Interview by Scott Hanselman, recorded for Hanselminutes in association with ACM ByteCast. Published 2026-10-15.

Charles H. Bennett and Gilles Brassard, recipients of the ACM A.M. Turing Award for foundational contributions to quantum information science, discussed the origins of their collaboration, the role of fundamental research, the history and state of quantum cryptography, the threat that quantum computers pose to current encryption, and the implications of artificial intelligence for research.

How the collaboration began

Bennett and Brassard met at a conference in Puerto Rico in 1979. Brassard was a computer scientist working on cryptography. Bennett came from physics, specifically the physics of information. At the conference, Brassard spoke on cryptography and oracles, topics that Bennett had also studied. Bennett had submitted a paper on oracles to the same conference. The paper was rejected, but Bennett attended Brassard's talk and described its contents to him.

Brassard said the exchange showed that the two fields were far more separate at the time than they are now. Bennett said he had known about an information-behavior phenomenon for almost 20 years but had not treated it seriously. Brassard told him it connected with cryptographic ideas and suggested they write a paper. Brassard also noted that the other physicists Bennett had described the phenomenon to found it interesting as physics but did not pursue it.

Brassard and Bennett both described the collaboration as the product of two fields meeting, not only two individuals. Brassard co-authored the random oracles paper with John Gill, who was not present at the 1979 meeting.

Fundamental research

Both researchers said fundamental research must be encouraged and funded. Bennett defined fundamental research as curiosity-driven work with no expected practical use, undertaken to understand nature. He cited the development of relativity by Albert Einstein and quantum theory in the early 20th century as examples. Their discoveries transformed society decades later.

Bennett stated that electronic computers would not exist without quantum mechanics and that quantum theory appears in almost every device in use today. He concluded that fundamental research is essential for science to continue and for practical applications to follow, although the timing and nature of those applications cannot be predicted.

Bennett also argued that research driven by a specific target tends to miss discoveries that later prove important. Applied research does produce results. He cited the work at IBM, which addressed electromigration by replacing aluminum with copper.

Number theory illustrates the point. Brassard noted that number theory was long regarded as among the least useful areas of mathematics and was called the queen of mathematics because of its beauty and apparent uselessness. In the mid-1970s, the RSA and Diffie-Hellman methods made number theory central to cryptography. Brassard stated that this cryptographic reliance will fail once quantum computers are available.

Problem-solving and serendipity

Brassard described his work as both problem-driven and exploratory. He pursues specific problems with students and sometimes finds solutions. His most important discoveries with Bennett and others came through serendipity.

Quantum teleportation emerged while the researchers were working on a different problem. They were not seeking a method of teleportation. Quantum cryptography also arose from serendipity. Brassard said he did not set out to apply the underlying ideas to cryptography. The applications appeared as the researchers pursued the ideas they had started with.

Invention or discovery

Asked whether they invented or discovered their protocols, both declined to treat the question as meaningful. Brassard called it a silly question but said it was not inappropriate. He compared it to the hypothesis that a law-governed universe is a computer simulation. Brassard described a paper of his on the simulation question, published in the Proceedings of the Royal Society of London. He noted that the scientific claim it supports is limited to the equivalence of the real world with its possible simulations.

Origins in information theory

Bennett said he first encountered the central phenomenon from his late colleague and classmate Stephen Wiesner. Bennett described it as a feature that Claude Shannon and Alan Turing, the founders of information theory, had omitted.

The phenomenon involves multiplexing two messages into a single form. A receiver can obtain one message, but doing so destroys the other. The receiver can choose which message to obtain, and neither the receiver nor the sender knows which one was chosen in advance. Bennett stated that information theorists had assumed they understood information fully. Wiesner, a physicist, showed that some information cannot be copied and is disturbed when read.

Bennett said the property can be used as an advantage. He cited a self-destroying multiplexed message as an example. He said that social applications promising message deletion require users to trust the provider to delete messages.

Bennett and Brassard said that information theorists and quantum optics researchers initially dismissed their explanations. Bennett described this as arrogance on both sides. The two fields were brought together through the collaboration.

Quantum cryptography in practice

Bennett and Brassard stated that they built the first prototype of quantum cryptography about five years after inventing the protocol and exactly 10 years after their meeting in Puerto Rico. Neither described himself as an experimental physicist. Brassard stated that he has remained in contact with experimentalists implementing the protocols.

The following developments were cited:

Brassard reported that the most recent figure he had heard was 5 million users of quantum cryptography in China. He had visited China a few weeks before the interview. He met Pan Jianwei, a leading experimental researcher in quantum cryptography, and discussed his recent results. Brassard did not visit the laboratories.

Bennett stated that the decoy-state BB84 protocol was deployed over 1,000 km in satellite-based experiments. Brassard confirmed that these experiments are about 10 years old and stated that the technology has improved. Smaller and more capable satellites are now in use, and more of them are deployed. Receiving stations on Earth have shrunk. Earlier stations required several months to build. Brassard said a current station can fit in a truck and be deployed within hours.

Post-quantum cryptography and quantum cryptography

Brassard distinguished the two fields. Quantum cryptography, which he and Bennett invented in 1983 or 1984, uses the laws of physics to establish a secret key. Its security rests on physics, provided the apparatus is built correctly. Post-quantum cryptography uses classical techniques to achieve the goals of RSA and Diffie-Hellman, with the aim of resisting quantum computers.

Brassard said post-quantum methods cannot be proven secure. He stated that they can be broken by unlimited computing power, whereas quantum cryptography cannot. He described post-quantum cryptography as based on beliefs and wishful thinking.

Brassard noted that classical cryptography, except for the one-time pad, is provably insecure. Classical systems are secure only if certain hard problems remain hard. Factoring was long considered hard, but quantum computers can factor efficiently. Brassard said post-quantum systems rely on newer problems that have not been studied for centuries. He stated that these systems have no established security basis.

Bennett said Brassard's statement overstated the case. He noted that post-quantum researchers seek problems that differ from factoring. If one-way functions exist, and if P differs from NP, some of these problems could be hard for both classical and quantum computers. Bennett stated that this has not been established.

Brassard also stated that quantum cryptography does not solve every problem. Digital signatures and public-key cryptography, which allow parties who do not know each other to verify identities, are difficult to achieve with quantum cryptography alone. Brassard said post-quantum methods may address these needs even though their security cannot be proven.

Harvest now, decrypt later

Brassard identified the main reason for concern as the "harvest now, decrypt later" approach. Adversaries can intercept and store encrypted internet communications. They cannot decrypt the data today. Once a quantum computer becomes available to them, they can decrypt stored communications retroactively.

Brassard stated that RSA and Diffie-Hellman were the dominant public-key tools used for encrypted web communication for decades. Both are vulnerable to quantum computers. Brassard concluded that data already transmitted cannot be protected against future decryption. Only future communications can be protected, through quantum or post-quantum methods.

Brassard stated that quantum cryptography is secure against an adversary with unlimited computing power and technology, but only under two conditions. Quantum theory must be correct, and the system must be implemented correctly. Brassard said that correct implementation is difficult and that neither condition is guaranteed.

Brassard said post-quantum cryptography, adopted today, would not protect communications sent before the transition. Information encrypted with post-quantum methods could also be broken later and decrypted retroactively.

Brassard stated that the main advantage of quantum cryptography is resistance to harvest-now-decrypt-later attacks. An eavesdropper who exploits an implementation weakness must do so while the communication takes place. Nothing remains for the eavesdropper to attack afterward. Brassard quoted Norbert Lütkenhaus of the University of Waterloo: "the key will remain as safe for eternity or forever as it was immediately after transmission."

Bennett stated that the most valuable property of quantum cryptography is that adversaries cannot store data and decrypt it later. He noted that a weakness discovered 10 years after transmission would come too late to matter for keys that were already secure at the time of transmission.

Bennett also described a proposal, which he presented as a facetious remark, for dealing with stored communications used for blackmail. Publishing multiple copies of the information would reduce its value to blackmailers.

Timeline and urgency

Brassard stated that the threat is already relevant. Stored communications can be decrypted once a quantum computer exists. The possibility that a sufficiently powerful machine already exists cannot be excluded. Brassard compared delayed action to delayed response on climate change.

Brassard declined to predict when a quantum computer capable of breaking current cryptography would become available. He stated that progress over the past few years has been rapid. Fifteen years ago, dismissing the possibility was defensible. The previous two or three years, in Brassard's view, mark the start of a steep increase in progress. Bennett agreed that technological progress has been extraordinary but also declined to give a date.

Asked for practical guidance, Bennett advised against saying anything that could cause embarrassment if disclosed. Brassard advised against trusting the current infrastructure and stated that anything posted on the internet may become known in the future, although the timing is unknown. Brassard added that people who want protected conversations could use quantum cryptographic equipment.

Artificial intelligence and interactive proofs

Bennett said that AI threatens research roles more directly than earlier automation because mathematicians and theoretical physicists regard proof-building as among the most demanding human intellectual work.

Bennett illustrated his view with interactive proof theory, a branch of theoretical computer science. Complexity classes such as P, NP, and PSPACE classify problems by the time or space needed to solve them. Interactive proof systems involve two participants. Arthur is honest but computationally limited. Merlin is computationally unlimited but untrustworthy.

Bennett stated that a central result of the theory shows that if Merlin and Arthur interact for a polynomial amount of time, Merlin can convince Arthur of the truth or falsity of any question that Arthur could solve alone using polynomial space. This class of problems includes many problems of interest to mathematical physicists. Bennett noted that the model is unrealistic because Merlin is assumed to know everything. Arthur's ability to ask adaptive questions, which expose lies within polynomial time, provides the power.

Bennett described a more recent result connected to quantum computing. If two entangled quantum provers, which cannot communicate with each other, replace the single Merlin, and Arthur remains classical and polynomial-time limited, the provers can convince Arthur of the halting behavior of any Turing machine. Bennett said this result was proven about six years before the interview.

Bennett used Goldbach's conjecture, which states that every even number greater than two is the sum of two primes, as an example. No proof exists, and no counterexample has been found. If the conjecture is false, two quantum provers could prove the counterexample to Arthur within a limited time, and Arthur could verify the proof. If the conjecture is true, the provers could not convince Arthur that no counterexample exists. Bennett stated that the provers' knowledge does not make their claims credible to Arthur. Arthur can verify only what the proofs establish.

Bennett applied the model to AI. He said users should not trust what an AI system says but can rely on its ability to help establish truth, as long as they ask questions that expose falsehoods.

Bennett and Brassard noted that Shafi Goldwasser and Silvio Micali received the Turing Award in 2012 for the invention of interactive proofs. Brassard stated that László Babai invented interactive proofs independently but did not share the award. Brassard added that the award also recognized cryptographic applications. The speakers noted that IP = PSPACE was established after the framework was developed. They did not confirm the order in which the Turing Award was given relative to that result. Bennett stated that this is an active area of theoretical research and that a newer result may receive an award in the future.

Bennett stated that machines take over less important parts of research work and that researchers should learn to question machine output without being misled by it, while still benefiting from its help.

Scott Hanselman compared the approach to an episode of Star Trek in which Captain Kirk uses the liar's paradox to defeat an android that claims everything Harry Mudd says is a lie. Bennett and Brassard did not respond to the comparison.