Transcription
Today we have our speaker Duncan Bule. Uh, he got his degree, a PhD in mathematics, in 1976 from the University of Illinois at Chicago. And, uh, he's worked with the government, and he's been an associate professor and, uh, and department chair of computer science at the University of South Carolina. And now he's retired and living in Ohio. So, uh, his interests are, uh, voting registration and elections, and cryptography. And, uh, so I'll turn it over to Duncan Buell. Uh, his talk is, uh, then up until 1970, now, and in the future. >> Duncan, go ahead. >> Thanks. Thanks. Um, so there we go. Whoops. Ah, now I find the forward button.
So, Flash had asked me to talk about, uh, public key cryptography. Uh, and I will, uh, I will try to present this in a way that, uh, certainly people who, who know the existence of, of the math, could understand. Uh, although the math is going to be very, very different from what one does, uh, when using math for something like physics. Uh, and this is actually a, a big deal for the computation, and I'll talk about that as well. Uh, up until the early 1970s, uh, cryptography was symmetric. Uh, so that to encrypt a message, to turn a message into something that looked like random characters, uh, required a key, and then turning the random characters back into the message required essentially the same key. Uh, and that was symmetric. And under symmetric, uh, systems, managing the keys is a huge issue because you can't let them out.
Uh, now, as an example, uh, uh, so the, the simplest example of this is, is the Caesar cipher. You index the letters A, B, C, D, E, F, etc. Uh, and you write the message out, and then you shift each letter down by some fixed number of spaces. And the classic example is three. So that an A turns into a D, a B turns into an E, a C turns into an F, and so forth. And you wrap around for the last couple of letters, uh, to A, B, and C. And this is symmetric because once you know the key, which is like three, then decrypting these random characters is just shifting by minus three. Uh, and pretty much all ciphers invented, uh, up until the very early 1970s, uh, were like this. And as I said, the, the key management issue becomes the big deal.
Now, there is still some dispute. Uh, in the early 1970s, Cliff Cox, James Ellis, and Malcolm Williamson, in the, in the UK, came up with asymmetric, uh, encryption. Uh, the UK, the, the Government Communications Headquarters, GCHQ, the, the cipher organization in the UK, kept it secret. And in the late 1970s, 1978, Ron Rivest, Adi Shamir, and Len Adleman, uh, working at MIT, uh, came up with, uh, an asymmetric public key crypto system and published it in Communications of the Association for Computing Machinery. And, uh, this is RSA. And they got credit for everything until sometime in the mid to late 1990s, when the UK said that, well, they actually had thought of this first. They just didn't tell anybody about it. So there's some, some dispute. Uh, but, uh, and at one point, Malcolm Williamson said, yes, we invented something, but we didn't really follow through, uh, to make it practical. We had the idea, and some of the idea was Cliff Cox, who is one of the most brilliant mathematicians I've ever met, uh, frankly, uh, amazingly skilled.
So, uh, up till now, uh, essentially all the public key crypto systems have relied upon, uh, number theory, which is integer arithmetic, or, uh, combinatorial problems, uh, that were easy to go one way and then hard to go back the other way. Um, so the number theoretic things, if you consider a prime p, uh, 11, all primes have a large number of primitive roots. For 11, seven is a perfectly fine primitive root. And if you power up seven modulo 11, uh, 7 squared is 49, minus 44, which is 5 mod 11. 7 * 5 is 35, minus 33 is 2. 7 * 2 is 14, minus 11 is 3, and so forth. And if you look at that second line, and this is the key, the powers of a primitive root modulo a reasonably large prime look like a random sequence. There's no inherent, uh, pattern.
Now, if you happen to have a primitive root that's two, you'll get a bunch of things. Once you get something small enough, you multiply it by two, it still stays smaller than the prime. So you can actually recognize things. But there are general rules of thumb that if your primitive root is roughly the square root of the prime, you're not going to get enough of these, uh, subsequences that would allow you to predict what, what the primitive root might be and what the powers might be. So these are, uh, essentially random. And the exponents are referred to as discrete logarithms. Uh, if 7 to the 5th modulo 11 is 10, then the logarithm modulo a primitive root 7 of 10 is five. And this is when you, what you hear when you talk about the discrete logarithm problem, because it really looks like a, like a logarithm. It's just kind of oddly done.
Now, cryptography generally doesn't work modulo primes. You take two large primes p and q and you multiply them together to get an integer n. Uh, and these days, if you were doing cryptography, if you were doing RSA cryptography, you would want p and q to be about 2096 bits long, 20, 2048 bits long. So the product n is 4096 bits long, which is 1300 and something decimals. So you would want big primes. Uh, and you would have lots of options. You don't get a single cycle modulo a product of two primes, but you almost get a, a, a single cycle. And the order, if you multiply everything together, uh, and you can multiply the integers together, or you can simply add the exponents, uh, and do a lookup, uh, in a table, just as you would look up, uh, in a logarithm table back in ancient days, like when I was in high school taking physics. Uh, and it's p minus 1 times q minus 1. There are bad choices for the primes, but there are general rules for choosing good primes p and q. And you know, if p minus 1 and q minus 1 have lots of factors that are the same, then the cycle that you get is not very interesting. So you would like to have p minus 1 and q minus 1 both having a large prime divisor. So if p and q are 2048 bits, p minus 1 is going to be 2048 bits. You would like at least a 2000-bit prime dividing p minus 1 and q minus 1, uh, just to make sure that you really do get this, uh, big cycle.
Wh, I keep wanting to use the shift character. Now, y'all are probably very used to doing physics, which on a computer is floating point, 64-bit floating point, 96-bit floating point. Uh, integer arithmetic is very much different. When you multiply these two numbers together that are, you know, 4096 bits long modulo n, you're going to get an 8192-bit number, and you have to reduce it essentially by dividing by this 4000-bit number. That's a very expensive operation, and it's inherently sequential. Uh, in, uh, in ancient days, when I was in grad school, uh, we had a rule of thumb that if an, if an add cost you one, a multiply would cost you about five, and a divide would cost you 10 to 20. Uh, and this gets worse and worse the bigger the numbers are that you're trying to reduce. Uh, and the interesting thing is arithmetic on special kinds of numbers can be quite fast. Uh, and the largest known prime numbers are usually Mersenne numbers, powers of 2 minus 1, because of the trick with arithmetic. And this is, this is where this, there's some good mathematics behind this, but the mathematics by itself would not be enough if you couldn't actually use some computing tricks. And my background was number theory. And when I first started computing, I realized that a large part of, uh, computing for doing number theory or combinatorics or something, uh, was figuring out clever, clever ways to get around the fact that the computers were not built to do that kind of, of work. Uh, computers are built to do science and physics and weather modeling and friction reduction and stuff like that.
So, interestingly enough, Peter Montgomery, uh, who has, who died three years ago, uh, came up. Wait, that's, ah, go back. Ah. Oh, okay. That was that was one. Peter Montgomery came up with, uh, a very clever way of doing with general numbers what you can do with Mersenne numbers. The reason that Mersenne numbers are almost always the largest prime is that it's a power of 2 minus 1, which means it's a string of n one bits. The product of two such things is 2n bits long. So it's some a, which is a 20, let's just deal with 1496-bit numbers. Uh, it would be a, it would be, you get an 8192-bit number, which would be a left half of 4096 bits and a right half of 4096 bits. And the product is the left half times 2 to the n plus b. And you can just rearrange this as 2 to the n minus 1 times a plus a plus b. And if you're, if the number you're reducing modulo is that power of 2 minus 1, the reduction is just adding the left half bits to the right half bits and maybe subtracting one if there's a, a carry forward. Uh, and this is why Mersenne numbers are the largest known primes is that you can do the arithmetic. Even for, uh, the largest known Mersenne prime is several thousand bits long, uh, and you can do the arithmetic because you don't have to divide. Uh, and this is a very big deal.
Now, what Peter came up with is a clever way of converting arithmetic modulo p times q into arithmetic that looks like Mersenne arithmetic. You essentially premultiply the entire world by something that turns it into something that looks like a string entirely of one bits. And then suddenly you can use the, uh, Mersenne trick, uh, to make the reduction, the division, which would be horribly expensive. Uh, integer division is done bit by bit, and if you've got 4096 bits, that would be totally unacceptable. So Peter came up with this wonderful idea, which is used all the time. Uh, and, uh, it's the computational trick that makes this kind of arithmetic possible for doing cryptography.
Uh, now, the Rivest-Shamir-Adleman RSA, uh, crypto system, essentially you choose p and q of 2048 bits. This is, this is doing it today. Uh, when this came out in 1978, uh, your, your primes p and q would have been 256 bits, maybe 512 bits long. Uh, but computers have gotten faster. So, knowing p and q, you choose a public exponent e, which is a number modulo, uh, n, and you compute the private exponent d for which e times d is congruent to one modulo p minus 1 times q minus 1. So the length of the cycle is p minus 1 times q minus 1. And there is, uh, a well-known theorem that says for any, uh, integer modulo pq, there's going to be an inverse modulo p minus 1 times q minus 1. So you can publish n and e, and you hold d secret. And that's the big deal.
To, so to send a message m, the plaintext, you just write it as ASCII characters and turn that into bits and chop it into, uh, sections only as long as your, your n, your integer n. Anyone can compute the ciphertext m to the e because e is public. And that ciphertext can then be sent. And if you take that ciphertext to the private key d that you haven't told anybody about, the, the math theorem says that turns into the original message mod n. Uh, so again, even with 4096-bit arithmetic, 4096 bits is not a very long message. So you have to do this with, after you break up the message into chunks that are 4096 bits long or smaller. So I get the ciphertext. I know d. Nobody else knows d. So if I take the ciphertext to the d power, that's m to the e*d power. And that turns into m, the original plaintext, because I have computed n and d to be the inverse, uh, of p minus 1 times q minus 1 of e.
So now, why is, why is this hard? Why is computing d hard? I don't think anybody believes there is anything faster for finding d given n and e that does not require factoring n. So all of RSA is based on the difficulty of factoring large integers. Um, and the whole business of choosing p and q properly is so there are certain 4096-bit numbers that are trivial to factor, uh, if the p and q are chosen badly. But if you choose, if you choose good p and q, then you can't compute d without factoring n. Uh, now, what's the state-of-the-art? I just looked up on Wikipedia, the state-of-the-art, the largest known, uh, hard numbers to be factored, successes come in in the range of 800 to 900 bits long for n. And, you know, we're talking 4096 bits. And this is just, this is just a very, very difficult problem. We know we can do it. But if it's going to take until the sun burns out to factor one of these numbers, then you've got a pretty secure crypto system. And this is RSA.
Uh, now, RSA itself is not used very much because it's slow. All those, all that arithmetic, all that powering up modulo large integers is slow. Uh, and it's slow by comparison with elliptic curves. Uh, and I'll talk about key exchange as an example of this. Uh, the NIST standard for AES, the Advanced Encryption System, was developed. Well, part of the original boilerplate said that it ought to be feasible for credit cards. Uh, and if you look at the algorithm that was chosen, AES heavily uses byte-oriented computations with lookup tables, uh, in matrices. Uh, and the, the chips that you have in credit cards that you manufacture by the tens of thousands are cheap and easy to use. And if you're only doing byte arithmetic, it's fast. So what normally happens these days, and this is, if you've ordered anything from Amazon, this has happened on your computer, uh, it's either Cox-Ellis-Williamson or Diffie-Hellman, depending on your political persuasion. Armadillo has a public prime p and a primitive root g and a secret exponent e. Uh, this is normally done as Alice and Bob in the, in the cryptography community, but that to me just seems boring. So, Armadillo computes g to the e power modulo a big prime, and sends that to Bobcat. Bobcat knows the prime, the public prime p and the primitive root g, and computes her own e prime, and then g to the e prime is b, and sends that to Armadillo. And computes a to the e prime, which is now g to the e*e prime. Oh, Armadillo gets b and computes b to the e, which is g to the e*e prime, which is k. So at this point, both Armadillo and Bobcat have the same key k. And without solving the discrete log problem for these primes, uh, this is secure. Uh, and if we couldn't do this, we could not do online commerce. Uh, you know, if we, if we didn't have a way of having your computer having a private key and having being able to exchange keys with Amazon or whoever, uh, then we wouldn't be able to come to a common key electronically, never having seen each other. Uh, so the system normally used these days is, uh, the, the Diffie-Hellman key exchange to produce a key that is now used for the actual transactions that uses AES, which is very fast and very simple. And if you both have a key that nobody else, uh, can come up with, you've got a secure message system.
Now, the discrete log problem, given e, a root n, and the k-th power of e, find k. Find, find the discrete log problem. There is an algorithm called the index calculus, which sort of works for large values of n, but doesn't work perfectly for large values of n. Uh, so we don't normally use, uh, primes with key exchange. We use elliptic curves. Uh, so let's see. I think I have a picture. So there's a picture of an elliptic curve. Uh, if you consider the solutions, the rational number solutions, pick integers a and b or rational numbers a and b, and consider the rational solutions to this equation, quadratic in y, cubic in x. The, the rational solutions form a mathematical group. Uh, so there's, and it's usually written additively, not multiplicatively. So, uh, given something like this, you get the picture. If you take a straight line and cut the curve, because it's cubic in x, it will cut it in three places, right? It's obviously like that. And if you think of the different values of a and b, if you push down in the z plane, the, uh, oval on the left will eventually get bigger and bigger and meet the, the curve on the right, and you'll have just one curve. If you pull it out, it's going to get smaller and smaller, like the pommel on a saddle on a horse. Um, and, uh, this is, interestingly enough, I actually did my, did my doctoral dissertation on elliptic curves, and at that time, I could find exactly one book in the library on elliptic curves. Now there are dozens. Now that this has become, Victor Miller and Neil Koblitz independently, separately came up with this elliptic curve idea in the, in about the same six-month period in the middle 1980s.
Um, so if you intersect a straight line with the curve, and you have two rational points on the line, so if the, then the slope delta y over delta x is rational, and you can stick that in, and you get a cubic m squared x squared sx plus t equals 0 for some values of s and t. Fairly complicated. And then Newton's equation will say the sum of the three roots of that is going to be the square of, well, it's minus the coefficient, so it's m squared. M is rational. X1 and X2 are rational. So X3 is also rational. So if you take a straight line and cut the curve in two rational points, the third point is rational. Uh, which is part of why you get, uh, a, a group. Uh, and this was proved to be a group of a finite number of generators back in the early 1900s. Very famous theorem. Uh, there's elliptic curves have a finite number of generators of infinite order. Uh, and you can actually write down fairly strict constraints on what, uh, points gen, uh, points of finite order in the group are going to be. Uh, and there usually are not many points of finite order.
Now, just as with powers of modulo primes, if you take a generator and take multiples of a generator, that's a reasonably random walk through the solution. So the discrete log problem for elliptic curves is just as hard as the discrete log problem for primes or two primes, but one can work with much smaller arithmetic. So these days, the general consensus seems to be that for traditional RSA, you need 4096-bit arithmetic. For comparable security using elliptic curves, you need maybe 512-bit arithmetic. So the computational cost is just smaller, much, much smaller. And these days, the discrete log problem using elliptic curves is what is used for key exchange. And then that gives both parties at the end of, of a computer line, the same key that is not something somebody else can hack. And then you can use AES for message passing. And now there are just dozens and dozens of books on elliptic curves. And, uh, and there are bad curves. You, there are certain kinds of curves that, uh, for which the discrete log problem can be really easy. Uh, and you, if you avoid those kinds of curves, uh, you generally do get the security you want. And NIST, for example, even publishes, uh, a comparison table of the bit length needed for elliptic curves and for RSA for the same level of security. Uh, and, uh, curves are just much better.
Where's my cursor gone? Oh, there's my cursor. Now, what's the problem? Once we get quantum computers of, of a size big enough to attack these problems, the solution becomes trivial. Factoring on a quantum computer with enough bits, enough qubits, is a trivial problem. So we're dead in the water. Uh, NIST started working on this several years ago, 10 years ago maybe. Uh, and they published a call for, uh, post-quantum algorithms for cryptography, for public key cryptography. A year and a half ago. Yeah, about a year and a half ago, they published three standards that they, and so I'll back off. When NIST first did the Data Encryption Standard, DES, in 1977, a whole bunch of conspiracy theorists said, "Oh, NIST was subverted by NSA to choose something that NSA knew it could crack." And there was a whole bunch of nastiness going on. NIST learned the lesson from that. And when they did AES, they basically had a conference and said, "Submit your proposed algorithms." And there were almost 30 that were, were submitted. Uh, and everybody got access to everything, and everybody started beating on the competition. Uh, and then they had a second conference, and they trimmed down the 29 or something submissions to, I think, six, and went at it again. And by the time the third conference came up with what is now AES, I have only heard of one mathematician in the world, uh, at the time it was in Czechoslovakia, and I'm not sure whether it's the Czech Republic or, or Slovakia, but he claimed that there was a backdoor for AES. He, I think, is the only one with any kind of background who actually says there's a backdoor to AES. I think everybody else was thoroughly pleased with the competition because everybody got to beat on everything else, uh, and, uh, they did much the same, uh, for the post-quantum algorithms. They had, you know, give us the submissions, and they had a sequence of competitions, uh, and people, people tried to break them. Uh, and I think now there is a fourth, uh, algorithm, fourth standard that I don't think I have seen totally published. There's a draft version, but I don't know. Was supposed to get published last August, I think, and I'm not sure it, I'm not sure it was. But there are four proposals to be used for different kinds of purposes. All of these new algorithms are based on lattices. Uh, there were some earlier public key cryptography algorithms that were also based on lattices. These are different.
Now, Shor's out in the, Peter Shor, uh, published 1994, and he showed that with a quantum computer of enough bits, he could factor, he could do the discrete log, he could do pretty much all of the computations necessary to break, uh, public key crypto systems that are still pretty much the standard. Uh, now they're saying millions of qubits. Uh, I think, I think it was last fall, there was a paper published that reduced the number of qubits from to factor an integer n of n bits. It reduced the number of qubits from n squared to n to the 1.5. So that's still a lot of bits. If you're dealing with a 4096-bit number, that's still a lot of bits. Um, but it's coming. Um, and, uh, now, what is a lattice? You've worked with lattices all your lives. Uh, given two points, 0, 1 and 1, 0 in two dimensions, you have a lattice of all of the points in the plane with integer coordinates. If you do this in three dimensions, you get unit vectors in x, y, and z, and you just look at all of the integer linear combinations of the basis elements. That's a lattice. Uh, now, if you go to several hundred dimensions and you have non-integral basis elements, so it's not just all zeros except for one one bit. Uh, there are some really hard problems that that come from from lattices. And probably the two best, the shortest vector problem, given a lattice, given that you have, you know, 256 basis elements that are floating point. What is the shortest vector in that lattice? What is the closest point in the lattice to the origin? That's a hard problem. Uh, and the, the closest vector problem is very similar. Given some point in n-dimensional space, what's the closest lattice point to that one? Uh, and these are computationally really, really hard. Uh, and this is what the, the current NIST standards are based on, these two problems. Uh, and I don't know that, I don't know that anybody thinks NIST got it wrong again. I think most people are reasonably confident that, uh, NIST learned its lesson from the DES debacle, uh, and they, they really have good problems. Uh, so these are computationally difficult.
Uh, and interestingly enough, yeah, so I, this is about the right timing. Uh, I figured there would largely be questions. Uh, now, in order to make this, uh, feasible, the NIST standards, uh, deal with bits and bytes, they don't, and, and polynomials in basis elements, they don't deal just with floating point numbers. Uh, and part of the reason for that, of course, and you all would know this really well, floating point arithmetic on a computer is not a perfect system. Um, you're going to get small errors just from not being able to maintain all of the, uh, the bits of a multiply. So the arithmetic is generally done, uh, in groups of, say, 256 bits of, uh, basis elements, and each of the vector, each of the, uh, values, say, is a 12-bit integer. So I deliberately left time for questions. So I would be happy to, you know, send you my slides, send you some, some, some links if you have questions. Um, so are there questions?
Of course, there's questions. Can you hear me? >> Yes. >> Now, we know that, um, floating point arithmetic is not exact. Uh, however, it is possible to create a system that is exact. And in fact, when we, uh, if we want an exact representation of the square root of three, we simply put a check mark followed by a three, and, um, and that represents the square root of three. Uh, similarly, a over b is represented by the pair of numbers a and b, or a and b are perhaps integers or counting numbers or whatever. Uh, you do this, um, you can still use the floating point arithmetic by specifying which, uh, floating point numbers are exact. And then, uh, if you, if you want to take a plus b, and say that c equals a plus b, then you calculate a minus c plus b as a d, and if d is zero, then, then the arithmetic was exact. And if it's not zero, then you've got the overflow, um, and, and you can, uh, end up redefining things so that, uh, rational numbers are defined in terms of complex numbers rather than the other way around. And, uh, a over b is defined as the cotangent of a plus b i, or the tangent of b plus a i. And, uh, those are exact. And, uh, and if you try to do the, uh, arithmetic, uh, with floating point numbers, and it's not exact, then you end up seeing, uh, that, um, for example, uh, i to the, uh, a i to the 1/a time, to the, uh, a power is equal exactly to i. And, uh, on, on in floating point arithmetic, it's not. And that shows the difference. And you can do it correctly. Uh, I would like a copy of your slides. >> Okay, I will, I will send them to Flash and then. >> Okay. Uh, or let's see. >> Did what did I say make any sense to you at all? >> Oh, yeah. Yeah. I, uh, for a brief period, I was interested in things like rational arithmetic and the other, uh, problems. So there's my email. Uh, so it's, it's easy to get to me. Uh, yeah, I, I did a little bit, uh, on, uh, rational arithmetic instead of floating point, uh, and other kinds of things. I also remember, uh, the fight over it, uh, uh, arithmetic standards when everybody said, yes, we need to have a standard for floating point arithmetic, and the standard should be exactly what my company built, and that held up the, uh, uh, what is it, 794 by five or six years. >> And the Fortran standard was a lot different than the C standard. >> Yeah. Well, and, you know, just the question of, uh, how big an exponent, how big a mantissa, um, I know that, uh, there was a serious dispute. Cray had fewer mantissa bits but bigger exponents, uh, and they didn't want to have to, nobody wanted to have to redesign their, their floating point operators. Oh, but, uh, yeah, now the other, >> well, one of the problems is, >> pardon. >> if you look at, uh, how, uh, how counting numbers are defined, or how integers are defined, and so on. Um, it, uh, what, what was I saying? Um, >> and so, >> I lost track of what I was trying to say. >> Well, I don't know anybody these days that doesn't do two's complement arithmetic. Uh, some of the CDC computers were one's complement arithmetic. Uh, but I think they were the only, >> manufacturer of, of big iron that that did that. Uh, and, >> well, uh, my thesis is that you can take any, uh, computing engine available and use it to define, um, uh, mathematical numbers. The thing I was trying to say, uh, was, um, that, uh, I'm, I'm sorry, I've been younger, but, >> Cheryl, you have your hand up. >> Uh, yes. Uh, thank you very much. Uh, Dr. Buell, I'm going to ask a very simple question. Um, when you say 4096 bits, you mean zeros and ones. A stream of zeros and ones. >> Yes. >> Okay. All right. And so, thank you. I thought maybe you meant that, but I just wanted to be, uh, sure. So, we know there are a lot of, uh, bad actors out there trying to, uh, hack one's, uh, credit card transactions and what have you. So, and these are gangs of people on, on their computers on the internet, we understand. So, are they trying to hire mathematicians to help them hack our credit card transactions? What kind of, uh, things are going on in the background with people trying to fathom how to, you know, decrypt things that they shouldn't be? Are you familiar with any of that? >> I, I came up with a lot of that. I think, uh, I think there's relatively little, uh, direct attack on the crypto systems. I think, uh, the, the social engineering kinds of things are much more common. Uh, and, you know, finding data, finding personal data, finding credit card numbers, I think that's, or, uh, hacking into various people's computers. I mean, one of the, one of the issues, of course, is we all get these messages and emails saying, you know, you've won something, just click on this link, and, uh, a lot of those are scams. Most of them are probably scams, and it's probably a lot simpler to do those scams in bulk, and then when somebody clicks on the link, you can insert some malware that will download passwords and such. And I think there's probably a lot more of that going on than there is direct attacks on the, on the crypto. >> Okay. Hello. >> I, I, I'm, I'm at Maryland and have an echo. >> You got a hell of an echo. What, what's the status of quantum computers attacking these systems? >> What kind of computers? >> Quantum computers. >> Oh, quantum. Uh, I think the biggest number that's been factored by a quantum computer might be 187. Uh, I think that's, they just, nothing has been, has come up with enough qubits to really go after anything big. Not yet. Uh, it's coming. Uh, and if you, you know, ordinary people probably don't have the same concern. If you're the US government, you may want to protect your messages for 40 years. And that's a lot of change in computers. Uh, and I think the bigger quantum computers are coming. Uh, you know, whether it's 2030, 2040, that's not that far into the future, provided, you know, one can get access to the, uh, to the cryptographic messages. So if you're just sucking things in from the ether and willing to wait 20 years, you might do well. Right now, I, I think so. Um, if it's some number of millions of qubits to factor a 4096-bit number, uh, I don't think, I think the biggest quantum computer is several dozen qubits. Uh, I, I get these messages from Science or whatever and CERN, and I, you know, it's coming, but we're not there yet. >> Thank you. Thank you. >> And the lattice, the, the post-quantum algorithms, uh, have been checked and do not seem to be subject to the same cracking, uh, by quantum computers that factoring or discrete logs could be. So if those, if those come into standard use, then we should be safe. >> Are there any more questions? Thank you very much.