Podcast | Quantum Threat Modeling at DEF CON — with Mark Carney and Victoria Kumaran of Quantum Village

Mark Carney: We’re hoping to do our first throng of threat-modeling sessions because we realized that a lot of the conversations we’re having with quantum technology companies would be better had if they understood what the potential threats against quantum technologies are.

Konstantinos Karagiannis: Ah, August in Vegas — an intense but dry heat, and the setting for DEF CON, the world’s leading hacking conference, 32 years strong. Nestled within the show is Quantum Village, now in its third year. I’ll be speaking there once again, and the gang and I will also provide numerous ways you can get hands-on with quantum computing and related security tech and techniques.

Learn about some of the fun we have on deck in this episode of The Post-Quantum World. I’m your host, Konstantinos Karagiannis. I lead Quantum Computing Services at Protiviti, where we’re helping companies prepare for the benefits and threats of this exploding field. I hope you’ll join each episode as we explore the technology and business impacts of this post-quantum era.

Hacker summer camp is once again coming soon if you’re listening to this when it posts. Our guests today are the dynamic duo behind Quantum Village. You know them and love them from last year: Mark Carney and Victoria Kumaran. Welcome back.

Victoria Kumaran: Hello.

Mark Carney: Thank you very much for having us. Wonderful to be here.

Konstantinos Karagiannis: This is terrific. I’m always excited when summer approaches, and I know I’ll be with my black-T-shirt-wearing brethren and sisters over there. Good times coming. But for newer listeners, those who haven’t been in the hacker world for many years, can you give them a description of what DEF CON is, just in case they didn’t hear the old episode?

Mark Carney: DEF CON is one of the largest gatherings of hackers in the world. The summer camp itself attracts nearly 40,000 hackers. It’s composed of three events: There’s an event called Black Hat USA, which is quite industry-focused — cybersecurity for the CISOs, for developers, for the more enterprise-level clients. There’s BSides Las Vegas, which is a fun side conference that lets people showcase the more unusual work they’re doing. Then there’s what is for us the main event, which is, of course, DEF CON, which is in its 32nd year this year.

Konstantinos Karagiannis: It’s crazy. I feel like I’ve been every one of them. It’s not true, but I’ve been to a lot. That’s great.

We’re going to be in the third year of Quantum Village. How has this subfaction of spooky action in the desert, if you want to call it that, evolved?

Mark Carney: Well, certainly since last year, when we spoke to you, we’re now formally a 501(c)(3) nonprofit, so that’s always a nice goal to finally hit. We have recently joined the QEDC, which is the economic-development consortium in the U.S. We’re branching out as well into Europe and the U.K., slowly but steadily. The whole idea is to grab the attention of hackers around and bring them into the quantum realm, and the upcoming quantum technologies we have arriving on our doorstep.

Konstantinos Karagiannis: Last year was amazing. I had so much fun. I really enjoyed it. It was fun speaking there. It was fun getting pulled into a panel with about three and a half seconds’ notice. Thanks for that, Mark. That was good. No, I really loved it. I loved seeing how more and more people crowded in as the weekend wore on.

Mark Carney: It was quite impressive last year because in our first year, we were next to the AI Village in our positioning. In order to get there, you had to go past us. We got a lot of footfall that way. Last year, we were well out of the way. You had to go to Harrah’s, go to a magic show, go to the end of a corridor. You had to go past exciting villages like the Social Engineering Community and the Hardware Hacking Village. Then, eventually, you got to the Quantum Village, and we still had a line out the door because of fire regulations and things.
This year, we’re incredibly central. In fact, we’re right opposite the AI Cyber Challenge DARPA semifinals, which should give us even more interested people who are going, “What’s that thing over there, because they’re hacking robots and AI machines and doing all sorts of things. What’s happening in the quantum realm?” Hopefully, we’re going to be able to answer that question for them.

Konstantinos Karagiannis: That’s terrific placement. I’m excited about that. As I believe you tweeted not too long ago, we’re not going to have AGI probably without some kind of quantum connection. I agree on that. That’s a whole other topic we can dig into one day.

I love that the synergy is going to be there, and we’re going to get more foot traffic without me wearing any weird showgirl headdress and walking around trying to get attention. The folks will just find us.

DEF CON always has a theme. Do you want to share that theme? And is there a theme for the Quantum Village?

Victoria Kumaran: One thing to point out as well is, for the first time, DEF CON is going to be under one roof. It’s grown so big that instead of spanning lots of hotels, it’s going to be at the Las Vegas Convention Center, which is where conferences like CES take place and so on. We’re really centrally located. The theme this year is Engage, but their bigger, encompassing theme is Y2K. A lot of people have given us feedback. Fortunately, we were already, obviously, looking at the Y2Q theme. We’ve already got the merch of Q days coming and so on. Our theme is going to be From Y2K to Y2Q. We see it as a nice avenue for bringing in different technologists from different eras, from different genres, into the quantum space, into finding out how it applies to them.

Until now, you have a lot of commercialization. You’ve got the research, you’ve got the academics, buzzing with all this stuff that’s quantum. But in the real world, apart from the 101 guides or clickbait that’s out there, there isn’t too much that’s quite tangible for a technologist. There isn’t too much for them to get hands-on. That’s where we’re taking that theme and running with it to help people decide, what do they want their Y2Q to be? We don’t believe it’s all doom-and-gloom.

Konstantinos Karagiannis: My first DEF CON was right after Y2K didn’t happen, we could say. The lights were still on. I was at the Alexis Park Resort, and that was certainly under one roof, with people spilling out into the pool because they literally couldn’t fit anywhere. It’s full circle now. Here we are, many years later. What are some of the activities attendees can expect to enjoy within what Quantum Village is going to encompass there?

Mark Carney: We’re having talks again this year. We’ve had two years of stellar quality talks.

Konstantinos Karagiannis: Oh, thank you!

Mark Carney: Not just yours, although yours has been a highlight for a good number of people. For those who don’t know, Konstantinos gave a great talk on hacking quantum advantage using classical processes, putting in amazing work through tensor networks, which is this idea of using quantum information to do computing better with all that quantum hardware.

This year, we’re shaping up to have more introductory material of all kinds. We’ve got talks that let you experience some in-depth people going through some amazing mathematics and theories all the way through to talks that will hopefully elucidate more about how the technologies are being built and how they’re being broken just a little bit.

We’re also looking to have our first zine, and we’re hoping to do our first throng of threat-modeling sessions because we realized that a lot of the conversations we’re having with quantum technology companies would be better had if they understood what the potential threats against quantum technologies are. We’ve heard a lot about how quantum is going to break everything, all the cryptography, or how it’s going to solve finance or it’s going to solve medicine. But in order to do that, you have to give it access to some privileged information, which means you’re putting a lot of sensitive bits into qubits. It’s looking at, how we can get people more aware of what the quantum stack looks like, and then using that as a gateway to help them get involved.

Konstantinos Karagiannis: If there’s anything we learned over the years, it’s that whenever new technology comes out, a little too much trust is usually put into it somewhere in some level of the stack. Web 2.0 is a great example of that. When you were finally able to start intercepting the traffic in Web 2.0, you’re, like, “They’re passing literally everything — every request you can get: everybody’s username, password, whatever. It’s all there — account numbers.

It is a full stack, like you say. This is the time for hackers especially to start taking a look at what that means. I love the interactive nature. I assume there’s going to be some way for folks to get involved — maybe walk up to a whiteboard or something. That would be cool.

Victoria Kumaran: We’re hoping to have interactive whiteboards, definitely. Whether they come through is another thing.

The nice thing we have going at the Village is different skill sets, and bringing that together — different quantum modalities, different approaches — and we’re hoping to have quite a few sessions. That’s definitely something that’s open to everyone. We’ve already got an exciting roster of interested parties — and even agencies — where we’re putting out the output from the sessions.

Konstantinos Karagiannis: Already, listeners should be getting a sense that this is not your typical quantum conference. Those are fine for what they do. They have a place for vendors to show what they’re up to and give demos and then have coordinated talks to show what each company’s up to. But that’s not what DEF CON is at all. DEF CON is about digging in and, frankly, ripping apart technology and getting under the hood.

In this case, we’re peering into the soul of the universe, if you will. This is a unique thing, and I want to impress that on everyone — if you can make it to one hacker show, or a quantum show, make it the one that combines both of those elements. It’s amazing. Last year and the year before, there were capture-the-flag contests, and I’ll let you talk about what that means in general. But this year, it turns out the one you’re running is part of DEF CON’s official capture-the-flag events.

Victoria Kumaran: We’re getting an upgrade. We’re an official contest. In one sense, it’s a little nerve-wracking, but on the other hand, it’s going to be incredible and exciting because before, we just advertised within the Village, whereas now it’s a formal contest. The stakes are upping, and we are expecting even more people who are outside that typical quantum-technology sphere to be coming in and peering in. We’re very grateful for our partners within quantum-computing companies, quantum-communication companies, that are also contributing. We’ve also got professors — academics that are coming to help support.

Konstantinos Karagiannis: Could you give an idea of what that looks like, participating? You can even give an example of what last year looked like and what you hope will change this year — something to set the stage for people who’ve never seen one.

Mark Carney: A capture-the-flag is how hackers learn in many ways. It’s problem-based learning par excellence. Essentially, you have a game server where you connect, you sign up. You can then log in, you can join a team, you can just go by yourself, and then you’re presented with a wall of challenges, and with those, you can decide, “I’m going to go for this challenge because it’s 10 points” or “I’m going go for this other challenge, which is 300 points,” say. The idea is, the more points, the more difficult it is. It’s all about trying to get flags.

For example, one thing we are doing this year for QKD challenges is encrypting the flag, which is a little string that tells you, “I was here. I definitely hacked it.” We’re encrypting the string with a quantum key — well, not quite. It’s somewhat simulated, but the idea is that we can give people a sense about what quantum key distribution is really about so they’ll learn by actually doing it.

That’s one of the challenges that we’re setting up this year. Other things we’re looking at doing are challenges around all areas of cybersecurity with quantum, and learning about quantum computing, and a few fun ones as well.

Last year, we had a picture round where we had, at the time, Dolly or GPT4. It was about imagine what different physicists would look like, and you can tell how big the data sets were for different popular scientists because some of them really looked like what we were hoping they would look like, and then others were, like, “I wonder which one that is.” We’ve had some real fun with it, so we try and make it appealing and engaging. The idea is that people will have an interesting and fun experience whilst also learning. We don’t push a textbook — we don’t push a particular course or particular Python library. We try to keep it as agnostic as we can because that way, you can learn in a way that suits what you’re interested in, and then that will open up, we hope, doors for people to learn even more.

Konstantinos Karagiannis: If you do that again, with generating the photos, I’m going to give a super-deep nerdy physics reference right now: Who’s the scientist that if you ask the machine to generate an image of them, it would probably be guaranteed to fail? If anyone out there knows, they can write to me. It’s really deep. Maybe I’ll give the answer at the end of the show. Cool — that makes it interactive.

Now, speaking of interactive, we’re posting this to give folks enough time to make some plans to attend. Is it too late to get involved more interactively? Can people hear this mid-July and then say, “I want to do something at Quantum Village. What can I do?” It’s probably too late to pitch a talk at that point, but they could maybe participate in some other way.

Mark Carney: Unfortunately, they probably are too late to pitch a talk, but we’re planning on keeping the call for challenges for the capture-the-flag. If you want to be a quantum quiz master, there’s a good chance we’ll have that open, because I close that quite close to the event to give people a chance to give me their quizzy questions for the capture-the-flag competition.

Other ways they can get involved include, of course, coming along — turning up and attending the conference and being part of what is a lovely community of brilliant technologists who want to engage with each other and talk about this incredible potential future of technology. We want people to come and listen to our talks, take part in our workshops. We also want people to get involved in our Discord as well. In case you can’t attend, we’re hoping that almost all the capture-the-flag this year will be available remotely. There’ll be some things where we want to tie it into some physical devices at the village, but that shouldn’t preclude you from having a good time and earning a load of points remotely.

Konstantinos Karagiannis: If, every once in a while, one of the talks is slightly over your head, if you’re an attendee, you can always load the Hacker Racker app and go hear one of the main-track talks that might be a little more accessible for an hour in return. People can take a break if it’s not their thing. DEF CON is where all the big talks happen. That’s where the Jeep was hacked. That’s where folks cracking e-book encryption were dragged off the stage by FBI agents. It’s a lot of fun to be had. Come, and bring your bail bond.

Mark Carney: Did you need one for your talk a few years ago?

Konstantinos Karagiannis: No. I never broke a single law when I went onstage. Of course, listeners might note that we all know each other and we’re making lots of jokes here, but it is a terrific show.

Are there any significant talks we can describe here via teasers?

Victoria Kumaran: We have two virtual-ish talks — one from someone who’s quite infamous in the quantum hacking space. It’s one of those things that you never know — life can pop up — so hopefully, it all goes smoothly. Then, also, there’s someone from the legal perspective. That’s one thing to note with our schedule: Each year, we do try to come outside of the classic cybersecurity area, outside of the hacking space, outside of the quantum 101 space, be it on computing or quantum information theory. Then, we also try and delve more into the social aspects. Certainly, policy is very important — getting lawyers, for instance: We’re hoping to have our first legal professionals giving their perspectives because they’re always very important as well, and have a very different lens and can help navigate through a lot of these fields and how it implies with policy. That’s something we want to dig in a little deeper.

We’re going to have our debates back as well — even things like around ethics. I always worry about saying that we do quantum ethics. It’s more about looking at the question and already, in cybersecurity, in the hacking space, what the term “ethical hacker” means. There are a lot of people in the audience at DEF CON who will have a good insight and a good value to add to these conversations.

Konstantinos Karagiannis: On that note, one of the people speaking will be yours truly. I’ll be talking about the hacker’s guide to post-quantum cryptography. Of course, most people don’t know how post-quantum cryptography works and certainly don’t know about the attacks that have been leveled against it and how it’s held up and things like that. I’ll be speaking on Friday evening, August 9, in Vegas, and it’s going to be so great.

I plan on attending every day till I die. If you guys stop doing Quantum Village, my ghost will just be roaming the halls looking for it or something. That’s what I’m planning on.

I’d love to discuss some of the things you’ve been putting on the Quantum Village site, which, of course, will be in the show notes. Can you talk about some of the latest things we’ve been publishing? You teased one of them already earlier with the concept of threat modeling.

Mark Carney: One of the things we published was an opening salvo, talking about what “threat modeling” means and trying to aim it at an audience that isn’t cybersecurity, but is still quite technical. A lot of that’s motivated by bugs we’ve reported and responses we’ve had where we can see that people have a particular view of what they’re doing that might be better-informed if it could have a slightly wider vision, a wider awareness about what the threats to quantum are. We have lots of models, like the stride model and the dread model, and other cybersecurity paradigms that you can google to see where they came from. But quantum physicists sitting in a lab tend not to think about that too much. They tend to go much more for “I just want to make this work.”

How do we go from having potential issues in quantum technologies — what will become quantum products — and how do we mitigate those? Earlier on in cybersecurity, we talked a lot about shifting-left, or left-shift, issues. That takes its name from the kanban board in agile development, where you want to put things for cybersecurity on the design side, on the left-hand side, rather than on the production side, on the right-hand side. The idea there is, it’s much harder to fix things in production than it is to fix it whilst you’re building it.

It’s also raising the awareness of, what is the supply chain in quantum computing? What does that look like? Who are the suppliers? How can we work with them to get better awareness so we could improve these solutions as they trickle down through the companies and then into real product offerings? That’s one thing we’re keen to do. The interest we’ve had from a few agencies, from a good number of companies — both quantum startups and very large enterprises — we are very much hoping we can talk a lot more about at the event. Nothing’s quite set in stone yet, but we’re excited with who’s interested in what we’re doing — who’s coming along to take part.

That’s going to be one of the more interesting outcomes from it because what we want to do is capture that data and present it to the community of quantum technologists and quantum hackers alike so that a quantum-computing company, say, can go, “What is our threat model?” “Here’s a guideline. Here’s what all the hackers at DEF CON 32 thought.” Now you can use it as a jumping-off point to inform your own activities because it’s always easier to fix something that’s not quite right than it is to start from scratch on a blank sheet.

Konstantinos Karagiannis: That’s great. I like to see this kind of stuff. Last year, you did the whole thing about other ways that quantum can push fraud, potentially, in the future — and would be used in that way. It shows you at a glance what that DEF CON ethos really is: “We’ve got this technology. What other crazy stuff — potentially dangerous stuff — can we do with it?” And it’s better to make the awareness.

That was one of the things that instantly impressed me back when we first all started talking. You’re perfectly lifting DEF CON and implanting that entire aesthetic inside of this world. I loved it. That’s why I wanted to be a part. We have our own little communication channel. Of course, we talk on Signal. We talked about Penrose’s theory of quantum consciousness. We talked about conservation of energy between universes and the many-world interpretation. Stuff like that comes up in there. It’s wild, but what are ways we can make Quantum Village more of a community all year long for everybody who wants to be part of it?

Victoria Kumaran: We’re available on all the social media channels. We are starting to broaden the scope of the projects we’re doing. If people want to get involved with threat modeling and people want to look at our different open source projects and want to contribute or want to take it on to the next level, we are here and ready and waiting.

Also, to follow on with what you were saying about DEF CON and the threat modeling, if there are, say, quantum physicists listening or people on that quantum-computing side, we’re an open space. There are a lot of people from a lot of the big companies that are already in existence, and it only gets bigger and more powerful with more people and different perspectives. We want to be that space. Hence, we do the debates. We’re looking at taking that outside of Vegas because Vegas is great, but not everyone wants to go to Vegas. Between that, we’re trying to figure out ways, certainly in the U.K. as well, and in Europe, where there is that demand of like, Can you bring this, because I can’t go to the desert every year,” so we’re trying to do that as well.

Konstantinos Karagiannis: What I want people to realize, with everything we just talked about — like the threat modeling — is that this is still a space where you can make a name for yourself. There have been hundreds of Wi-Fi hackers and IoT hackers. This is still a space where you can find something in that stack that’s vulnerable. You can come up with a new approach.

You have to take a look at what’s going on in the Quantum Village because that’s where these kinds of opportunities are going to rise for folks to rise to stardom. You have to come and debate me or come up to the whiteboard, if you’re brave, and write something there for us — that would be terrific. I want to emphasize that.

Before I ask you the next question, I’m going to tell everyone which physicist that if you create an image of them, you’re going to probably break the machine itself. That would be Wolfgang Pauli, because he was notorious for the Pauli effect: Anytime he would enter a room where advanced machinery was running, it would break down, and no one knew why. Pauli was a weird guy, and he was into all sorts of stuff like synchronicity and things, but for some reason, the Pauli effect would just destroy hardware. Be careful if you generate an image of Wolfgang Pauli — I just wanted to throw that out there. I thought that would be fun to bring up.

What advice would you give folks who want to be quantum hackers, besides what I just said? Go to the Quantum Village, obviously.

Victoria Kumaran: That might have to start with checking out our zine, which we’ll have available at DEF CON. We’re hoping to have an online interactive version as well as a physical copy. We’re still open for collaborators or companies that want to get involved in that as well, specifically around getting that expertise and that knowledge exchange.

In terms of hackers, if they’re coming from the classical side, there’s already a lot of material in terms of education out there. We don’t try to reinvent the wheel when it comes to quantum information theory, but we are trying to decrypt some of it because a lot of it tends to be that vendor pitching, sales pitching, pay-to-play documents — very dense academic materials that you don’t always have time to decrypt. You want to learn a bit before you want to commit to that.

We do have good videos. We are putting together a list on our website, and there are a lot of good books that are coming out. There are books by Nicole Halpern, who works at NIST. She’s a phenomenal professor, and she created a book called Quantum Steampunk. For someone that’s not necessarily convinced about quantum, she goes back to the Victorian era and contextualizes it.

Sometimes, reading a book like that can help give you that story as to why it matters about computing. She’s a specialist in thermodynamics, that sort of thing. She’s looking at all these bigger concepts and drawing them in. I think she even narrates the story of bobbing around the U.K.

Mark, you’ve probably got some good ideas from a more technical perspective.

Mark Carney: The biggest thing is to have no fear. From the stories we’ve had, like doing the quantum capture-the-flag, in particular, the first year, there was a slightly older gentleman who turned up, and he was, like, “I’m not clever enough. I’m not smart enough to do this.” I’m, like, “Oh, have a go.” “No, I’m not smart enough. I couldn’t possibly do it.” “No, no, no, just have a go.” “No, I couldn’t.” And I just went, “Bloody have a go.” He was, like, “Fine.” He gave in, totally expecting he wouldn’t be able to achieve anything, and he placed 19th out of 50 in the competition, which is respectable.

There are lots of stories like that. You can make a lot of this very complicated. You can get into the very deepest mathematics of the various physical systems that are going on. But you can also understand quantum information from a fairly high school perspective, like linear algebra, which is complex on incredibly well-behaved matrices. They sound scary, and then you just do some work with them and then you can get into it.

If you want to learn it from that point of view and then go into the physics, that’s another route. Or if you just want to focus on the classical stuff — the majority of a quantum computer isn’t the incredibly cold, incredibly empty box in the middle. It’s all the classical circuitry, cloud queues, compilers. There are a lot of other technologies we do understand very well and understand how to hack very well that are involved in building a quantum computer.

There is something for everyone’s expertise, and we need more people to bring that diversity of backgrounds into quantum tech because that’s how we’re going to build more robust and more production-ready systems. That’s how we’re going to get to the advantage sooner, when the advantage can’t be done away by someone accidentally tripping on a cable three rooms down or something, there’s a whole load of work to be done. As you’ve already alluded to, there’s a whole wealth of heroes to be made from finding ways of doing things that haven’t been done before.

Quantum information has shown us a new and interesting way of doing computing, which is so exciting, and it’s so different when you get your head around it, or you start to. I always think I’m never doing enough sometimes, but when you start getting your head around it, it’s an exciting way of thinking. Hopefully, if you just start and get into it and go for it, you’ll be amazed at where you get to. My big recommendation would be, don’t have any fear of it.

Konstantinos Karagiannis: Yes. If I could think of one classical attack you probably don’t want to try against a quantum computer, it would be the screwdriver attack, because if you open that thing up, you’re done.

Mark Carney: Yes. You’re probably having a bad Tuesday.

Konstantinos Karagiannis: Mark and Victoria, thank you so much for coming on again. I can’t wait to see you soon in person. And listeners, come and join us for a great time in Vegas.

Victoria Kumaran: Absolutely.

Mark Carney: Come and join the quantum hackers.

Konstantinos Karagiannis: Now, it’s time for Coherence, the quantum executive summary, where I take a moment to highlight some of the business impacts we discussed today in case things got too nerdy at times. Let’s recap.

DEF CON is canceled this year. It’s an old joke I couldn’t resist. Actually, it’s very much on — in its 32nd year, now in a bigger space: the Las Vegas Convention Center. Mark and Victoria are about to host the Quantum Village, there for the third year in a row. If you’re a longtime listener, you’ve heard about this show and the Quantum Village before.

Quantum conferences are great but can feel somewhat similar. There’s something special about having a gathering like the Quantum Village that is so hands-on, and surrounded by the world’s largest hacker conference. This unique experience is not to be missed. Like in past years, there will be talks, workshops and a capture-the-flag competition. This hacker challenge is one of the official DEF CON CTF events this year, so we expect even greater participation, and you don’t need any real experience to participate. Check it out and see. This year’s overall DEF CON theme is Engage, and the Quantum Village theme is From Y2K to Y2Q. There certainly are a lot of parallels we can draw there, as you’ve heard on this show before, when we’ve talked about Y2Q. Expect some good coverage of quantum threat modeling, too, which is an overdue discussion area. The security around QIS may be a place for new hackers to make a name for themselves.

I will present a hacker’s guide to post-quantum cryptography, among the many talks. You can also join us for interactive panels and activities. It’s not too late to join us in Vegas if you hear this as it first posts. DEF CON 32 is August 8–11, 2024, and if you’re listening in the future, DEF CON 33 is not canceled.

That does it for this episode. Thanks to Mark Carney and Victoria Kumaran for joining us to discuss DEF CON’s Quantum Village, and thank you for listening. If you enjoyed the show, please subscribe to Protiviti’s The Post-Quantum World, and leave a review to help others find us. Be sure to follow me on all socials @KonstantHacker. You’ll find links there to what we’re doing in Quantum Computing Services at Protiviti. You can also DM me questions or suggestions for what you’d like to hear on the show. For more information on our quantum services, check out Protiviti.com or follow Protiviti Tech on Twitter and LinkedIn. Until next time, be kind, and stay quantum-curious.