, I'm like, we'restill in the same like infantile
boat, and it's like we gottagrow up, give that control back
to the user or the wallet, sothey could change dynamically,
and blockchains are now foreverfuture-proof if they put QFlex
in there.
And and so that is the proposalthat we're putting out there
(30:44):
because we think it is closer tothe ethos of what blockchain was
meant to do.
And you know, if it's yourasset, you should have the
ability to choose the lock tosecure it with.
The flip side of that is thatthe blockchain is no longer
liable for that choice.
Think about that.
(31:04):
So if you're running ablockchain as a private entity
for a group of banks orfinancial institutions, that's
uh, you know, that's mana fromheaven, right?
It's like it's like we don'twant that liability, you know.
SPEAKER_04 (31:15):
Right.
SPEAKER_02 (31:16):
And and and so I think you know, there's a lot of
benefits to this architecturalchange that we're proposing.
And, you know, we've beentalking to so many different
types of um institutionsrelating to blockchains.
Even we've been talking to firmslike JP Morgan, DTCC, um, you
(31:36):
know, uh layer one uh publicpermissionless blockchains like
like the crypto guys, and uh andI gotta tell you, like like
Bitcoin, Ethereum, Solana, theythey're like um kind of
disorganized.
Um I mean Bitcoin is the mostdisorganized in terms of their
governance structure is isalmost like a shouting match.
(31:58):
Um and then then you haveorganized ones where um like
we're talking to Canton, andthey're they're very precise,
and and we actually found Cantonis uh very forward-looking, and
they realize this person thatthey've been working on it.
And you know, when we met them,they already had a plan.
(32:21):
Um and they said, you know,well, what do you what do you
have to offer?
We already have a team and wehave a plan.
And we showed them ourdemonstration and what we
actually do.
And you know, they said, hey,uh, that's actually very
logical, and we like that.
Um and and the you know, theysomebody mentioned, like, oh, I
(32:42):
think we could get ourcryptography team to implement
that in uh in like three or fourmonths.
And I'm like, yeah, but that'swhy we're talking to you about
it, because um you can't just dothat.
They're like, why not?
And I'm like, because we just wehappen to have like over 30
patents around the world on it.
So we want to help you work withus, and uh, I think we could
(33:04):
negotiate something where youknow uh we will meet your
criteria for for you know doinga pilot.
And uh so that that's the otherthing, uh, you know, is that
because we did this work over 10years ago, um, we have all we
have all the patents.
Yeah.
You know, it's it's like uh soyou know if you look at what
(33:27):
just happened with Anthropic andtheir source code uh you know
being released into the wild,yeah.
They're going around um withDMCA protections, which is like
very, very loose, right?
It's uh the copyrightprotections.
Uh what these guys did was theyused probably Clawed to recode
it into different languages.
(33:48):
Yeah they're fighting their owninvention, right?
And and and now now they havecopyright problems, and and and
copyright does not protectagainst different versions of
your creation, right?
Yeah, um intellectual propertyunder patents does, right?
Because you have a much morepowerful thing.
(34:09):
And so we believe that we weended up in a very superior
position, um way ahead of the uhof anybody else, not by design,
but by tackling the problem thatwe've seen for a long time and
uh doing it what we think is theright way and in a in a in a
(34:30):
permanent way.
And um and then it it reallytook the NIST people to point it
out to us, hey, you should lookat blockchain.
And we're like, yeah, how stupidare we, right?
We should we should have beenlooking at that for a while, but
we didn't.
But we're playing catch up, andI think I think like the recent
news from this week um fromGoogle and the research and you
(34:51):
know um Google changing theiryou know time horizon to 2029.
I think that surprisedeverybody.
Then they kind of um backed itup by saying, This is the recent
research that we're seeing.
Yeah, we need more people toprove it that it's true, but
there's enough there that makesus scared and and we wanna we
(35:12):
want to be more diligent.
And I think that's freaking alot of people out, especially in
blockchains, right?
They're they're like looking atit going, oh my god, you know,
Google's not somebody who justyou know randomly says things,
so uh they gotta pay attention.
Um and what what we're going outwith is don't worry, the
solution is there, it's just thewill to do it.
(35:33):
It's like, you know, I've hadproblems losing weight all my
life, right?
And I know what the solution is.
unknown (35:40):
Yeah.
SPEAKER_02 (35:41):
It's just do I have the will to do anything about
it, right?
Besides take Ego Zempic, right?
Um, but you know, I think that'sthat's where we are, is that
we're gonna see majorannouncements every few months,
uh, at least once or twice ayear from different uh areas of
research related to quantumcomputing advances.
(36:02):
And um that's just a fact ofhigh technology.
It progresses rapidly,especially if the prize for
getting there before anybodyelse is as immense as what
quantum computing is promising.
SPEAKER_03 (36:17):
Agreed.
So we've been at this for awhile.
We're coming down to the uh theend of our time.
You've done a great job ofelucidating uh your solution,
and and and we all understandthat's a problem.
Is there anything else we shouldget in before we wrap up?
SPEAKER_02 (36:32):
Uh, you know, I I think it's a fascinating thing.
I always like to um kind of givea little bit of a geopolitical
technological spin on what I seeis happening and why quantum
advances will continue at abreakneck pace.
Um we've enjoyed in the in theWest, uh we've enjoyed this
(36:57):
enormous uh control oversemiconductor technology.
And um anybody I I you know II'm kind of surprised as well,
is technology investors in in uhthemselves sometimes lose this
this kind of triad that'sformed.
At the top of that pyramid is umASML, a Dutch company, right?
(37:19):
They produce all the HEVmachines, which these are the
chip printers, right?
SPEAKER_03 (37:24):
The lithography machines, yeah.
SPEAKER_02 (37:25):
That's right.
They're the only ones thatproduce that level of machinery
for the entire world.
SPEAKER_03 (37:31):
Right.
SPEAKER_02 (37:31):
Um and they sell mainly those high-end machines
to only two companies, Intel andTSMC.
So they form the triad of nearlyall high-end processors around
the world and all our devices,right?
Um it's pretty much Westerncontrolled.
(37:51):
ASML is not going to be allowedto sell their most uh
sophisticated printers to Chinaor Russia, guaranteed,
especially not Iran, right?
And and so that is what is atrisk.
Whichever country comes up withthe ability to mass produce
(38:12):
advanced quantum computers mayactually achieve that kind of
you know dominance and kind ofmarket control over the entire
world, right?
And and that is a significantrisk, and that's why there's so
much money being thrown into byeach country that's capable of
doing that into quantumcomputing.
(38:33):
Yeah it is and and what's atstake.
And and I think that's kind oflost on people that this is what
exists, and that's what we'retrying to create.
Everyone's trying to create inthe quantum world is their own
dominance.
And it could be significant, youknow, and and um I I think it's
a huge risk, and I I think themoney being spent is probably
(38:55):
not enough.
They should put more into it.
Um because you you need you needand and but the progress is
significant, right?
It's it's uh it's people aremaking progress uh you know left
and right.
Very quick.
And and now we know the reasonwhy it's moving quick.
Uh part of the reason is thatthere's this huge thing at risk.
SPEAKER_03 (39:16):
Yeah.
So it's been a greatconversation.
Um, you know, you you you madeit easy because you had you know
answers for everything.
Uh hopefully we'll see you backon the show and thank you for
joining us.
SPEAKER_02 (39:27):
Thank you for having me.
Very nice to meet you guys.
Yep.
Thank you.
It's been a pleasure.
Okay.
SPEAKER_03 (39:32):
Thanks everybody.
We'll see you next time.
Bye.
SPEAKER_02 (39:34):
Bye.
SPEAKER_00 (39:34):
Bye.
Cybercrime is one of the biggestthreats to businesses of all
sizes and industries.
With almost half a million opencyber positions, the problem is
compounded by the lack ofavailable talent in the
marketplace.
At Pulsar Security, our eliteteam of highly credentialed
experts collaborate with you toassess your current defenses and
(39:56):
develop solutions tailored toyour specific needs.
With services ranging fromcybersecurity education to
advanced penetration testing andred teaming, you can start
reducing your risks today.
Visit PulsarSecurity.com andlet's secure your digital future
together.
Hey Tiffreen, how are you doing?
SPEAKER_01 (00:42):
Hey Patrick, I'm doing well looking forward to
another great episode ofEntangle Things.
SPEAKER_03 (00:47):
Yes, this is a timely one.
So we're joined by Yoon.
Yoon, do you mind introducingyourself to our audience?
SPEAKER_02 (00:53):
Sure.
I'm Yoon Al, and I'm the founderof uh two companies, Nuts
Technologies and BoltzTechnologies.
Um we deal with appliedcryptography and delivering
cryptography where it's needed,when it's needed.
SPEAKER_03 (01:07):
So we've talked before.
Um this is about handling, andcorrect me if I'm wrong, this is
about handling the transition ofencryption types because we
haven't had to do that indecades.
We haven't had to fundamentallychange from RSA, elliptical
curve.
Those have been around for along time.
But now, because of post-quantumcryptography, because of Q Day,
(01:31):
people have to migrate to a newencryption.
And I I think your philosophy,if I'm reading it correctly, is
why would you do that in a waythat makes it inflexible in the
future when you can do it in away that makes it flexible so
you could change every month ifyou had to?
Because we don't know whatquantum's gonna bring and what
threats, which which NISTprotocols are gonna get debunked
(01:52):
or or or hurt.
Does that sum it up a littlebit?
SPEAKER_02 (01:56):
That is correct.
That that is the gist of what wedo.
And um our approach really camefrom not even, you know, I I
don't think we were smart enoughto even um anticipate this
quantum problem.
Um when I started on thisproject back in 2013, my main
(02:16):
problem was theincompatibilities and the lack
of interoperable um things thatyou could have from just even
like products that say that umthey are AES 256 compatible.
Um when you even have uh twoproducts like that, they don't
even talk to each other out ofthe box.
(02:38):
You have to actually have aconsulting company or
integration effort that makesthose two things talk.
Because unbeknownst to you knowpeople who don't dabble in the
actual cryptography of uh youknow encrypting data, AES, the
family of AES algorithms come inalmost innumerable variants
(03:00):
based upon what parameters youpick, right?
And we we all know about thethree key sizes, like 128, you
know, 192, and 256.
But there's like five or sixother critical parameters you
have to pick.
And when you talk to twodifferent applied
cryptographers, they will havevarying opinions, very, very
(03:21):
passionate, about which onesthey feel are better and why
they don't want to use the otherone and things like that, right?
And so so it's like those arethe hidden garbage and and and
details of of cryptography, andthat's not really delved into
too much at all, and that causesa lot of problems
programmatically.
(03:42):
And um and that's the problemthat we were solving is how do
you how do you create a API anda library set and encapsulate
data in such a way that theencrypted or digital signature
stuff that you're doing arecompatible to one another
without all of these manualadjustments and and
(04:03):
configurations.
SPEAKER_03 (04:04):
So we saw very similar effort that was very
successful with XML, where datacould be moved from one place to
another and it wasself-describing.
And it's that's that's what yourtechnology is accomplished.
SPEAKER_02 (04:19):
We're doing self-describing at the message
level for the cryptography thatwas used on that message.
Now, we have you know um JWE andall of those stuff, but I think
they're still very primitive.
What we do is we allow for thesequencing and um multiple
(04:41):
operations on that same message,which you would typically do um
in a program that usescryptography.
So um, and then what the otherunique thing that we do is um in
this, we we call it atransmutation command set where
we normalized um datatransformation commands along
(05:03):
with applied cryptographiccommands.
And as far as we know, that'snever been done in one command
set, right?
And that is the essence of mostcryptographers' jobs.
SPEAKER_05 (05:16):
Yeah.
SPEAKER_02 (05:17):
Is you go into code and then you go, hey, how do I
massage the data so that I canprepare it middleware to be
encrypted or signed, you know,and stored.
Um and then and then they gottado the flip side, right?
They gotta do the write routine,which is how do I turn that into
something encryptable?
And then on the on the flipside, you gotta do, you gotta do
(05:38):
the read side, right?
You gotta say, how do I take theencrypted data, what did I use,
and um what were the parameters,and you can do it the reverse
process.
And you know how many errorshappen between developing those
read and write pairs, right?
So what we did was we said, ifwe had these simple, normalized
transmutation command set thatdescribes what you do to data in
(06:02):
order to take it from a datastructure in memory all the way
to encrypted message, um, youknow, why don't we just run the
whole thing backwards?
That way you only have to do theright part of the application,
right?
SPEAKER_05 (06:18):
Right.
SPEAKER_02 (06:18):
So you say this is the one way of creating the
message, and then when youreceive the message, you go run
it backwards.
And that that that is an areathat's called reversible
computing.
And that was developed by I IBMresearchers maybe, you know,
forty, fifty years ago, and andthey did that for the purposes
(06:40):
of there was a theory that allof computing, the heat generated
from computer chips when they'rerunning comes from changing
data.
And um they they were trying tofigure out if they could do
reversible computing, can youactually conserve the heat, you
(07:01):
know, and and reduce the heat.
And I I thought it was veryinteresting, but the one
practical thing out of I got outof that research paper was that
you know, they have this conceptof reversible computing
languages, and we took that ideaand transformed it for a very,
very specific and small usecase, which is the
(07:24):
transformation and encryption ofmessages.
And uh within that smallcontext, it's a very
well-defined problem.
It's not a uh so when you gointo reversible computing, you
got major problems if you talkabout the types of instructions
you could have in a computinglanguage, uh, and it gets very,
(07:44):
very messy.
Uh but in a in a tight set ofdata transformation and applied
uh applied cryptographicfunctions, that uh universe
shrinks drastically, and it's avery closed system, and we could
control it better.
Um and so that's the essence ofwhat we do, which is compact
language called transputation uhcommands, and the ability to
(08:08):
encapsulate that alongside themessage you just created.
SPEAKER_03 (08:14):
And that gives you encryption at rest.
Because you encapsulate the theobject.
SPEAKER_02 (08:19):
That's a great thing because you're you're bringing
up something that's critical towhat we did was we saw
incompatibilities,interoperability problems.
The the you know, one questionwas where do you put these
parameters that you chose?
Right?
And if you've ever programmed,it starts as a global variable
or some configuration setting,it goes into a you know a CFG
(08:42):
file or some text file, then itends up in being some database
or the worst case, worst case ishard-coded, right?
unknown (08:49):
Yeah.
SPEAKER_02 (08:50):
He said, shove this all into the actual
transmutation command set andput it alongside the message you
just created, that becomes themessage, right?
And what that does is that weunify data at rest and data in
transit modes of applyingcryptography to data.
(09:13):
And and so that sounds kind of aweird thing for people who don't
know the uh cybersecuritylandscape, but in cybersecurity,
when somebody says, Hey, I needthis data to be encrypted,
applied cryptography teams, thefirst question they're gonna ask
is, is that in transit or isthat at rest?
That's right, right?
Because they have two totallydifferent ways of approaching
(09:36):
it, totally different sets oftools to use.
And we said that's stupid,right?
That's like, why are you doingtwo twice the amount of work?
And then um, when you want totake data at rest and move it, a
lot of times they won't justmove it because it's not in the
right format to be moved.
You know, because if you moveit, you you're implying that the
(09:58):
recipient knows how to processthat data, and that may not be
necessarily true.
So what happens a lot of timesis the data gets decrypted by
another program, re-encryptedfor transit, and then on the
other side, another processencrypts it in the system that
they know how to uh encrypt anddecrypt um data at rest.
(10:21):
So that's a major amount ofwork.
There's a lot of uhtransformations going on, and
then what we consider is thatthe transformation points, both
at the sending part and therecipient part, they are
cybersecurity weaknesses thatyou're introducing.
Right?
So anytime you have secret dataand you have a process that
(10:45):
decrypts it or re-encrypts it tosomething else, um, you know,
you're you're just you're you'reintroducing slowness, uh,
inefficiencies, and possiblevulnerabilities uh to your
sensitive information.
So we wanted to just removethat.
So with our um we we call thistechnically we call this
structured data folding withtransmutations, and for our
(11:08):
bolts technologies effort, we'vewe've ref rebranded it as QFlex.
Apparently, my team did not likeSDFT as a popular thing.
So they they said we needsomething that rolls a little
better, and we called it QFlex.
And um, and so that's what wedid was we we did we created
this protocol.
(11:29):
It's good for both messages andtransit and data to be saved on
your long-term storage andpersistent storage.
And persistent storage, Ibelieve, is where the real
problems, the longer-termproblems, are going to be.
So if you look at dataencryption systems that deal
with massive amounts of storeddata, um there is no standards,
(11:54):
there are no compatibilities,everybody has their own systems.
SPEAKER_03 (11:57):
Well, and things change over time.
SPEAKER_02 (11:59):
Key sizes over time, um, that requires massive
amounts of downtime to upgradeand and re-encrypt stuff.
SPEAKER_03 (12:07):
And in our debt.
SPEAKER_02 (12:10):
Absolutely.
And and for us, it's like if youdo it on an object basis, which
is a file, um, it'sself-describing.
So you could just, upon somebodytouching it, it'll it'll
re-encrypt itself, right?
And then um, and then others,you could just do it
periodically with a like aspider program in the
background, right?
And then just touch things alongthe way, and it'll just do it
(12:32):
incrementally.
So it's built for the dynamicnature of uh data lifecycle,
right?
That it doesn't end with one uhstate being re-reached, that
state may continually changeupon different requirements.
SPEAKER_03 (12:46):
Right.
So there's a lot of talk about Qday, and we've covered it here
before and talked about itbefore, and post-quantum
cryptography, quantum safe.
There's lots of different wordsfor it.
And I imagine that this it'scausing a lot of agita in places
because one organizations don'teven know where they're using
different types of encryption.
They don't have they need anaudit.
(13:07):
They need uh and and we talk topeople at IBM and others.
Is i is there a consulting phaseto figure out where they're
using encryption?
How how does this get rolledout?
Is it is it a big lift?
SPEAKER_02 (13:22):
It's a huge lift because we've had the luxury of
using a handful of algorithmsfor nearly 50 years.
SPEAKER_05 (13:30):
Right.
SPEAKER_02 (13:31):
Um I I think that's a very unusual thing that's
happened because uh in theearlier times, like in the 70s,
80s, 90s, I think you will seethat cryptography changed quite
rapidly.
Right as as as microprocessorsincreased in their uh
capabilities and speed andmemory, um, we changed
(13:52):
cryptography quite often.
And um and and but that was lostas soon as we reached AES and a
certain you know chip level umand and RSA and and ECC, I think
people settled on, hey, youknow, this stuff seems pretty
good, everybody start using it,and now it's all over the place.
(14:14):
And and the world, the digitalworld, on the value that it
holds in terms of information,from the year 2000 to now, I
think we could all agree that itis exponentially greater in
terms of the amount of datathat's that's exposable and
that's been collected.
(14:34):
So the um, you know, the thedebt is huge.
The the thing to change is isjust monster.
And the changes that we may havehad to do back in year 2000 no
longer even applies now becausethere's so much work to be done.
And I think that's where theproblems are, is that we've been
so accustomed to this methodthat everybody and anybody had
(14:58):
to use some variant of it whenthey want to build secure
systems.
So it's it's ingrainedeverywhere, right?
And and um that is a nationalstandard.
The Department of Commerce'sNIST, the National Institute of
Standards and Technology, hasenjoyed um sort of this
figurehead and authorityposition around the world uh
(15:21):
because they developed theexperts and the methodologies to
evaluate and and analyzecryptography.
And they were at the top of thisfood chain of cryptography for
the last like 30, 40 years,easily.
The entire world follows thesestandards, and now it's about to
(15:42):
change in a dramatic way, yeah,right?
Because a lot of things havehappened during that time.
I mean, if you remember thecourt cases of the PGP uh, you
know, being public and not, youknow, and and and and the
government kind of losing thatcase, then you also go to the
cases of uh the Clippert chip,right?
(16:03):
And um you look at kind of uhinterference by government to
try and get ahead and get a peekat everybody's stuff.
It did not do anything to gaintrust in whatever we say as a
country and as a as an agencythat says that wink wink,
whatever we say is a standard isgood for everybody, right?
(16:26):
So it kind of like everybodystarts taking a step back.
And you'll see the evidence ofthis because China and South
Korea have each declared thatthey've set up their own
post-quantum cryptographystandards agencies, uh, which is
parallel to the NISD's PQCstandards agency, right?
(16:47):
Uh department.
And uh and then you have someEuropean countries taking a look
at that as well.
I mean, you know, what do we dowith the remember the uh the
revelations of Merkel'sconversations being recorded and
you know, whatever?
It didn't engender a lot oftrust.
So they're also thinking aboutputting in different departments
(17:10):
or taking on the responsibilityof having their own PQC
standards.
And as I mentioned, with justlike with AES, standards on uh
from PQC may be that we're usingthe same algos, but they're
picking different parametersets.
Right.
That's all that means, right?
(17:30):
And sometimes they'll change thealgo a little bit, but um you
know, these days, uhcryptographic methods are
generally free.
Um, they're generally notcreated by one or two
individuals, they're a groupeffort across the world.
Um, you'll see evidence of it ifyou take a look at who's behind
(17:52):
these first three NIST PQCstandards.
There are groups of academics,corporate experts, and
scientists behind it.
So it's no longer an individualeffort, it's generally available
to the public.
And, you know, the old saying isright now I think cryptography
is like a dime a dozen, right?
(18:13):
You will find new cryptographywhen you need it.
There's many differentapproaches.
Um but here's the here's theproblem.
Like I think you going back towhat you just said, we've
enjoyed this period of a handfulof cryptography for decades,
serious road testing, right?
Enough road testing that peoplesay, hey, you know what?
(18:36):
I think it's pretty safe, right?
SPEAKER_03 (18:38):
Um and it has been.
SPEAKER_02 (18:40):
Yes.
And all of these PQC algos, noroad testing.
These are brand new tires you'reputting on that on that car.
And uh how do you figure outwhether it's really safe?
Right?
I think that's a centralproblem.
One thing that's not reallymentioned a lot is that I think
(19:01):
in in all of cryptography,there's only been one provably
secure cipher.
And what I mean by provablysecure is management.
SPEAKER_03 (19:11):
The one-time pad, I think, is what you're talking
about.
SPEAKER_02 (19:13):
The one-time pad is the only algorithm that has a
mathematical proof that it issecure.
But for digital commerce, it'svirtually useless.
And so they don't really use it.
Um you've seen variants of it inthese uh apocalyptic war movies,
right, where they crack open thecode and and you gotta have a
(19:35):
physical thing, right?
SPEAKER_05 (19:37):
And and check the number.
Yeah.
SPEAKER_02 (19:39):
Yeah.
Um but um, you know, I I thinkthe if you look at the flip side
of that statement, that there'sonly been one time pad is the
only one that's provably secure,what it says is all the rest are
guesses.
SPEAKER_03 (19:54):
Yeah.
SPEAKER_02 (19:55):
Including stuff that we've been using.
SPEAKER_03 (19:57):
So Cyprian and I have discussed in the past if
Shore hadn't come up with hisalgorithm when he did, if
instead he came came up with itin 2032 and there were already
sufficiently powerful quantumcomputers to leverage it, it
would have been a very differentstory.
Absolutely.
And we're we're one mathbreakthrough or one realization
(20:19):
or one AI, you know, stepfunction away from, oh, we
thought this was secure and it'snot.
Right.
And so I think the flexibilitythat you're talking about is is
pretty critical.
SPEAKER_02 (20:32):
Yeah, so you know, that's where uh this comes in,
is that when we um we developedthis technology in the pursuit
of creating better encapsulatedprotection for data, and we call
we developed it in NutsTechnologies, that's a company
that we formed for it.
Uh, we used this SDFT QFlexprotocol to create very complex
(20:57):
data structures to store andprotect um unstructured data.
Um and then we saw this um NISTuh grant program, which is a
SIBR grant, SBIR.
SPEAKER_03 (21:10):
I know the SIBR program very well.
SPEAKER_02 (21:12):
Right, that's a federal thing where they uh it's
called Small Business InnovationResearch Grants.
And the NIST as an organizationcovers most of the foundational
uh scientific fields, right?
From from measurements all theway to chemicals to
cryptography.
And um they they give out about10 or 12 of these across all of
(21:34):
their science science fields.
And um we happened to put one inuh and we got selected for in
2024.
SPEAKER_05 (21:42):
Cool.
SPEAKER_02 (21:43):
We got you know, here's here's some money, you
got a six month project.
We'd like to see what youproposed.
And what we proposed was that wesaid we realized that you guys
are saying that there's a uh PQCtransition problem, right?
How do you equip Coordinate allthese transitions across all of
these systems and all thesecommercial and government
(22:04):
vendors.
SPEAKER_03 (22:05):
The heavy lift we talked about.
SPEAKER_02 (22:06):
Right.
And uh and we said, you knowwhat, if you're gonna go through
the pains of doing this once,why don't we just do it in such
a way that it never gives usthat problem again for
transition?
And we have a protocol thatallows you to change
cryptography per message if youwanted to.
(22:27):
And um therefore, theoretically,it's so granular, you can never
have this transition problemagain.
We could transition on uh everymessage.
And they selected us and and weactually were overseen by um one
of the leaders of the uh PQCselection committee.
(22:47):
Um and um I asked him, I said,Hey, you know, uh you must get a
lot of uh proposals.
Why did you pick us?
And he said, you know, it wasvery interesting because we were
kind of we didn't know if thiswas even possible to this extent
and we wanted to see it.
Now the the the difference inour proposal for SIBR phase one
(23:13):
projects is that if you'refamiliar with the SIBR program,
simp phase one program projectsuh any last anywhere from three
to six months and the endproduct is usually a research
paper or PowerPoint.
Okay, there is no work beingdone except thought process and
and and maybe some prototypesthat you do.
(23:40):
Right.
But it may or may not be uhreal.
Um what we told him in ourserver phase one proposal, we
said, we actually have thisworking, and uh what we'd like
to do for you is prove by takingyour PQC candidate algos at any
standards that you've come outwith, incorporate it into our
(24:03):
QFlex library, and show you andprove to you that we could
change cryptography per message,including all your PQC variants.
And so it's a very differenttype of phase one where we're
actually producing phase twolike work, right?
SPEAKER_05 (24:19):
Right.
SPEAKER_02 (24:20):
Uh so for them I think it was a great bargain,
right?
They're like, oh, these foolsare willing to do the work for
phase one money.
SPEAKER_03 (24:27):
And they and they don't give you a ton of money,
but they gave you some so youcould actually do something you
had to do anyways.
SPEAKER_02 (24:33):
Yeah, I mean, you know, it was a$100,000 check, so
that's great, right?
Um uh, you know, it I I don'tthink it pays for the work, but
it's it's a nice recognition.
SPEAKER_03 (24:42):
Yeah.
SPEAKER_02 (24:43):
And um it's a nice it's like a nice tax refund,
right?
But anyway.
SPEAKER_03 (24:48):
So Cyprian, you know, you you're a great
representative of somebody who'snot based in the United States.
I'm not sure of you, and but I'msure many of our audience
haven't heard of the SIPRprogram.
The SIBR program is thegovernment's attempt to, the
U.S.
government's attempt to findtechnical solutions to problems
that they've found oranticipate.
Kind of like if you know aboutum DARPA, it's kind of like a
(25:10):
low, low version of DARPA.
So if I'm in uh you know acolonel in the Army and I can
say, you know what, I got thisproblem, I need a a portable,
you know, shed that is like uhlike radio frequency blocking.
And somebody might say, hey, Igot an idea about using a
refracting paint, and I can makea shed for you, you know, in the
(25:31):
field really quickly.
And and they fund this, but thea big part of it is they want it
to be both for the militarypurpose but also commercial.
So a company like you know, nutsand bolts, they they that's
perfect for them because theywant to see that money they
spend also benefiting thecommercial market and driving
the economy.
I don't know.
Have you ever heard of that,Cyprian?
SPEAKER_01 (25:53):
Yeah, yeah.
Actually, I I I did.
But there's there's one thingthat that I I like to bring up
when we when we do thisdiscussion, so I really want to
get your perspective on it.
Like we understand very well thechallenges and the complexity,
right?
What do you see as being thelevel of perception and
(26:14):
understanding um out there, likein various organizations, in
various kind of uh structuresout there?
Because what we are seeing isthat in some cases they are
aware and they're taking steps.
In some cases, they currentlydon't care because they think,
oh, the quantum threat is notthat close.
(26:35):
So, what do you see out there interms of is there like a sense
of urgency for folks, or it'ssomething that they still think
they have enough time toaddress?
And I'm talking obviously aboutthe transition because I love
what you are talking about.
Having a solution that willprevent the problem in the
future is probably a solutionworth having, yeah, instead of
(26:59):
just going because I've seen alot of talks also,
unfortunately, about let's dolike a big bang transition from
whatever we have today tosomething else, which will
essentially just put us maybe 20years from now into the exact
same position.
SPEAKER_02 (27:14):
Right.
SPEAKER_01 (27:15):
Exactly.
SPEAKER_02 (27:15):
It's it's you know what you're saying is the
equivalent of taking NyQuil fora flu, right?
You're you're you're treatingthe symptom rather than the
cause, right?
And and and and so I thinkthere's a difference in in how
we approach the problem.
In terms of what we see outthere, it's like it's like
politics, right?
There's like there's likethere's conservative and there's
(27:37):
like you know, the other side,right?
And and the it's very few uh arein the in the area where they're
taking it very seriously, right?
Um and in that area, I thinksome are motivated by doing the
right thing, which is addressthe risk when you see it and
when you know that it istheoretically possible and it's
(28:00):
coming.
And then there's others whereit's mostly for like, you know,
they want to run a business andgrow a business in this area.
Now we're kind of doing both inthat we we happen to stumble on
this particular solution not bydesign.
We we were solving a t a verydifferent problem.
(28:21):
But towards the end of that NISTproject, um the cryptographers
overseeing the final report,they asked us, they said, hey,
you know, this uh SDFT protocol,which we call QFlex now, might
be a pretty good solution forblockchain.
Have you taken a look at that?
(28:41):
And we're we weren't reallyblockchain people, right?
And and we said, oh, that soundsvery interesting.
Well, we will take a look atthat.
We did a little, you know, quickresearch, and it's like, oh my
god, you know, a blockchaintransaction is a uh is a QFlex
message.
And we could equivalent, youknow, equate the two, and if we
(29:02):
do it the right way, we willallow an architectural change
within blockchains that they'venever seen before or even
thought it was possible, right?
So even you know, I don't knowwhat you've uh heard about
blockchains, but blockchains isum decentralized and you know
(29:22):
distributed, but they it isautocratic in a in a in a weird
way when you think about what'sthe essence of blockchain that
they're protecting, and it's theindividual users' assets, which
is just a number, right?
And um, how do they protect it?
(29:44):
That method of protection isdictated by whoever or what
group governs that blockchain.
And right now, 99% of all thevalue in blockchains is pretty
much protected by one algorithm,elliptical curve.
SPEAKER_05 (29:59):
Elliptical curve, yeah.
SPEAKER_02 (30:00):
Right?
So I'm like, my money, I want tochoose my lock, and I can't.
Right?
I I that's uh so that's kind ofabsurd, right?
It's like going back to highschool when you could lock your
locker with any lock as long asit's provided by the principal,
right?
Yeah, because he has the masterkey, right?
(30:23):
So so I'm like, I'm like, we'restill in the same like infantile
boat, and it's like we gottagrow up, give that control back
to the user or the wallet, sothey could change dynamically,
and blockchains are now foreverfuture-proof if they put QFlex
in there.
And and so that is the proposalthat we're putting out there
(30:44):
because we think it is closer tothe ethos of what blockchain was
meant to do.
And you know, if it's yourasset, you should have the
ability to choose the lock tosecure it with.
The flip side of that is thatthe blockchain is no longer
liable for that choice.
Think about that.
(31:04):
So if you're running ablockchain as a private entity
for a group of banks orfinancial institutions, that's
uh, you know, that's mana fromheaven, right?
It's like it's like we don'twant that liability, you know.
SPEAKER_04 (31:15):
Right.
SPEAKER_02 (31:16):
And and and so I think you know, there's a lot of
benefits to this architecturalchange that we're proposing.
And, you know, we've beentalking to so many different
types of um institutionsrelating to blockchains.
Even we've been talking to firmslike JP Morgan, DTCC, um, you
(31:36):
know, uh layer one uh publicpermissionless blockchains like
like the crypto guys, and uh andI gotta tell you, like like
Bitcoin, Ethereum, Solana, theythey're like um kind of
disorganized.
Um I mean Bitcoin is the mostdisorganized in terms of their
governance structure is isalmost like a shouting match.
(31:58):
Um and then then you haveorganized ones where um like
we're talking to Canton, andthey're they're very precise,
and and we actually found Cantonis uh very forward-looking, and
they realize this person thatthey've been working on it.
And you know, when we met them,they already had a plan.
(32:21):
Um and they said, you know,well, what do you what do you
have to offer?
We already have a team and wehave a plan.
And we showed them ourdemonstration and what we
actually do.
And you know, they said, hey,uh, that's actually very
logical, and we like that.
Um and and the you know, theysomebody mentioned, like, oh, I
(32:42):
think we could get ourcryptography team to implement
that in uh in like three or fourmonths.
And I'm like, yeah, but that'swhy we're talking to you about
it, because um you can't just dothat.
They're like, why not?
And I'm like, because we just wehappen to have like over 30
patents around the world on it.
So we want to help you work withus, and uh, I think we could
(33:04):
negotiate something where youknow uh we will meet your
criteria for for you know doinga pilot.
And uh so that that's the otherthing, uh, you know, is that
because we did this work over 10years ago, um, we have all we
have all the patents.
Yeah.
You know, it's it's like uh soyou know if you look at what
(33:27):
just happened with Anthropic andtheir source code uh you know
being released into the wild,yeah.
They're going around um withDMCA protections, which is like
very, very loose, right?
It's uh the copyrightprotections.
Uh what these guys did was theyused probably Clawed to recode
it into different languages.
(33:48):
Yeah they're fighting their owninvention, right?
And and and now now they havecopyright problems, and and and
copyright does not protectagainst different versions of
your creation, right?
Yeah, um intellectual propertyunder patents does, right?
Because you have a much morepowerful thing.
(34:09):
And so we believe that we weended up in a very superior
position, um way ahead of the uhof anybody else, not by design,
but by tackling the problem thatwe've seen for a long time and
uh doing it what we think is theright way and in a in a in a
(34:30):
permanent way.
And um and then it it reallytook the NIST people to point it
out to us, hey, you should lookat blockchain.
And we're like, yeah, how stupidare we, right?
We should we should have beenlooking at that for a while, but
we didn't.
But we're playing catch up, andI think I think like the recent
news from this week um fromGoogle and the research and you
(34:51):
know um Google changing theiryou know time horizon to 2029.
I think that surprisedeverybody.
Then they kind of um backed itup by saying, This is the recent
research that we're seeing.
Yeah, we need more people toprove it that it's true, but
there's enough there that makesus scared and and we wanna we
(35:12):
want to be more diligent.
And I think that's freaking alot of people out, especially in
blockchains, right?
They're they're like looking atit going, oh my god, you know,
Google's not somebody who justyou know randomly says things,
so uh they gotta pay attention.
Um and what what we're going outwith is don't worry, the
solution is there, it's just thewill to do it.
(35:33):
It's like, you know, I've hadproblems losing weight all my
life, right?
And I know what the solution is.
unknown (35:40):
Yeah.
SPEAKER_02 (35:41):
It's just do I have the will to do anything about
it, right?
Besides take Ego Zempic, right?
Um, but you know, I think that'sthat's where we are, is that
we're gonna see majorannouncements every few months,
uh, at least once or twice ayear from different uh areas of
research related to quantumcomputing advances.
(36:02):
And um that's just a fact ofhigh technology.
It progresses rapidly,especially if the prize for
getting there before anybodyelse is as immense as what
quantum computing is promising.
SPEAKER_03 (36:17):
Agreed.
So we've been at this for awhile.
We're coming down to the uh theend of our time.
You've done a great job ofelucidating uh your solution,
and and and we all understandthat's a problem.
Is there anything else we shouldget in before we wrap up?
SPEAKER_02 (36:32):
Uh, you know, I I think it's a fascinating thing.
I always like to um kind of givea little bit of a geopolitical
technological spin on what I seeis happening and why quantum
advances will continue at abreakneck pace.
Um we've enjoyed in the in theWest, uh we've enjoyed this
(36:57):
enormous uh control oversemiconductor technology.
And um anybody I I you know II'm kind of surprised as well,
is technology investors in in uhthemselves sometimes lose this
this kind of triad that'sformed.
At the top of that pyramid is umASML, a Dutch company, right?
(37:19):
They produce all the HEVmachines, which these are the
chip printers, right?
SPEAKER_03 (37:24):
The lithography machines, yeah.
SPEAKER_02 (37:25):
That's right.
They're the only ones thatproduce that level of machinery
for the entire world.
SPEAKER_03 (37:31):
Right.
SPEAKER_02 (37:31):
Um and they sell mainly those high-end machines
to only two companies, Intel andTSMC.
So they form the triad of nearlyall high-end processors around
the world and all our devices,right?
Um it's pretty much Westerncontrolled.
(37:51):
ASML is not going to be allowedto sell their most uh
sophisticated printers to Chinaor Russia, guaranteed,
especially not Iran, right?
And and so that is what is atrisk.
Whichever country comes up withthe ability to mass produce
(38:12):
advanced quantum computers mayactually achieve that kind of
you know dominance and kind ofmarket control over the entire
world, right?
And and that is a significantrisk, and that's why there's so
much money being thrown into byeach country that's capable of
doing that into quantumcomputing.
(38:33):
Yeah it is and and what's atstake.
And and I think that's kind oflost on people that this is what
exists, and that's what we'retrying to create.
Everyone's trying to create inthe quantum world is their own
dominance.
And it could be significant, youknow, and and um I I think it's
a huge risk, and I I think themoney being spent is probably
(38:55):
not enough.
They should put more into it.
Um because you you need you needand and but the progress is
significant, right?
It's it's uh it's people aremaking progress uh you know left
and right.
Very quick.
And and now we know the reasonwhy it's moving quick.
Uh part of the reason is thatthere's this huge thing at risk.
SPEAKER_03 (39:16):
Yeah.
So it's been a greatconversation.
Um, you know, you you you madeit easy because you had you know
answers for everything.
Uh hopefully we'll see you backon the show and thank you for
joining us.
SPEAKER_02 (39:27):
Thank you for having me.
Very nice to meet you guys.
Yep.
Thank you.
It's been a pleasure.
Okay.
SPEAKER_03 (39:32):
Thanks everybody.
We'll see you next time.
Bye.
SPEAKER_02 (39:34):
Bye.
SPEAKER_00 (39:34):
Bye.
Cybercrime is one of the biggestthreats to businesses of all
sizes and industries.
With almost half a million opencyber positions, the problem is
compounded by the lack ofavailable talent in the
marketplace.
At Pulsar Security, our eliteteam of highly credentialed
experts collaborate with you toassess your current defenses and
(39:56):
develop solutions tailored toyour specific needs.
With services ranging fromcybersecurity education to
advanced penetration testing andred teaming, you can start
reducing your risks today.
Visit PulsarSecurity.com andlet's secure your digital future
together.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
Betrayal Weekly
Betrayal Weekly is back for a new season. Every Thursday, Betrayal Weekly shares first-hand accounts of broken trust, shocking deceptions, and the trail of destruction they leave behind. Hosted by Andrea Gunning, this weekly ongoing series digs into real-life stories of betrayal and the aftermath. From stories of double lives to dark discoveries, these are cautionary tales and accounts of resilience against all odds. From the producers of the critically acclaimed Betrayal series, Betrayal Weekly drops new episodes every Thursday. If you would like to share your story, you can reach out to the Betrayal Team by emailing them at betrayalpod@gmail.com and follow us on Instagram at @betrayalpod and @glasspodcasts. Please join our Substack for additional exclusive content, curated book recommendations, and community discussions. Sign up FREE by clicking this link Beyond Betrayal Substack. Join our community dedicated to truth, resilience, and healing. Your voice matters! Be a part of our Betrayal journey on Substack.