EP164 Quantum Computing: Understanding the (very serious) Threat and Post-Quantum Cryptography

Security.

Hi there, welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior PM for Threat Detection, Investigation, and Response in Chronicle, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button in your podcasting app of choice. You can follow the show, argue with your hosts and the rest of the Cloud Security Podcast listeners on our community page. You can find the link to that in our show notes. Finally, I recommend you follow our LinkedIn page so you can watch special livestream episodes. Anton, this episode, where do I even begin?

I mean, it's just, I don't know. Like, to be honest, it was just, I was like gushing from being mind-blown by a guest. Like, it was just like one of those kind of life-changing episodes that are really rare.

Listeners, Anton just called this life-changing of an episode. And I want to give a little backstory, which is this guest reached out to us and pitched us on doing this episode. And Anton and I both had a reaction of, no, that's not real. No way. And then we both had the reaction of, oh God, this is very real, very way, holy cow. And so for an episode that spans topics from Richard Feynman to computational complexity to qubits to data centers in the desert to fundamental changes to how we live our lives, I think this one's a banger. I hope you do too. Let's turn things over to today's guest. Today we are joined by Jennifer Furnick, senior staff security engineer here at Google and our second UTL of the year. And if you've forgotten what a UTL is, go check out the Mike Schiffman episode. Jennifer, I don't have a PhD in quantum mechanics, unlike my co-host. Could you tell me what a quantum computer is? And are they actually a threat to cryptography? Like, I thought quantum computers were kind of like fusion, like always 20 years away. So, so what's going on here? Why are we here?

That's a great question. I mean, first off, I think it might make sense to break this into 2 separate problems. So the first question is like, if RSA and elliptic curve cryptography were broken, what would that mean? And the second question is like, okay, let Jennifer please convince me that we can actually break, for example, RSA. Oh, for sure. So like, if RSA were broken or elliptic curves were broken, if any of the quantum attacks that I'm gonna talk about today that we know are possible were to exist, the following things would be affected, like RSA, DSA, elliptic curve Diffie-Hellman, X.509 certificates, TLS, IPsec, VPNs, SFTP, SMTP. Wait, hang on.

This is a big list. What's not on the list?

Anything that doesn't rely upon cryptography, especially asymmetric cryptography, for its security. Um, so try and find me a piece of the internet where cryptography doesn't matter.

Okay. So everything breaks.

ROT13 would be broken too? No, my library.

What year is this? What year is this?

So, so, okay. So that's the downside, everything. What's quantum got to do with that?

All right. So imagine some theoretical ideal world where like every single vulnerability in your infrastructure and applications were completely patched and like zero days didn't exist. You'd still be vulnerable to quantum adversaries. And I'm gonna talk about the types of attacks that we're thinking about in this cryptographic domain. So basically when we think about quantum computers, you can imagine like, you know, Moore's Law, right? As computing progresses, you know, every 18 months you fit twice as many on a chip and we get smaller and smaller things able to do the same computational task. If you keep following that along its natural progression, and sorry, this is a bit hand-wavy, but I'm just trying to get to the point. If you follow this along its natural progression, there comes a point where like the things that you're computing with are small enough for quantum effects to come into play.

Okay.

Now, this could be a bad thing, right? Like it could be that this is interrupting the computations we're trying to perform, but actually there was this idea of Feynman, well, what if we leverage those quantum effects to like make computers do unique things. So when we think about post-quantum cryptography, we're basically saying quantum computers, we have certain algorithms for them. They're able to break cryptography in certain ways. And in post-quantum cryptography, we're saying, how can we find primitives that are resistant to attacks by classical regular computers that we have today, perhaps an arbitrary number of them, and quantum computers that can do these special types of attacks as well?

Hang on. Did you say this was Feynman's idea?

I mean, it was around that time period that Feynman definitely put forth this spin that was like, what if we used quantum computational effects as a good thing, right? Harness them, harness them for unique types of computation. But these ideas have been floating around for a long time. Some of the algorithms that we'll probably talk about today have been around for almost my entire lifetime, for example.

Wow.

Well, I bring that up because we were talking about Feynman on an episode we recorded Just yesterday. Oh, it was funny to see the guy twice in 2 days. So, okay.

I haven't hacked you and listened to all the prerecorded episodes.

You might've with your quantum computer in your back pocket. So are quantum computers like on a credible path? Are we close? Are they on the horizon now?

Yes. What exactly that time horizon is, we can talk about how to think about that. But basically the idea is like, it all builds from this presupposition that quantum mechanics is true. So we'll start with this assumption that quantum mechanics is true. And we have a bunch of experimental evidence that, you know, this is likely the case.

I believe you.

Since information is physical and since computers obey the laws of physics, building computers at a certain scale, as I mentioned, will result in quantum properties. So ultimately, if you get small enough, we talk about something called a quantum bit or a qubit. So it's analogous to typical 1 or 0 bit that we have. We build up these qubits into something called quantum gates. So we have our own way of defining computational gates using quantum bits, depending on what the physical properties are of those bits and the instantiation of quantum computing. From those gates, we can build quantum algorithms, which is all about how do we build these computational building blocks using quantum physics to like design an actual algorithm that performs an interesting task and does it efficiently. And then we finally have this area of computational complexity, where we look at all the resources needed to perform these tasks and whether they're even possible, and also whether they're worth doing, right? Like, if you've got a quantum computer, that's like, let's call it a billion-dollar computer. If we don't have a reason to believe that that quantum computer can do anything efficiently that regular computers cannot, why would we bother building it? So computational complexity is really important because it helps us reason about what kinds of resources exist and what kinds of computers are worth building. So, So, like, if we were to step back and think about computing in general, computing is really just a sandbox of what is possible, right? It's what is computable, what may be known within the universe. It's bigger than you or I. We can ask questions about computability within our lifetime. So, like, as a cryptographer, I might ask something like, can I break an AES-128 key with some certain amount of compute within the next 60 or 70 years, right? And this is the type of analysis cryptographers perform to understand how much our algorithms can slow down an attacker to accessing some data. But we can also ask really profound things like, what is computable before the heat death of the universe? And this matters because it helps us reason about the hardness of different mathematical problems and what can be known and unknown with what resources.

So, talking about the heat death of the universe, cryptographers are popular at parties. I'm getting that much so far.

Honestly, you would be surprised. Like, okay, so like it sounds really philosophical, but it really matters, right? Like, let me convince you that it matters.

Please.

So I think this question is really fundamental to cybersecurity because we're essentially asking what can be known and unknown and what is possible to be known or to be protected from the most well-resourced possible adversaries. So something that we don't talk about very much, but I think is really interesting is like when we think about the math of cryptography, there's this notion of one-way functions, which are functions that are like easy to compute on every input, but hard to invert under some certain conditions. An unsolved problem in computer science is actually, do one-way functions exist? Like, because asymmetric cryptography presumes that we do.

It's right in the name, isn't it? Yeah.

Right. Like, we presume that these functions exist and the security of the entire internet and like of information writ large depends on the existence of one-way functions. And like, we as humanity don't actually know for sure that they exist. And if they did, we'd finally be able to confirm that like P is not equal to NP, which would be like kind of a big deal. But if we steer this back to quantum, right, we are able to start asking these resource type questions, not just about what is computable in general when we think about cryptographic one-way functions, but what is computable specifically with these quantum resources when we harness the quantum physics and the information, the way that we're able to manage those quantum bits, we can ultimately ask questions like I mentioned, like, are quantum computers capable of efficiently doing things that classical computers are not?

Ah, that's the crux of it right there, listeners, isn't it?

Yes, that's the depth of it. So we have reason to believe that they are, but we don't have definitive and robust proof that they are. But it looks like based on some other small proofs that we're pointed in that direction. So then, you know, if you have efficient quantum algorithms, you can do things like break RSA. And we know that that's possible quantumly, and we don't know if it's possible classically. We're still figuring that out. We suspect not, but we know that it's possible quantumly. So then how do you make all of this real? How do you take this from the world of mathematics to the world of like, actually like cracking RSA. It's about building the computers that can execute these algorithms. So the work of experimental quantum computer scientists, and you've probably heard in labs like Google and IBM and various universities, that people are making progress on just that. So step by step, they're reaching these different engineering milestones necessary to build what we refer to as a cryptographically relevant quantum computer. That's a big enough quantum computer that lets us break crypto. And let's make this real with some numbers, 'cause I feel like I've been in theory world for too long for a second.

There's definitely This has definitely been an abstract episode so far.

So far. All right, so let's think about breaking our current crypto systems, AES-128, RSA-2048, various elliptic curves. This is estimated to take between 2,000 and 4,000, what's known as logical qubits. So right now, people like different labs are on the order of a few hundred different qubits. They're working on different engineering milestones that will probably be super linear and scale up to thousands or millions of qubits. over time, and once they reach those and you've had this sufficiently large quantum computer, there's been estimates, like resource estimates, where you could break RSA-2048 in less than 29 hours. You could break RSA-4096 in less than 10 days. And like, the scaling is poor. You can have, you know, a very large RSA key and it's still gonna be trivially broken. So because we have these—

By a computer that does not exist, right? By a computer that doesn't exist, and the path to it is clear, clear-ish, or not clear? Because that to me is the bigger question, not only how quickly it would work, but the path to it is clear or the path to it is clear-ish?

I think it's clear-ish. So, I mean, there's different milestones that are well-defined and people have been, you know, I've been in this field for about a decade. People have been checking the boxes on that list of milestones progressively, being able to scale up to having stable, scalable, fault-tolerant, error-corrected quantum bit that you could combine with a bunch of other quantum bits to run these algorithms. So we've seen progress, right, over time. We can also get this information from other sources too, though. Like, I mean, don't you always wanna know what the NSA is thinking? NSA published these guidelines called CNSA 2.0, where they were talking about what crypto algorithms you should use if you process like national security data and when you need to like switch them to be post-quantum.

Right.

And many of these timelines start having milestones of like, you have to protect these certain things within 2 years from now, 3 years from now. And a lot of the hardest deadlines are less than a decade away. So NSA, certainly it seems based on what I can infer from this document, seems to think that this is like a very near-term concern for us.

So that was going to be my next unscheduled question of, okay, fine, IBM's got that, we've got this, public labs have this.

Yeah.

How far ahead is the government?

That's a great question. And I think that's a really important question to keep in mind because, you know, we can make all of our suppositions about when we'll have a cryptographic cryptographically relevant quantum computer.

Yeah, but when do they have it?

When do they have it? Do they have it already? And is it the US government? Is it a government of another nation that is allied or not allied with the United States? These are really important questions because if we think about the shift in geopolitical power, if, you know, a state intelligence community, you know, a state-level adversary were able to arbitrarily crack the most widely used cryptographic algorithms on the internet, That's profound. And what is chilling, and I think very important to keep in mind, is that this won't necessarily be the front page of the New York Times.

Yes.

We may not necessarily know when it happens or if it's already happened, and we may not know for years or decades afterward. So a lot of the preparation that we have to do, and this is in Google Cloud, but this is everywhere else around the world as well, is preparing for this with all these question marks in the timeline, because there's certain attacks that can actually already be carried out today before we even have the large-scale quantum computers.

But the timelines you're giving me, basically, I was meaning to ask a mildly snide question about is it permanently 10 years away. But if you have people planning for the risks of certain things being 2 years, that to me almost makes me kind of shut up and say, oh, okay, that's different. I mean, of course, you can go on Twitter and meet a clown who would think that AGI is coming in 2 years. But, but I think that it's different people. who think that the quantum-relevant encryption is coming, is coming so that within 2 years we should act. I think that's different, and it does make me pause. And I think ultimately, I almost feel like we're done, podcast is over, because you convinced me. And I've been in a couple of years, at least I was kind of like, yeah, but it's not coming soon. But I mean, it is coming soon then.

Seems like it, right? We can infer from IARPA and DARPA grants. We can infer from advisories given by different defensive agencies around the world. We can infer from looking at what is public about the scaling of quantum computing. We can look at algorithmic breakthroughs, right? So as the quantum computers get better and better and we have more and more resources, sometimes there's algorithmic breakthroughs as well that are showing that we need less and less actual resources and they come closer together.

Oh no.

So yeah, as it's evolving, right, there's— this is an active space. We won't know exactly when it's happening, but like the time to work on it is now and even well before now.

Okay, so you've scared me and Anton. You've scared us. You've probably scared everybody who's tuned in and not hung up and gone and sold all their stocks and bought gold and guns and moved to a bunker. I want to kick off one thing.

And sell all my Bitcoin.

Oh yeah, forget that.

Oh man.

One of the things I've heard doing my research about this is that quantum computing is algorithmically more of a threat to asymmetric crypto than symmetric crypto. Why is that? Can you explain that without making me wish I knew more math?

Sure. So like—

You'd wish you knew more math, Tim.

So I don't know, like, we don't have to necessarily think of this as generically true. Maybe what I'd say is like, oh, the best quantum algorithms that we have are for asymmetric crypto, and they're very powerful. We have ones for symmetric crypto as well that roughly cut the key sizes in half, but there's some debate about the circuit depth about how efficient they can be. And maybe that's a deeper, longer conversation for another time. But like, the most exciting quantum algorithms that we have, the scariest ones, affect things that are based on the discrete log problem. So RSA and elliptic curve cryptography, which is asymmetric. When we think about symmetric crypto, the best algorithms that we think about are like Grover's algorithm, which is like speeding up the search of unstructured databases. And it basically lets you kind of brute force faster. But like each day is a new day. Quantum algorithms are in their infancy. New algorithms can be discovered all of the time. So like something that we have to keep in mind is that post-quantum crypto, like the algorithms that are being proposed today, they are resistant to the as-of-yet undiscovered quantum attacks, but there could be a new algorithm, quantum or otherwise, that breaks those in the future. So cryptography always being a moving target, always being secure until we realized that it wasn't, we have to be ready to migrate these algorithms perhaps more than once in our lifetime, perhaps several times.

Which reminds me that there is this other concept of an algorithm that's resistant to that. So it's almost like it's resistant to a threat that truly hasn't materialized yet. So that's another area for my confusion personally, because I don't know how do you make a post-quantum algorithm that is clearly gonna be resistant to something that hasn't happened yet. So can you tell us more about how somebody would go and pursue and build a post-quantum algorithm given that you don't have a true breaker of the pre-quantum algorithms?

I love that question, Anton.

Oh, thank you. I think you wrote it.

So, that's a great question. It's kind of why I led in with all this theory, and all this math, and philosophy, because those are the things that are the building blocks for how we do all this quantum group analysis. So, first off, just to level set on terminology, when people say post-quantum crypto, or they say quantum safe, or they say quantum resistant, Those terms are all interchangeable. They all mean the same thing. And basically, this is this pursuit of an algorithm that is secure against classical adversaries, all the people we deal with now, and quantum adversaries. So anyone with a large-scale quantum computer, perhaps now or in the future. And when we're designing for those and trying to design algorithms that are resistant to computers that don't exist yet, we are making them resistant to the algorithmic attacks that you can create using a quantum computer. So what we do is we think about the hardness of the math that underlies the cryptographic algorithm. And, you know, when we talk about like asymmetric crypto, you know, we talk about like RSA, for example, the point in those algorithms is that they're hard in one direction and easy in another. So like multiplying 2 prime numbers together, very easy, but factoring a big number into its component primes is supposed to be hard. Well, Shor's algorithm made it that factoring a big number into its component primes was actually like pretty trivial once you have a big enough quantum computer to run it on.

There it is.

Sure.

So when we're doing this kind of algorithmic analysis, we're basically saying, hmm, which computational tasks can quantum computers do efficiently that classical ones couldn't? And we're trying to create new crypto schemes where that hardness in one direction and easy in the other direction property is still present even when a quantum computer's there. So we're looking for computational problems that are hard even for quantum computers, and we're basing our crypto algorithms off of that.

But we don't really know exactly how good quantum computers can be or what algorithms might be possible yet, right? So we're making kind of a guess.

That's right, because like some of the complexity stuff I've been talking about, we don't know exactly how those different pieces of all the math relate to each other, although we have a lot of good findings in that area and have quite good intuition. But the bigger thing is like there's just not that many people creating quantum algorithms. So maybe these You know, an algorithm that one might propose today is resistant to all the quantum attacks that people have thought of so far. But when there are many more researchers, much more time, there will likely be advances in these quantum cryptanalytic algorithms, and that might put certain things at risk.

So, it almost sounds to me like what we need next is not to find the right single new standard, but actually to invest in agility in our cryptographic approaches and make sure that we can adapt when we discover the things we will inevitably discover.

Yes and no. I think we need both. So the agility is important because—

Oh yeah, sorry, definitely both.

Yeah, the agility is important because like maybe the things we have today, we think they're good, but maybe they're not. Like the proposed post-quantum algorithms that are undergoing this standardization, people have worked really hard to attack those, but like that doesn't mean that the attacks are done, right? But we also need to migrate today. We also need standards today. And that's why NIST has been standardizing this stuff for like 7 or 8 years, and we're finally getting the NIST drafts, like right in the last 6 months or so, we received the draft post-quantum standards from NIST. They're gonna be finalized this year. So this is why it's like an opportune time to talk and think about all of these things because they're becoming real in the world. We're implementing them at Google Cloud and other places to roll them out like in 2024 and beyond. But we need those things now because first of all, as I mentioned, we don't know when a large-scale quantum computer will exist or if it does already.

Yeah.

But also there's this kind of attack that is really important to know Some people call it harvest then decrypt. Some people call it store now decrypt later.

Yeah, absolutely.

Where basically you're capturing, you know, encrypted traffic, you're holding onto it 'cause, you know, storage and computation is cheap. And then you're waiting until you have a sufficiently large quantum computer so that you can like break all the keys and access all of the plaintext. So since this is true for any data that's ever been in existence and sent over the wire, that it could just be captured and held onto, We need to be really thoughtful about rolling out post-quantum sooner so that we have a better chance at protecting it from quantum adversaries.

Yeah, that's a really scary one. And when I think about stuff like the, you know, what was the attack the NSA pulled off by storing all of the one-time pad traffic they ever saw and decrypting it later when they figured out one-time pad reuse? I believe people are capable of this kind of long-term thinking.

There's some pretty large data centers, you know, in Utah and other places. Right. And this is the work of intelligence community around the world. So of course they're capturing that traffic, and of course we have to care about this. And if it's not happening in one country, it's probably happening in another. The idea that no one's capturing encrypted traffic and storing it for later, I'd find that hard to believe. So it's for those reasons, and because of all of that uncertainty, that we do have to think about these things right now.

I admit that my attitude about this have very obviously shifted in the last 30 minutes. Like, I'm not gonna joke about it.

I'm not gonna joke about it. Victory is mine.

You win.

She really does, because I was the person with the snidest remarks about this, about it being permanently 10 years away, or about it being mostly about theoretical risks using hardware that doesn't exist, and what I thought may not ever exist. Because in my physics days, a long time ago, I had people who had a quantum computer lab kind of in the same building, and I felt like they've been at work since the late '90s, and with no real quantum computer in evidence. So, of course, science works exactly like that. You work hard, get no results, and suddenly it happens. So, like, I get that, but I still didn't fully grasp where we are. So, perhaps, is there any way to give a guide to listeners about, like, how to tell crazy sensationalist BS in this area from, like, reality? If somebody says, oh yeah, this skepticism is justified. By the way, quantum computer may be in the building next to you and you may not know. Like, I'm now stuck in this torn sort of like a psychologically unpleasant place where I feel like I'm convinced I'm paranoid, yet at the same time want to make snide remarks still.

Yeah. Well, I mean, I think it's good for those things to coexist because with too much fear, you know, we do nothing and we buy into things that aren't true. But like skepticism is important in our field and maybe we need it more than we have, right? The idea that we adopt all kinds of best practices that are not evidence-based is very problematic to me. Like, for security, other than ignore post-quantum, I think there's a lot of things that we do that we don't have good scientific results about why we should do them. They're just kind of like what everyone has been saying for a long time. So skepticism is good. Now, if we're calling out snake oil vendors, I mean, some of the advice I'd have, one is like, look for practitioners. So are the people who are making bold claims about cryptography people who have actually worked on cryptography in contexts outside of these bold claims? Have they dealt with the realities of production code bases? Can they speak accurately about other cryptographic problems outside of this one particularly narrow field? Like, do they have that broader security context? And can they put these problems side by side in terms of risk, right? Like, when we think about post-quantum, of course that risk is really scary, but we also have to think about like real-world attacks that are happening right now, and, right, and we need to compare and we need to credibly be able to speak about the comparative risk. So like, that's one thing. Maybe another one is look at where the science begins and ends, right? So we can trace out assumptions, we can trace out the claims that people are making, we can look at the experimental demonstrations or the theoretical proofs, and we can establish what is known to be true. But then a lot of times you'll have opinion that's kind of masquerading as fact. And especially when that opinion tries to scare you or tries to get you to spend money or whatever, I would ask yourself, like, what are these people trying to sell me? That's always a skeptical eye that I bring to things. And then finally, I think it's like asking questions. So asking questions, especially the obvious questions, like the things that you feel like are stupid questions, that's actually where the great things hide. Like I used to run—

Ooh.

Before, before I came to Google, I used to run a security research team. I ran the security research team at NCC Group. And like, we had amazing, like famous hackers like Chris Anley, but we also had like interns that were all doing security research. And I loved having the interns there because, and I'd say to them, ask every question that comes to mind, especially the ones that feel too obvious or too stupid, because often it's in those assumptions that we're making or in that, you know, thing we've glossed over in the threat model that is actually where the dirt lies. So I think asking these questions and not being afraid of asking the obvious thing is really important and it helps us be skeptical. Like you should call it, I come in here with all these buzzwords, quantum, somebody said AI at some point today. Like the more buzzwords there are, the more skeptical Jennifer, I—

first of all, I want to second Anton's on-air apology of our unwarranted skepticism and thank you for blowing both of our minds today. I sadly have to ask our traditional closing questions. One, aside from the awesome advice you just gave about telling truth from fiction, do you have practical advice for helping people? And 2, do you have recommended reading that doesn't require a quantum PhD like Anton has?

Cool. I think for advice, Like specifically related to post-quantum crypto.

Yeah.

One thing is like hybridize your algorithms. So if you're gonna use a post-quantum algorithm, there's lots of resources about this, hybridize it with a classical algorithm. So like do, you know, elliptic curve plus some post-quantum thing, use both so that you at minimum have the security of the thing we were using before, plus the post-quantum thing.

Makes sense.

A second thing is use standardized crypto. So like NIST has been running this standardization competition for like 7 or 8 years. And there's been a lot of cryptanalysis. People have really focused their energy here. These standards have been in the advancement of good things and the deprecation of bad things. So like, use the standards and don't roll your own crypto, right? Like, don't roll your own algorithms, don't roll your own implementations. Use existing high-quality implementations that have been thoughtful about like side-channel attacks and things like that. And I think as well, understand what's at stake. It's easy to like get caught up in the philosophy and the skeptical kind of excitement of these types of problems. But when we think about like trade secrets, PII, medical information, military secrets, these things really matter. And even, you know, when we think about people saying, oh, I don't have to worry because I have nothing to hide, like robust encryption is still important. Privacy enables, you know, freedom of speech. Privacy enables freedom of the press. It enables democracy at large.

Freedom of assembly, freedom of faith. It enables everything.

Exactly. So like, because of these things, the work that we do matters, cryptography matters, the data we protect matters, and the more thoughtful we are about what is at stake and how it can be attacked and how we can protect it, the better we'll be at protecting it. And then I guess my final piece of advice is like, work with your vendor. Like, we're here to help. Like, I work for Google Cloud. My life's work is about being increasingly rigorous and robust about cryptography and security. So nothing would make me happier than going to sleep at night and knowing that every GCP customer has like robust, quantum-safe crypto. So work with your vendor 'cause we're here to help you get there. In terms of reading, if you're interested in PQC, I would say looking at the PQC standards that are being developed at NIST, the project website, the NIST Post-Quantum Cryptography Project, the related mailing list where cryptographers argue about things, all good stuff. You can get experimental and like kind of research results from the PQ Crypto Conference. You can also look in the major IACR conferences for the post-quantum cryptanalysis and post-quantum results. There's also a small workshop. I attended it back in 2015 at Schloss Dagstuhl, where they have like this centuries-old German castle that hosts small groups of people to work on important problems in computer science. And they do one on quantum cryptanalysis in particular, and they publish their results. So that's a great thing if you really want to get into the weeds about like how people are designing quantum algorithms to break different kinds of cryptography. If you're just interested in quantum computing, the book Quantum Computation and Quantum Information by Nielsen and Chuang is fantastic. And if you really want to be profoundly inspired about these problems in computational complexity and quantum computing and things like that, I could not more highly recommend anything than the book Quantum Computing Since Democritus by Scott Aaronson.

Jennifer, I can't thank you enough for joining us today.

Oh, it's been my pleasure. Thank you so much for having me.

And now we are at time. Thank you very much for listening and of course for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton_Chuvaikin and _TimPico. Tweet at us, email us, argue with us, and if you like or hate what you hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Thank you, Roni.