Quantum Computers Are Coming for Our Privacy
Blockspäti, Berlin Blockchain Week, June 2026

Automatic transcript with corrections to names and technical terms. May contain transcription errors.
Timestamps refer to the video on this page.

[00:00:00] Meet yourself and tell us what you're going to talk about.
[00:00:04] Yeah, I'm Rick Carback.
[00:00:06] I work with Quantum Computers now.
[00:00:09] In Zcash land, I'm best known as a mixnet guy.
[00:00:14] My fondest memory, well, fondest and sort of most regrettable memory with Zcash is
[00:00:20] I came to a conference much like this.
[00:00:23] And about an hour before I was supposed to talk, they had announced.
[00:00:28] I forget who it was, but we wanted the Tornado Cash or Samourai Wallet guys, got
[00:00:32] arrested.
[00:00:34] And I was going to announce how I was planning to launch my mixnet for like five
[00:00:39] cents a transaction.
[00:00:42] We could put Shield and Zcash transactions through the mixnet.
[00:00:45] And I was told in sort of no uncertain terms by an unlisted number, if you make
[00:00:50] money on crypto right now, the government will come after you.
[00:00:54] You are a U.S. citizen, you're okay.
[00:00:56] And I was like, shit, okay, not going to announce that.
[00:00:59] So that's my fun Zcash story for you.
[00:01:03] I know one of the previous speakers said, you know, sometimes it feels like the
[00:01:06] deck is stacked against you.
[00:01:08] And then especially the private space, that is true.
[00:01:11] There is government activity and they're trying to suppress it sometimes.
[00:01:16] Sometimes they're not.
[00:01:17] I don't know.
[00:01:18] You know, I think today, these days, if you're sort of a large project and you're
[00:01:21] doing a lot of different things, you know, we're going to hear from Nym after my
[00:01:26] speech, I believe.
[00:01:28] And they're doing exactly what I was proposing all those years ago.
[00:01:33] But these days, and academically, I'm sorry, I didn't finish my intro, I did a lot
[00:01:39] of civic tech.
[00:01:40] So my PhD thesis is in privacy enhancing electronic voting systems.
[00:01:47] So you get a receipt when you vote, but it doesn't prove how you vote, which
[00:01:51] obviously is a mixnet based platform.
[00:01:53] So that's a little bit about me.
[00:01:55] These days, I work in quantum computers.
[00:01:58] We are largely building a platform to sell quantum compute.
[00:02:02] We're building the world's shared quantum computer because you can take qubits, and
[00:02:06] we've heard of this term called entanglement.
[00:02:08] You can entangle qubits across the pistons.
[00:02:10] And what that means is we take different quantum computer installations and entangle
[00:02:15] the qubits across fiber optic cable.
[00:02:18] So our ultimate goal, our vision, is to be that.
[00:02:23] So for those of you who are Zcash people and you're worried about privacy, the too
[00:02:27] long, didn't watch, didn't pay attention to this presentation,
[00:02:31] is switch to Orchard and hope that NU7 comes quicker than it's been coming.
[00:02:38] And be ready to upgrade anytime there's an upgrade so that you are on NU7 as fast
[00:02:42] as possible.
[00:02:43] And hope that they actually fix things in NU8 or NU9 of the protocol.
[00:02:49] Because Zcash has problems, and I'll be telling you to wake up.
[00:02:53] So the problem here is quantum computers can break ECC crypto.
[00:03:03] ECC crypto is what essentially all modern privacy technology is built on with a few
[00:03:08] exceptions.
[00:03:09] So hash-based ZK-STARKs are one of the exceptions.
[00:03:13] There's very few of them.
[00:03:15] The trade-off tends to be when you're using these hash-based methods, key sizes are
[00:03:20] massive, the resources required are significant.
[00:03:23] So that's sort of the problem we're dealing with here.
[00:03:27] The other problem is everyone thinks that it's like 5, 10, well, the current
[00:03:32] thinking is 5 years away.
[00:03:35] The thinking up until about 2024 was that it was always 20 years away.
[00:03:41] And the last 3 years, it went from 10 years to 5 years.
[00:03:45] And my personal opinion, that's my website, thequantumdoomclock.com, is if you look
[00:03:49] at the exponential growth, if you look at the error correction rate improvements
[00:03:53] over the last couple of years,
[00:03:54] you're seeing two years, you're seeing two things exponentially growing in opposite
[00:03:59] directions, and you're going to enter this gray space in 2028, specifically March
[00:04:03] 2028, according to the raw data I have,
[00:04:06] where it's not going to be clear that a quantum computer is in that state where it
[00:04:09] can break crypto or not.
[00:04:11] And then after that point, you just kind of have to throw your hands up in the air
[00:04:14] and say, maybe what I'm doing is broken, but maybe it's fine.
[00:04:18] And hopefully a few years later, we'll find out one way or the other.
[00:04:21] A great example of this kind of thing that happened most recently, about two months
[00:04:24] ago, Google released a paper.
[00:04:26] They said, oh, we've published the required number of logical qubits.
[00:04:31] So there's this concept of a logical versus a physical qubit.
[00:04:35] You used to need, like, several hundred thousand physical qubits.
[00:04:38] That was 2024's number.
[00:04:40] 2026's number is 30.
[00:04:42] So that's a big improvement.
[00:04:45] And that's from Alice and Bob.
[00:04:46] They say they're going to release a computer by the end of the year, but they're
[00:04:49] going to be able to implement a logical qubit in 30 physical qubits.
[00:04:53] So the logical qubit count required went from about 1,800 to break ECC all the way
[00:04:58] down to about 1,400 in their numbers, 13 to 1,400 in their numbers.
[00:05:04] And now it's 40% lower two months later.
[00:05:07] And they published all this under a zero-knowledge proof, but people figured out
[00:05:11] how to, like, essentially get around that because there's enough public information
[00:05:15] that just derived the right process.
[00:05:18] So we're already 44% data from Google's numbers two months ago.
[00:05:22] So this is kind of, like, the exponential problem.
[00:05:25] And then the person who has been the most vocal and the person all the news
[00:05:28] articles cite saying, oh, quantum computers are always 20 years away from crypto.
[00:05:33] He just published that three months ago saying, don't say I didn't warn you.
[00:05:38] Look, I don't know what's going to happen the next couple of years.
[00:05:40] So with that, you know, this is just illustrating the point.
[00:05:45] Like, yeah, it looks really flat until you see you get a little bit more
[00:05:49] progressive and everything builds on it.
[00:05:52] We're finance people here mostly.
[00:05:54] I hope we would understand, like, compound interest.
[00:05:57] But, like, this is, like, compound interest on steroids.
[00:05:59] It's literally a doubling or a tripling in the span of the year.
[00:06:04] So, and we don't have very far to go.
[00:06:07] These are numbers from 2025 when it was, like, about a billion physical qubits that
[00:06:11] you needed.
[00:06:12] Now it's, like, a little closer to, like, $600.
[00:06:17] So those lines are going lower and the number of qubits is going up.
[00:06:22] Since this is a technical audience, I actually get to teach you, like, why and how
[00:06:26] quantum computers work.
[00:06:28] So what this slide is showing you is essentially, like, an adder array gate on a
[00:06:33] quantum computer.
[00:06:35] And we are doing this thing where we are looking at these three-minute inputs and
[00:06:40] we're determining whether they're constant or balanced using those definitions on
[00:06:44] the screen.
[00:06:44] I'll let you read that.
[00:06:46] And when you run the quantum computer, you run this Atomar transform gate on all
[00:06:50] things.
[00:06:51] You run the function.
[00:06:53] You run the Atomar transfer gate again.
[00:06:55] And you do this, like, little twist on them.
[00:06:58] And then you read it and you get the answer.
[00:07:00] So how many times does that algorithm run?
[00:07:03] So the circuit lights up, runs through it once.
[00:07:07] Now, when we make the problem bigger, like, let's say we're going to do four bits
[00:07:12] as opposed to three bits.
[00:07:14] Yeah, I need another qubit, right?
[00:07:17] But it's a constant time algorithm, whereas this is going to explode exponentially,
[00:07:22] right?
[00:07:23] So it's a massive amount of additional work that you would have to do on a
[00:07:26] classical computer.
[00:07:28] And what you're doing, like, the mental model you should have with quantum is, like,
[00:07:33] a 2D grid and, like, a line, right?
[00:07:36] And a classical computer has to go a little bit in the X direction, a little bit in
[00:07:39] the Y direction to get to the end state value.
[00:07:42] And the quantum computer just goes right there in one step.
[00:07:44] And that's not true, like, generally speaking, for all algorithms.
[00:07:48] But there do exist this class of algorithms of which the discrete log problem was
[00:07:52] one of them that caused this problem.
[00:07:56] The great thing about it is that this is going to change the world, right?
[00:08:00] So there's applications in finance, there's applications in logistics.
[00:08:04] If you were here two days ago at the hackathon, we showed you finance optimization
[00:08:08] where we did, we figured out what crypto was optimal to use to buy your bit refill
[00:08:12] cards.
[00:08:14] We used the actual quantum computer that we have access to.
[00:08:18] So it can run these problems right now.
[00:08:21] I mean, obviously, you can run either a simulation or the exact same computation
[00:08:25] classically right now, and it's about the same.
[00:08:28] But once you get past about 50 qubits, it becomes impossible to do the simulation.
[00:08:33] And then you, on the classical side, to keep up, you have to start doing, you know,
[00:08:38] estimations of the algorithm for it to work.
[00:08:44] In privacy, we have a bigger problem, which is harvest now, detriple later.
[00:08:50] Ten years ago, I said, oh, well, we'll do some things where we'll do some hash-based
[00:08:55] signatures, and then the signatures will be secure.
[00:09:00] And for key agreement, we'll add some things in there to sort of prevent it from
[00:09:05] being breakable after the fact.
[00:09:09] And I, you know, proposed some things, wrote some things, published some code, and
[00:09:14] said, well, it's probably 30, 40 years away still.
[00:09:17] I'll be dead, most likely, or I'll be retired.
[00:09:20] It's not going to matter to me.
[00:09:21] And, in fact, in grad school, I literally had a professor say, we're going to talk
[00:09:26] about quantum computers today and why they're relevant to crypto.
[00:09:30] It's like one lecture.
[00:09:31] And he said, don't worry about it.
[00:09:32] It's probably not you.
[00:09:33] It's going to be your students or their students that are going to be worried about
[00:09:36] this.
[00:09:37] So I never really thought I would be here in this moment.
[00:09:41] So the hardest now to encrypt later problem is we can take encrypted data today,
[00:09:46] like the Zcash transaction, the Shielded Zcash transaction that we did earlier at
[00:09:51] the beginning of the talks.
[00:09:54] And we can look at that encrypted data and we can uncover what was happening there
[00:10:00] after the fact, which all crypto kind of has that vulnerability.
[00:10:05] But typically we say, oh, it's going to be 30, 50, 100 years.
[00:10:08] That's like a cryptographer gets uncomfortable when you say it's going to be computable
[00:10:13] in 30 years.
[00:10:14] They're generally comfortable once you say it's decryptable in like 50 to 100 years.
[00:10:18] So it's like that tends to be what most crypto is rated for and it's like 30 to 100
[00:10:23] years.
[00:10:25] But we're going to be in this period, probably in the next five to 10 years where
[00:10:28] everything the previous five to 10 years was is going to be decryptable.
[00:10:35] And that's a big problem for privacy crypto, because basically all of it, with a
[00:10:39] couple of exceptions, is vulnerable in one way or another.
[00:10:43] Proof systems, that's CK proofs.
[00:10:46] The stars are not vulnerable because they're hash based.
[00:10:48] Message anonymizers, anonymous authentication systems, confidential ledgers, that
[00:10:54] would be Zcash, Monero.
[00:10:57] We're going to talk, deep Zcash is special, so we're going to talk a little bit
[00:10:59] about that in the next couple of slides.
[00:11:01] Multiparty computation, threshold encryption is vulnerable.
[00:11:05] And then encrypted aggregators, so like groups, signature type things, they're
[00:11:09] generally vulnerable.
[00:11:11] And there are essentially not a lot of solutions available right now.
[00:11:16] There are solutions available for the signatures, and there are solutions available
[00:11:22] for, you know, key agreement right now.
[00:11:25] That's what NIST has approved, but they rely on algebraic constructions that just
[00:11:32] haven't been figured out or just aren't workable in the current ecosystem yet.
[00:11:38] So let's think about Zcash specifically.
[00:11:41] So these three boxes, transparent transactions, if you use it, your funds are
[00:11:47] stolen in the context of a quantum computer.
[00:11:51] If you're using Sprout or Sapling, you're, in some cases, your funds are taken, in
[00:11:56] some cases, we're able to, like, counterfeit funds in the shielding pool.
[00:12:02] There is a protection in Zcash where you can't take out more funds than went into
[00:12:06] the shielding pool, but that's just, like, you're the bag holder.
[00:12:10] Like, that's not a real protection.
[00:12:12] So be aware of that.
[00:12:14] On Orchard, the proof system is broken, but the privacy, if you never publish the
[00:12:21] spending key, which when you put the QR code, spending the money, you publish the
[00:12:26] spending key, is protected if you never publish.
[00:12:29] So now, your public keys are, essentially, you have to treat them like secrets.
[00:12:33] So if you treat your public keys like secrets and you're using Orchard, you're,
[00:12:36] generally speaking, going to be okay on the privacy side, but the proof system is
[00:12:40] going to fail when a quantum computer comes over.
[00:12:45] And U7 fixes that.
[00:12:48] There's two main things.
[00:12:50] Tachyon is the one that fixes the privacy.
[00:12:52] They just remove the note effectively.
[00:12:55] I mean, I'm oversimplifying it, but they remove the note that would make it
[00:12:58] possible to do the dicker.
[00:12:59] To break the key that would enable you to de-anonymize the transaction.
[00:13:03] And then on the left side, there's the Zip 2005, which will recover the funds, and
[00:13:08] contract your funds.
[00:13:10] But there's still this proof soundness problem that is opening the air.
[00:13:15] And hopefully, I think that there's time to fix it.
[00:13:18] I think, you know, we do, even on my most aggressive timeline, March 2028, that's
[00:13:22] still two years, about two years away.
[00:13:25] I do think we're going to be, generally speaking, okay.
[00:13:29] So, just, this is the takeaway of the talk.
[00:13:33] Orchard preserves privacy, but a quantum computer can still break that proof system.
[00:13:38] And that's what we need to be worried about.
[00:13:41] What do we do about it?
[00:13:43] I'll just say that privacy techniques go back a long way prior to crypto.
[00:13:48] There's a famous, you know, principle from a guy named Kirchhoff from 1883, and Claude
[00:13:55] Shannon.
[00:13:56] Do you guys know Shannon entropy?
[00:13:59] Or, like, the imitation game?
[00:14:03] Like, or the movie?
[00:14:05] Like, just the guy that sort of invented a lot of, like, the base principles of
[00:14:10] cryptography.
[00:14:12] And a lot of mathematics, as well, he coined the phrase, the enemy knows the system.
[00:14:17] So, you have to operate as if the enemy knows the system.
[00:14:20] And we know that very well.
[00:14:21] And this is sort of the general advice.
[00:14:24] I already told you the first one.
[00:14:25] Public keys are our secrets now, so treat them as such.
[00:14:29] You know, compartmentalization.
[00:14:31] We had a great example of that, where you have to share your viewing key on one of
[00:14:34] the tools.
[00:14:36] And so, the general advice is, use this for your public storefront.
[00:14:39] Use a separate wallet for everything else.
[00:14:42] I think that's really good advice.
[00:14:44] Suit it in.
[00:14:44] So, build a wallet.
[00:14:46] Use it for a transaction.
[00:14:47] Throw it away.
[00:14:48] Don't keep things around too long.
[00:14:50] Again, upgrade, upgrade, upgrade, especially when new crypto comes out.
[00:14:54] I know that there's kind of a double-edged sword in that the new crypto is
[00:14:57] generally not, is less trustworthy.
[00:14:59] This is one of those cases where I would just upgrade immediately, because,
[00:15:04] especially after 2028,
[00:15:06] I just don't know what's going to happen.
[00:15:07] We can walk computers and minimize the expires.
[00:15:10] It's just kind of a summary of everything I just talked about.
[00:15:14] There are cryptographers.
[00:15:15] They are working on solutions in general.
[00:15:18] The resources required are significantly more.
[00:15:23] And the confidential ledgers is the biggest one that I'm worried about.
[00:15:27] But, you know, I think that it is possible to solve these problems.
[00:15:31] I just don't know how it's going to play out.
[00:15:33] So, I'm not worried.
[00:15:34] On the long tail of crypto, in general, I'm an optimist.
[00:15:37] But I will tell you, in 2024, when I realized, like, the trend that we were seeing,
[00:15:42] I went
[00:15:43] through a very deep, dark period of about three months where I just disappeared.
[00:15:47] And I was like, man, everything I've been working on my whole career is, like,
[00:15:50] bullshit now.
[00:15:51] And it took a while to get over that.
[00:15:53] And I realized, well, these things are really cool.
[00:15:56] They do a lot of neat stuff.
[00:15:57] And they're going to have commercial applicability probably in the next year or so.
[00:16:01] I think that's really cool.
[00:16:03] With that, questions, I'm on Signal.
[00:16:09] You can find me.
[00:16:10] And I think I brought my business card.
[00:16:12] I'll hand this out, too, if anyone's interested.
[00:16:13] Thank you so much.