My name is Cindy Cohn. I'm the executive director of the Electronic Frontier Foundation. EFF is the oldest and the largest nonprofit organization focusing on protecting people's digital rights. I'm a lawyer by training. I'm not a technical person, but I have been involved in first freeing up encryption from US government control in the 1990s, and then defending it against ongoing attacks over time from law enforcement, from the national security infrastructures both in the US and abroad. EFF is, I think, the chief champion of making sure people have access to strong encryption so that they can have strong privacy and security.
Nice. Thank you. Well, we really need your view on the legal ramifications of this new age of post-quantum cryptography, but actually also the potential of what we have so far. And I know this is a tricky, difficult question, but I just want to hear your general opinion. I guess you heard about quantum and what it can mean for the current cryptographic system. Just to know what you're thinking about it.
Well, I mean, cryptography has always been a kind of cat-and-mouse game, right? People write the strongest cryptography they can, other people help them break it. Then when we learn from the breaks, then we go for it. The introduction of quantum computers means we're going to have a very important version of this where quantum computers have a risk of being able to break all of the encryption that we've all relied on. You know, I think of this as not different in kind than the cat-and-mouse game, but a very much more intense version of one. And so that's kind of my start, and it's really important that we continue both sides of this, that we continue to try to build the best cryptography we can and also that we protect the people who are figuring out how to break it because that's the only way it gets better. The bad guys never stop trying to break encryption just because the good guys stop protecting them. A lot of what EFF does is trying to make sure that we are defending this process. We're defending people's ability to attack and break cryptography because that's the only way cryptography gets better. So when I'm thinking of quantum, I'm also thinking about that. I'm not just thinking about, oh my gosh, what about all this stuff that might be vulnerable? I'm thinking how do we make sure that we continue to let people attack even post-quantum cryptography so that we can continue to get better at it because we never want to be in a position where like the emperor has no clothes, right? Where the public officials tell us everything's really secure but we know it's breakable.
We had a situation like that in the 1990s with a secure encryption standard that was called DES, right? This was an early encryption standard that the US government embraced that by the late 1990s, everybody who thought about encryption knew was really weak and breakable, but nobody would admit it. And so, EFF built something. It was called a DES cracker. That demonstrated with very little capability, one could break DES. And this was part of how we pushed the government to advance its standards and really accept the next generation secure encryption which was called AES. So, Advanced Encryption Standard. So, I digress a little bit, but I think one of the things that people think about when they're thinking about post-quantum cryptography is how do we defend? And I think that one of the things we also have to protect is how do we attack so that we can make things better. How do we protect the whole ecosystem by which things stay secure? So, that's a very long-winded answer of saying I think post-quantum cryptography is coming. Quantum computers are coming. It's still a ways away and I think different people differ about how close that is. I'm very happy to see that NIST has already announced post-quantum cryptography protections and that people are starting to put it into things because I think that's one way we can start to get ahead of the curve on this. But we also have to make sure that we are making sure quantum computers get in the hands of the people who can attack our future cryptography and help make it better because that's going to happen. You know, that's going to happen. Those attacks are going to happen and we're not going to win by pretending like only good guys will ever have quantum technology.
Let's suppose, let's have this kind of sci-fi scenario or hypothesis that tomorrow the public key cryptography gets broken. And someone comes to you and says, 'Well, we did it, and how would you protect that as a lawyer?' I made that question because maybe you already had that situation in the past where you have to defend an attacker because you're saying the good guys should be able to attack and break cryptography, right? And then as a lawyer, how would you defend that person?
Well, I think there's a lot of it depends there. So let me just project one scenario out. You know, we do a lot of work what we call coders' rights work where we try to really protect people's ability to again say the emperor has no clothes, to point out that there is a break that's possible, you know, in a context in which the public announcement of something could be very, very dangerous for people who are unrelated, you know, to the people who build the crypto. So you think about the people whose data is stored. We would probably work with the person to do some kind of responsible disclosure, right, to authorities, to the people who need to update their cryptography in order to do it. And that's why I'm very happy that NIST is already ahead of this because we have options to give people for how to make their cryptography post-quantum resistant. And that's one thing that people should really be doing. But we would work with them to identify, you know, where are the places where people need to know before it gets publicly released. Try to make sure that that can happen. But we would not say that they need to hide it, right? Because, you know, one of the things that's true under the sun is it's very rare that only one person discovers something. So many people are working towards this that you have to imagine that the person who comes to you isn't the only person who knows it. And so, how do you get this out into the world in a way that's responsible, but that also doesn't pretend like other people aren't going to get this information soon. So we've worked with people to, you know, sometimes that means if you've just broken an encryption scheme for one particular system, tell the people who own that system so that they can patch it before it actually impacts all of their customers.
Sometimes we do that and the first thing they do is try to sue or get the person who has told them the bad news arrested. We've had to defend people against getting arrested for revealing that security is weak in tools. So, you know, we would have to be prepared for that as a possibility and to make sure that we can explain to the courts or to other people later why this scientific advancement is really important and that we shouldn't just squelch it. So those are the kinds of things we would think about. We would think about is notification necessary before this goes public? Is it not? Sometimes it's not. Making sure that we can clear the path towards making sure that the public can know the truth about their security. And also then being ready for any blowback because sometimes companies will, you know, just try to squelch the person who gives them bad news. What happens if a bad guy actually discovered that is not a good guy or a good group of people or EFF defending them?
It's a cat-and-mouse game. You know, people are going to be at risk if somebody does come up with the, you know, Dr. Evil version of a quantum attack and comes after the good guys. We have to make sure there are systems to try to help protect people as best we can and we have to have systems of liability and support to help people get to the next level. That's what we are going to have to do. It's unfortunate. But again, I don't think security was always that, you know. Encryption gave a lot of people the sense that there was a magic answer and that things could be secure forever and that we didn't have to worry about it. And we have, you know, great things that have happened as a result of this, right? I mean, Edward Snowden was able to use strong encryption to get the information that he leaked out to journalists out because strong encryption works. But it was always temporary. And I think that that is just something we have to come to terms with. And quantum to me, again, it's a significant change because of the power that's there. We thought we had, you know, security that would last a very long time. Quantum because it's such a new paradigm means that that may be shorter than we thought. But it's not different in kind. It's not fundamentally different.
Yeah, that's why in fact we have this temporary title for the documentary. We call it post-encryption or post-quantum encryption because we don't know if encryption will be safe after quantum.
I think it will be. I have to say my sense is that the people who are, I mean maybe I'm a little too optimistic, but you know, security people, they're really good and they evolve and I do think it's always a cat-and-mouse game. Whenever the risk to cryptography comes, smart people on the other side figure out how to already do it. And the fact that post-quantum cryptography already exists even though we don't have quantum computers, I think is a really good sign that the people who want to protect our data are not in a losing game against the people who want to attack. They're just going to lose a battle and then they're going to win the next battle. They're going to lose a battle. This is going to happen. It doesn't mean that everything is always secure. But it does mean that the game isn't over.
Let's say that encryption is broken. Current public key encryption is broken. And that was broken by the NSA or by the Chinese government or by, I don't know, Google or Microsoft or a big company and they keep this secret or they want to use it for a while. What do you think would be the consequence? And you probably know very well.
I mean, the ultimate zero day, right? Like I think that it's very, very dangerous and this is something that EFF has been pushing on governments around the world from the beginning, that putting everybody's security at risk so you can keep a secret attack is very, very dangerous for everybody else. Why? Because you're not the only smart person in the world. It's just not the case that as smart as the people at the NSA are, this idea that they would be the only ones who could ever break it and the bad guys would never break it, the people who are there would never break it, it's naive. It's ridiculous and it puts all the rest of us at risk because of their hubris. So EFF has always taken the position that government hoarding zero days rather than telling the companies so that they can patch their systems and make the rest of us safe is dangerous and wrong. And while there might be a few narrow areas where one might do it, doing that for a quantum attack is just tremendously dangerous for everyone. The NSA can't keep its own secrets. We've had how many leaks have we had of the NSA's internal data? Like even if they're the only ones who find it, they haven't proven themselves to be all that great at keeping those secrets. The Chinese have penetrated the NSA systems. They penetrated lots of systems. So the right answer to all of this is as much transparency as we can do. That doesn't mean you don't give people a heads up and a chance to patch their systems, but that has to be a temporary thing towards a world in which we're empowered and we know where the risks are rather than us staying in the dark. So, you know, I think there is a real, a reasonable fear. I took a little heart that the NSA demanded that the NIST protections against post-quantum cryptography attacks were mandated to their own systems, which, you know, reading tea leaves gives me hope that they don't have a post-quantum computer that can break everything. But it doesn't necessarily follow. We don't know. We don't know what their capabilities are. But I think it's a really bad idea for them to adopt a posture where they think they're the only people smart enough to do this and therefore trying to keep the rest of us in the dark. That will not work.
Everyone kind of agrees because that's really the truth that current public key cryptography is based on a very simple math equation, which is the factorization of primes. And that, you know, from the '90s we start to build on that quite a lot. In fact, all our infrastructure pretty much relies on that simple equation. And some mathematicians say, well, that is still an assumption. It's there just because no one discovered it yet. Some others say, no, that's, you know, that's math, there is no way around it. So I don't know if you have an opinion about that particularly, but the general question is more, do you think maybe we went too far or what kind of scenario we would find ourselves in if that simple equation is proven to be wrong?
I'll add a little bit to it that I think will put it actually squarely where your mind is regularly. Whatever the assumption is, in this case it's that computational complexity as we know it is just, we can't prove it because it would take a billion years to say, yep, it took a billion years, but assumptions regularly become thought of as immutable because no one has actually gone back and reviewed and it has held. Is it actually that it held or that no one bet? So assumptions getting questioned is a process problem.
