Hello, good evening. Thank you, Gilbert, for the introduction and for the invitation. It's particularly nice, actually, to be at SOAS. Not that I have ever taken a class at SOAS or taught a class, but for a long time and throughout my university years, some of my closest friends were students here. So it does feel like coming to a familiar place. And thanks to all of you for being here. And braving the weather. It feels very cold. I don't think it's an exceptionally cold evening, but I think coming from Cairo, it feels very, very cold. My lecture will deal in the main with old concerns, questions that have occupied me with varying degrees of urgency for many years. How to exist as an artist, or put another way, how to protect one's work from history, how to keep it conscious of the present, attentive to the present, yet guarded from public service. I must stress that I'm approaching this very much from the point of view of a novelist. And therefore, my musings and questions will have an improvisational and personal temperament. To consider the question of the novelist in history, I am going to observe other authors, namely Ovid or David Matloof's Ovid, Albert Camus and others. I want to examine the experiential life of the novelist as both artist and citizen. To explore the ongoing concern I have of how an artist can create during a time in which current events intrude into his or her imagination. It is perhaps one of literature's most cruel stories that Ovid, or Publius Ovidius Nassau, author of Metamorphosis, a work about persons and animals and things transformed and therefore separated from their true physical identity, should have become himself subjected to an endless and cruel exile from his wife, his country, and everything that he knew. Ovid was 51 when this happened, already well known for his reputation as a poet established. He had committed a karmine et erar, a poem and a mistake, which was the only explanation the poet offered for his banishment. This event, which informed everything Ovid wrote from this point on, took place over 2,000 years ago in 8 AD, the same year in which he completed the epic poem Metamorphosis, consisting of 15 books. He was at the height of his literary powers. His language, his method had never been stronger. Tomes, by the Black Sea, modern day Constansta in Romania, is where Emperor Augustus decided to send Ovid. Tomes had no library, no books, no paintings, no great architecture, and no theater. Its people did not speak a written language. Its landscape was harsh and bleak. Ovid was not only exiled from Rome, but also from language, from literature, culture, and the life of the mind. Notwithstanding his endless pleas to the emperor, he was never allowed to return. He died nine years into his exile in 17 AD at the age of 60. Ovid wrote two major works from his banishment, Trestia, a book-length poem which fulfills the ultimate exilic fantasy, a poem that returns in place of the author, and which he completed and sent back to Rome a year after arriving at Tomes in the autumn of 9 AD. The other work he completed in exile is Especialia Ex Punto, Black Sea Letters, and these two works Ovid sometimes addresses his friends, sometimes he addresses Rome, the city, sometimes he addresses his wife, and sometimes he addresses the dictator, Augustus. Or, as in the opening of Trestia, he addresses the poem itself. I'll read you the opening. Little book, no, I don't begrudge at you. You're off to the city without me, going where your only begator is banned. On your way then, but penny plain as befits an exile, sad offering and my present life. For you, no purple slipcase, that's a color goes ill with grief. No title line picked out in vermilion, no sedder-oiled backing, no white bosses to set off those black edges. Leave luckier books to be dressed with such trimmings. Never forget my sad estate. No smoothing off your ends with friable pumice appear for inspection bristly, unkempt, and don't be embarrassed by blots. Anyone who sees them will sense they were due to my tears. Go, book, go and bring to the places I loved my greeting. Let me reach them with what feet I may, and if in the throng there's one by whom I'm not forgotten who should chance to ask how I am, tell him I live, not his well, but emphasize I only survive by courtesy of a God. For the rest, keep silent. If people demand more details, take care not to blab out any state secrets. A reader once reminded will remember the charges against me. I will be condemned in public by popular vote. Those such accusations may wound you, make no defense. A good for nothing case stands beyond any advocacy. Find one who sighs at my exile, who can't read those poems dry-eyed, and who prays but in silence lest the malicious hear him that Caesar's wrath may abate. My sentence, be lightened. Tristia and the Black Sea Letters contain some of the most powerful literature of political exile ever written. They explore the territory of dislocation, alienation, and estrangement. Ovid's longing brings to mind Edward Said's words that exile is strangely compelling to think about, but terrible to experience. Said's brilliant formulation that exile is a jealous state, that what you achieve is precisely what you have no wish to share because it has been so painful to earn, rings true, particularly when you note Ovid's haughty and eaked tone in the line, find one who sighs at my exile, who can't read those poems dry-eyed. And the letters, particularly his reoccurring appeal for mercy, his poetic begging to be allowed to return home. Exemplify what Simone V, the French philosopher, meant when she wrote that to be rooted is perhaps the most important and least recognized need of the human soul. David Maalouf, not a writer in exile, but a writer born out of exile. His Lebanese father and English mother moved to Australia, and he was born in Brisbane in 1934. In his second novel, An Imaginary Life, published in 1978, Maalouf takes up Ovid in Tomesh. The novel is written in the first person in the voice of the Roman poet. Maalouf doesn't indulge in trying to sound like Ovid or like a period poet, but rather assumes Ovid's intellect and sensibility with such artistry that Ovid seems so natural and contemporary. What sets Maalouf aside as an artist is that he is not satisfied by merely creating a curious musing on what life was like or might have been like for Ovid in his banishment by the Black Sea, but uses the poet's harsh fate to write a meditation about the civilized mind and nature, the tame and the wild, home and exile, and ultimately a meditation on language. What is the use of a refined, cultivated and complex language such as Latin when no one understands it? What is the use of writing if you are not read? How to approach the world now? And would this crisis of language and exile from a shared tongue provoke an older human language to emerge, a language before language, a forgotten, lost language? Maalouf takes the particular and isolating state, the jealous state of banishment, and extracts from it universal and timeless themes. A proposition made by an imaginary life is that exile is an nascent, in sepence state that is almost regressive, returning an adult to stages of infancy, but also exile as death and therefore part of nature. Exile, nature and language are connected in Ovid's life through Maalouf's book. Latin, the language of sophisticated and courtly Rome is the language that pronounced Ovid's banishment. The barbarian language of the Getai, the people now Ovid was living with in Tomesh, is earthier, more fundamental, more rooted in the physicality of agrarian life. But even more fundamental than this is a language of childhood whose quote from Ovid's book, every syllable is a gesture of reconciliation, end of quote. Ovid has learned this language under the tutelage of child, the boy brought up by beasts in the wild and that Ovid encounters in his walks.  His relationship with child enables, quote, a kind of conversation that needs no tongue, a perfect interchange of perceptions, end of quote. And as he approaches death, Ovid declares that, and this is of course from Ovid's book, quote, between our bodies and the world there is unity and commerce, end of quote. The poet's identity is being as a subject, separate and indistinguishable from everything else, dissolves into this unity of the body and the world around it in an annulment of all alienation and its concomitant desire. The novel ends with Ovid watching child, his guide into this new landscape moving ahead of him. He is walking on the water's light and as I watch, he takes the first steps off it, moving slowly away now into the deepest distance above the earth, above the water, on air. It is summer, it is spring. I am immeasurably, unbearably happy. I am three years old, I am 60, I am six, I am there. Ovid uses language and the imagination to remake the world, the world he remembers, Rome, from which he has been excluded and the new world he finds in his banishment. His exile excites his imagination, but it also limits it. One intention behind Ovid's exile was the desire on Augustus's part to retard the poem. It is the intention of most dictators for involved in the dictatorial project is the intent, either through fear, dispossession or alienation, to retard society and the individual. The extraordinary thing about Matluv's novel and imaginary life is how modern it makes Ovid and Ovid's condition. Not only modern, but also radical in the true meaning of that word, in the sense of relating to the root of things. And therefore it is hard to escape the suggestion that writers from Ovid from 2000 years ago till today have shared a fundamental crisis with society and the will of history. That writers have always existed intentionally or otherwise in opposition to power. The Swiss German painter Paul Clay compared the artist to the trunk of a tree and the work of art to the crown. Quote, from the root, the sap flows to the artist, flows through him, flows through, flows to his eyes. He does nothing other than gather and pass on what comes to him from the depths. He neither serves nor rules. He transmits. His position is humble and the beauty at the crown is not his own. He is merely a channel, end of quote. The tragedy of the modern artist Clay maintains in his essay on modern art is that the sap does not flow sufficiently from human roots. The participative life of the community. Artists suffer from social disunity, a sort of permanent existential exile. We have found parts but not the whole, he says. That the tragedy of which Clay speaks is exhibited in his own works. They are exquisite and refined, but they belong in their intense and wayward subjectivity to a private universe and thus contribute to the very schizoid tendencies that he deplores. This is not the plight of a single painter or of a few artists only, I'm suggesting. It is much more pervasive. There seems to be a profound maladjustment between the creative life and the existing social order. That, quote, the writer exists under siege, as W. H. Auden put it. Adorno echoes the sentiment in his essay on commitment which argues with references to Kafka and Beckett that it is not the office of art to spotlight alternatives but to resist by its form alone the course of the world which permanently puts a pistol to men's heads. End of quote, very optimistic. Artists are not necessarily outsiders and outsiders are not necessarily artists, of course, yet there is a point in history in which we could detect this gradual existential exile of the artist. It coincides with the romantic period of the 19th century when the individualistic nature of Western civilization became firmly established. The artist began to be seen as a bohemian and eccentric and impractical dreamer, perhaps a genius, but certainly not a normal, well-adjusted member of society. And it became fashionable to read external marks of nonconformity, dress or residence in an artist's quarter or unconventionalities of behavior such as infidelity. It became commonplace to read such eccentricities as superficial signs of an inward detachment and estrangement. More significant than outward nonconformity was the alienation exhibited in the artist's creative role. In England, for example, the following groups spring to mind. The back-to-nature prophets such as the lake poets, the romantic rebels against almost every form of authority such as Shelley and Swinburne, the mockers of convention such as Byron and Wilde, quote, a gentleman is one who never hurts anyone's feelings unintentionally, end of quote, or a man can be happy with any woman as long as he does not love her, end of quote, as of course Wilde. The religious critics of social materialism and mass standardization such as Blake, Ruskin and Carlisle, quote, the tree which moves some to tears of joys in the eyes of others, only a green thing that stands in the way. Some see nature all ridicule and deformity and some scarce see nature at all. But to the eyes of the man of imagination, nature is imagination itself and that's of course Blake. And the art for art's sake as such as Patter, Whistler and to a certain extent, I think Hopkins. The vast quote, this is Whistler, bemoaning. The vast majority of English folk cannot and will not consider a picture as a picture apart from any story which it may be supposed to tell, end of quote. And through this rebellion, the artist has attained a kind of freedom. All taboos are off, any style, any subject matter is now permissible. It is a considerable achievement, as Herbert Reed wrote, of modern art to have made the world tolerant, intellectually, if not politically, of variety. It would be foolish to suggest that all of these artists are outsiders but all exhibit some symptom of cultural estrangement. In his book, The Rebel about alienated artists and writers and through his lyrical and critical essays, the author Albert Camus invited the description of a moralist in the tradition, in the French fashion, in the sense that a moralist is a commentator on the human condition. Camus was born into a working class French colonial family in Alderaan in Algeria in 1913. And of course, for 132 years from 1830 to 1962, Algeria was under the French. Like the philosopher Jacques Derrida, Camus was also a pied noir or black foot, a term referring to French citizens of various origins who lived in Algeria and who were, to a certain extent, outsiders in Algeria and outsiders in France. He was a novelist, playwright and philosophical essayist. He was also a working journalist, expressing himself from day to day on questions of current affairs. He was intensely conscious of the nature of his duty as a writer and indeed of the function of writers in general. On this question, there had been a good deal of discussion in French literary circles. The old answers to amuse, to instruct, that's what writers do, to distract, to refresh, to depict another world more satisfying than this, to make people real to themselves by words, to turn a perfect sentence, to create the sentence in itself beautiful, meticulous seas, daffodils that come before the swallow dares, to set a chime of words, tinkling in the minds of a few fastidious people. These and the like were rejected as the delicate superfluities of a softer age. Modern conditions, we were assured, needs turner stuff. Writers were asked, no, commanded to plunge into the social and political battles of their time, to take a stand and to fight for that stand, in a word, to commit. Camus asks whether any man can ever be as sure as all that. He proclaims his own allegiance to the party of those who know that they are sometimes wrong. And even if men are so sure, he says, does their sureness give them the right to spill blood? Camus sees humanity at a crossroads. And on the signpost is the challenge, shall thou or shall thou not kill? The plea, although for peace, is not for what is generally called pacifism. Camus fought in the French resistance and agreed that there are occasions when violence has to be met with violence. His point is rather that in our time, the use of violence has become a recognized mode of public action, both usual and accepted as legitimate. Crimes of violence, there have been always. It is only in our time, he suggests, that they have become legal. Current ways of thought have turned the murderer into a judge and judges into murderers. Murder as a means, terror as an instrument of policy. These are the accompaniments and consequences, he suggests, of blind faith. The course of the world, according to Camus, or the logic of Camus' fiction, sorry, the curse of the world, according to Camus, or the logic of Camus' fiction, is the idealist. The writer akin to Camus in English is George Orwell. Both Camus and Orwell write clearly. Both Camus and Orwell know clearly the infamous thing to destroy. Quote, every line of serious work which I have written since 1936, wrote George Orwell, has been written directly or indirectly against totalitarianism, and for democratic socialism, as I understand it. It seems to me nonsense in a period like our own to think that one can avoid writing of such subjects. Orwell wrote this in 1948. In the same year, Camus wrote these words. The 17th century was the century of mathematics, the 18th of the physical sciences, the 19th of biology, our century, the 20th century is the century of fear. And he proceeds to explain the new turn in the human scene whereby the human voice and the human appeal has lost its power, and men no longer speak or understand the language of humanity. He says, we have seen lying and degrading and killing and deporting and torturing. And every time it was not possible to persuade those who were doing it not to do it, because they were sure of themselves and because one cannot persuade an abstraction. That is to say, the representative of an ideology. We live in terror, he says, because persuasion is no longer possible. In this recognition of the nature of the immoralism of their time, Orwell and Camus speak with one voice. But Camus goes deeper than Orwell in that he has tried to excavate its historical origins and therefore unravel its universal character. Orwell's intense vision was of the present and he saw it clearly, so clearly in fact, as to make him over sharpen the issues and to invite the censure of exaggeration. Albert Camus' most influential work is Lutronje, the outsider. It is the story of a young clerk who loses his mother, attends her funeral, returns to the office, takes out a girl or two, goes on a visit to a friend, joins in an obscure dispute, lets off a gun, kills a man, is tried and condemned to death. That's basically the plot. It's brittle, splintery, fragile style, it's paratactic simplicity, the placing of clauses or phrases one after another without words to indicate coordination or subordination, reflects the delicate and yet insecure nature of its action. If action is the right word, things happen and not very interesting things at that. Incident attaches itself to incident, triviality to triviality. A cigarette is taken out and smoked or put back. The stranger, the outsider, himself is not a hero, hardly even a subject. He is the person to whom what happens happens. He's an anonymous nobody who is casually involved in this or that casual event. For Camus, the present is rooted in historical conditions that require and repay study. Seven centuries was the century of mathematics, the 18th of physical sciences, the 19th of biology, our century, the 20th century is the century of fear. In his view, our situation is neither a momentary lapse nor an all engulfing present. It was prefigured long ago and is not, therefore, out of the way or accidental. But at the same time, our own experience suffices to show that the collapse is not total and more importantly, the making of the next chapter, the 21st century, our century, is in the making and therefore in our hand. Camus, therefore, implicates us in our time. In the modern era, something new begins to afflict the condition of the artist. He or she becomes dislocated from a viable, tangible sense of community and belonging.  And this sense of separateness creates a melancholy between the artist and society, between the individual and the group. It seems irreversible, like a loss of innocence, but it has gained artists a certain facility, a necessary distance, or to use Tolstoy's immortal phrase, the necessary weakness, necessary to make the world tolerant intellectually, if not politically, a variety. This sense of separateness, of course, existed long before the modern era, from over, then arguably from the very beginnings of when human beings felt the impulse to express, to comment, to record, to reflect their reality. I remember, for example, my father taking me to see the cave paintings in Fazan, in southern Libya, which date back to around the time Ovid was banished to Thomas. The prehistoric pastoral paintings of animals and hunting scenes from 2000 years ago show that even then, the artist had to step back, literally, had to take a step away in order to record, to document. So even then, the sense of separateness I am looking at was present, but the clear rupture occurred perhaps more dramatically and perhaps more irrevocably in the mid 20th century, around the time when Kafka and Camus were writing. In this light, we can look at Camus, the outsider, as a marker in the sand. It asks the simple yet profound question of what happens when a man acts with naked honesty. What happens when a man refuses to lie? One of the answers offered is a phrase, to borrow a phrase from the book, a melancholic truce is set in, a sort of pessimistic optimism. Decades words, you must go on, I can't go on, I'll go on, could have been spoken or thought by Mechso, the hero of the outsider. Camus' novel is an elegy, too, to the mother. We forget that everything that takes place in that book, including the central tragedy, the murder of the Arab, takes place as a response to the death of the mother. It is also, I believe, a meditation on what it means to be a man, on masculinity. Mechso is like a trapped animal. Whenever he's indoors, he is still or wary. When he leans his head on the belly of a girl he took swimming, he takes note of the sound of her body. I want to stay with this theme of masculinity and the sense of separateness of the artist. The two are evoked further by two events that took place in the latter half of the 20th century. Although they have nothing to do with Libya, these events say, I believe, something about the existential pull and thrust of politics and literature. The nature of the dislocation mentioned of the artist from a viable, tangible sense of community and belonging. And in turn, they bring to mind the Libyan writer and the Libyan male. In 1945, shortly after liberation, a charismatic French general manages to convince an award-winning French author to be his minister of information. Approximately 45 years later, an internationally acclaimed Peruvian novelist puts his pen down to run for office. Although wholly unconnected, these events share a detail that is telling and curious in its mirror likeness. General Charles de Gaulle had been trying for some time to convince the reluctant André Malraux, a man 11 years his junior, to take on the job of minister. He used the guilt argument. Your country needs you. He used flattery. You are the best man for the job. And I'm sure de Gaulle also used the mildly threatening argument of, so much would be lost if he turned this down. Every tactic failed. It wasn't until all three were employed with equal skill and fine balance that the general succeeded. That night, Victoria's de Gaulle tiptoed into his marital bedroom and woke up Yvonne de Gaulle. This is recorded in Yvonne de Gaulle's memoir. I didn't make it up. It's exactly us. Yvonne turned on the lamp beside her bed and squinted at the figure of her husband unbuttoning his military jacket. I imagine the large brass buttons eased out of the slits with more willingness than usual. He apologized for waking her up. Where have you been? She asked. Tonight, he told her, then perhaps here he paused or perhaps he went straight on speaking the words quickly. Tonight I assassinated André Malraux. By this time Malraux had published La Conditione humaine, published in English under the title of Man's Fate, a novel about the existential plight of a diverse group of people after a failed revolution. He had also written Le Spoire, published in English under the title Man's Hope about the Spanish Civil War. Another historical drama, by the way, in which the fated Malraux had played a significant role, fighting on the side of the Republican forces. And indeed, it's an incredible fact about him, is that he set up the legendary Esquadrone España, which had inflicted serious losses on Franco's nationalist army. André Malraux ended up serving the goal until the end of the general's presidency in 1969. First as minister of information, then as minister of state, and finally as the first minister of cultural affairs. And he was, by all accounts, an excellent minister of cultural affairs. In a different continent, and about 20 years after Malraux retired from public office, the 54-year-old Peruvian novelist, Mario Vargas Llosa, already noted for novels such as The Time of the Hero, Conversations in the Cathedral, and The War of the End of the World, was running for the presidency of Peru. And again, I'm not making this up, this was recorded in his memoir called Fish Out of Water. Late one night, Mario Vargas Llosa writes, he too walks into his marital bedroom and silhouetted by the light begins to unbutton his dinner jacket, waking his wife, Patricia Llosa. Like Yvonne, Patricia too turned on the lamp beside her bed and squinted towards her husband. But she did not ask, where have you been? She knew, he was in a political rally. His combed hair and his shoulders were sprinkled with confetti. No, Patricia did not need to ask where Mario had been. All she said was, once, and perhaps here too, she paused. Once, I was married to a novelist. Malraux and Vargas Llosa's example illustrates the paradoxical reality of the novelist, that whilst he or she are obliged to be intimately acquainted with the details of social life and be intellectually and passionately involved, their work demands them to remain outsiders. Their example also says something about domestic space, about the marital bedroom. In Malraux's example, Charles de Gaulle, the man, is perhaps superficially lamenting his actions. Tonight I assassinated Andrei Malraux, but also showing off to his wife, his powers, his dominance, his self and historically aware violence and influence. But with Vargas Llosa, it is Patricia, the woman who leads the assault once I was married to a novelist, placing her husband's very identity under question, declaring him a stranger or the stranger in the bedroom, whilst accusing him of the ultimate betrayal that of the self. The silence of the marital bedrooms of Yvonne and Charles de Gaulle and of Patricia and Mario Vargas Llosa, the way history, politics and literature, assassination and identity has found its way in, makes me think of how the Libyan marital bedroom changed in the years under Colonel Gaddafi's rule. To explain, I have to first draw a quick picture of what life was like under the Libyan dictatorship. Throughout its rule from 1969 to 2000 any level, Gaddafi's dictatorship penetrated every sphere of civic life. It implanted its agents, the so-called revolutionary committees, who were obsessed with finding enemies in every institution and organization, every club and union, in the lecture halls and in the theaters, corrupting society's cultural vibrancy. They subjugated the press and dismantled one of the most progressive and independent university student unions in the post-colonial Arab world. Executing its leaders in public squares and imprisoning hundreds of its members, society was chased indoors until the only place Libyans could exist unmonitored was inside their homes. But even that final domain was invaded. Interrogations were regularly broadcast on national TV. Men, the revolutionary committees, deemed anti-revolutionary or traitors or bourgeois or backward or people who were halting the march, endless, the list goes on, were questioned and accused on television. From our sitting rooms we watched men stiff with fear under a camera's harsh lights, answering questions delivered by faceless voices. We must have known that the questions were also intended for us. And when some of those men were executed, we watched also on national television the summery and clumsy nature of the executions held in sports stadiums or city squares. We watched men hanging by the neck, swinging by a rope, fear killed many poems, fear killed many novels, fear was like thorns in the mouth. Conversation in the home changed. Members of the same family distrusted one another. And when children were around, any criticism of the regime became coded, lest the young innocently carry words out to the street. It was not uncommon for the dictators Henschman to interrogate young children about their parents. This practice returned darkly during the Libyan Revolution when security officials went to schools in Tripoli to ask children as young as seven what their parents thought of the uprisings taking place in Benghazi and other cities. Throughout the 42 years of the dictatorship, certain things could only be said in the marital bedroom. And the Libyan male endured both Marlowe's assassination, his silence and impotence in the face of Gaddafi's authoritarianism, and Vargas Llosa's estrangement. Without a voice, the Libyan male's identity and power became obscure. You could see this play itself out during the revolution. The enthusiasm by which Libyan men took up arms, for example, was of course an expression of audacity and bravery, but also I believe a reclaiming of will and an assertion of their masculinity. And the final act, the killing of Gaddafi, its violence, the sexual nature of the abuse the dictator endured at the hands of his captors was a dark reflection of both the crisis of masculinity and impotence the Libyan male endured for four decades. As well as being many other things, the Libyan Revolution is an attempt to redefine the existential place of the Libyan male, to bring him out of his hiding places. What he will make of this opportunity remains to be seen. Similarly, the revolution has redefined the place of the Libyan writer. And as so much as one can speak about such a complex figure, such a vague and fragile and nearly ephemeral figure, for Libyan literature has been dealt so many blows that it now seems to tremble at the edge of oblivion. It is a literature that has for too long been subjected to political interference and interference that has developed so many ways to undermine the imagination. For if dictatorship is to exist, it exists against the imagination. It cannot tolerate variance or contemplation and therefore it cannot tolerate spontaneity or dreaming. Like Edward Said's exile, dictatorship too is jealous, but more violently so. In the words of the late Resiart Kapushinsky, every dictatorship not only surrounds itself with kitsch, it is in itself a vulgar political kitsch, unhappy, often stained with blood. It is the triumph of tastelessness, not the harmless, containable kitsch of mass culture, but an aggressive kitsch, which ruins the creative culture, poisons the social atmosphere, and has only hate and contempt for the individual. Perhaps dictatorship's fear literature because they see it as a competing narrative, dictatorship is a sort of hideous fiction and tolerant of the very idea that there might exist more than one possibility, the very idea of other fictions. I remember when I was writing my first book in The Country of Men, a novel set in Libya and in which the constant and menacing gaze of the dictatorship pierces its way through the private quarters of a family's daily life. I often felt the temptation to expose the awfulness, the sheer absurdity and vileness of the Libyan dictatorship further. A dictatorship that stole our house, a dictatorship that killed people I know, people I love, people I admire, a dictatorship that in 1990 colluded with the Egyptian government to kidnap my father from his home in exile in Cairo, took him to Libya where he was subjected to torture and imprisonment and worse of all, to the fate of the disappeared. So as you can see, I had many reasons to make my book an attack, a catalog of their crimes. I had to resist such temptations. And on the other extreme, when I was gripped with a sense of panic, fearing retribution against me or worse, members of my family, as indeed has happened to other Libyan writers who spoke out in the past, the temptation to act as my own censor, in other words, my own Augustus, my own oppressor was also great. I had to resist that too. If I succeeded in protecting my work from such extra literary concerns, then I did it because I was somehow convinced that to give in to those temptations, regardless of the legitimacy of my grievances, would turn my novel into a diatribe, a dead corpse. For any writer caught amid such violent tides, literature must be his measure. His prose would show him up. In the prose of any work of literature, one finds the very DNA of the entire thing, right there in the sentences, sometimes in the first sentence. A writer who thinks he can fool language will be made a fool of by language. Language's main purpose, after all, is to betray us. Every word we utter betrays us. It says a little more than what we think we are saying. Reveals more than we had anticipated, exposes us. And if a writer's intention is to use literature for his own ends, then all the evidence will be on the page, regardless how hard he tries to hide his footsteps. Gaddafi's political war on literature was effective. He silenced the whole generation of Libyan writers. Burnt books made it a dangerous activity to think, but he could have never succeeded because literature is not a plant one can uproot, but a vapor, as agile as oxygen. It is by nature rebellious, resists control and will never be satisfied. No prizes, no praise, no success, and no torture or burning of books or closure of universities could ever satisfy or kill it. It is in every one of us, including those who have never read a word in their lives, those who do not know how to read. It's the cluttering tongues and the poetic ones. It is wild and searching and it finds opportunity everywhere. This is its genius. Back in 1948, Albert Camus declared that the 17th century was the century of mathematics, the 18th century of the physical sciences, the 19th of biology, his century, the 20th century, the century of fear. I wonder what image we could assign our new 21st century. For this, and to close, I will turn to the words of another author, Italo Calvino. Were I to choose an auspicious image for the new millennium, he wrote, I would choose that one, the sudden agile leap of the poet philosopher who raises himself above the weight of the world, showing that with all his gravity, he has the secret of lightness and that what many consider to be the vitality of the times, noisy, aggressive, revving and roaring, belongs to the realm of the old death, like a cemetery of rusty old cars. The Libyan novelist went from being followed, pursued and persecuted, to now being free to write whatever he or she wishes. Therefore, Calvino's image of the sudden agile leap of the poet philosopher who raises himself above the weight of the world is not an inappropriate model because there exists the danger of replacing the burden of oppression and persecution with that of public duty and obligation. If the imagination itself is that private chamber, like the marital bedroom, in which the artist renews his or her vows to literature, then let it be a place not of assassinations and betrayal, but a place of wonderment and what the creative process has always seemed to me to be a state of absolute freedom. Thank you. Thank you.


This is probably the only talk you're going to get here from somebody who's absolutely unqualified in terms of their academic background to speak to this audience whatsoever. So I'm going to look here at some history and trends together and try to look at what I think kind of some of the interesting research frontiers going forward are going to be. So if I just start looking at the problem of just doing a cryptographic operation, historically we were really limited in the amount of computation we could do. And so you've got these various manual schemes, the Enigma, the M209, various mechanical sorts of cypher machines. And this limitation on computation really limited security. But when things scale, as I think all of you know, that favors the defense from a cryptanalytic perspective and makes offense really hard. So you go from single des to triple des. It's only three times as much computation, two to the power 56 times as much work to do the attack. So this kind of scaling means that basically the defense wins. And I'm going to make what is in one hand the absolutely most safe prediction and kind of an interesting one at the same time, the triple AES 256 I think will absolutely never get cryptanalysed in terms of classical cryptanalysis. So we've reached this point where the algorithms have won. And obviously though, if we map the winning of the algorithms over to the real world, you can see just a huge number of different breaches occurring. And security isn't going well in practice, despite the fact that we have these algorithms that have won. And you can think, oh, well, that's a security problem. We're crypto people. Things are actually OK in the crypto world. And no matter how you look at it, they're actually not OK. So if you're trying to protect a key that's going to protect your Bitcoin, I mean, that's a pretty easy problem, how to hold a key so somebody doesn't steal it and do maybe an occasional transaction with it. But the number of successes at holding high value keys versus failures and the places where we actually get data, like if somebody steals your Bitcoin, you actually can see it, in the places where we get this kind of feedback, we can see that we're failing terribly. And even in the places where we don't usually get feedback, the leaks coming out of the NSA are telling us that we're failing in many of those areas as well, at least against that kind of adversary. So our world is not a very good one right now. So one of the places that I sort of like to do is I like to look to other fields and see kind of what's going on there, what the history is. So if we go back to the Middle Ages, if you needed an amputation or you needed a surgery of some kind, your physician wasn't going to do it for you. He was going to send you over to a barber. Because the barber was the guy that would go chop stuff off. The physician didn't want to deal with that. That was people screaming and messy and the patients often died. And so you had this divide between the academic physicians and the barbers who went off and actually did a lot of the applied stuff. And we are kind of in this same era of history. So if we look at this, I mean practice right now yields some really, really bad outcomes and some that are good even for inexplicable reasons. So you may be getting the right outcome for reasons that we don't really truly understand why. And if you look at research, I mean, I think at least the practice people would say that research is really painfully divorced from practice in many cases. Not all, and this has gotten a lot better in the 20 years that I've been involved in this community, but it's still a major issue. And so what you end up happening is quite predictable. I mean, theory is struggling with just the messiness of reality. And the theory isn't applicable then to the real world. And the practice then ignores the theory because if you're a practice person and you attend a conference and you can't even understand a single word that was said, you don't really gain from that. And if you start to actually implement the fully homomorphic encryption algorithm that was just presented that seems like it might solve your problem. And you get your code working correctly and then you just realize that it's going to be many, many, many centuries before anything returns. You haven't actually achieved anything useful. So you ignore all of that stuff. And so you get this gap. And if you're a practice person, it's really frustrating to go and read some of the kinds of things that get written. And if you're a theory person, you get so frustrated with the kinds of questions that practice is asking. So, but in the same way that when you had well meaning of people in the Middle Ages trying to do their best, practice has to go on. You can't just stop and say, look, you've got a leg with gangrene in it. The amputation is still probably better than doing nothing. You still have to go and do your best to protect these systems that people are using. So I came into this when this divide was, I think, even greater than it is today. If barbers can do surgery, pre-veterinary students can clearly do cryptography. And so I got curious about cryptography, discovered the Psy.Crypt news group that the old people in the audience will know what I'm talking about and the young ones, maybe not. Discovered from their interesting things in the Stanford Engineering Library. There were all of the proceedings of the old crypto conferences. And I went down there and discovered all kinds of interesting stuff and met up with Marty Halmon in the Stanford Crypto Group. In parallel, I had this problem called tuition. And again, I shouldn't complain now because it's gotten a lot worse. But I had to come up with enough money to pay my tuition. I discovered that compared to working in the food service hall doing crypto consulting was fantastic and worked for RSA for a bit implementing things. Discovered some issues like the RC4 related key problem kind of early on. Also learned about patents for better and for worse. Those of you who pay my company licensing money probably wish that I hadn't learned it, but at the same time, those are an important way to be able to monetize research despite all of the warts in that process. I also got an interesting project that paid a lot of my tuition working for Microsoft where they were trying to do try before you buy software. And the CD format was relatively new. You could put lots of programs on it. The idea was you'd be able to distribute a CD to lots of people. And then the people who had paid for the software would buy unlock codes or perhaps you'd even have some trial period first. And so I probably broke 40 or so of these schemes over the course of a few years. And that paid my tuition. And the guy in the marketing department thought it was great because he could just send these things to me and I'd send him back a little hack. And so we had this kind of thing that kept on going. And that basically paid my way through school. And it also let me sort of peek behind the curtain. Because there was this idea, whenever you're new to a field, you have this idea, well, gosh, people who are doing this really must know what they're doing. They're old, they give invited lectures. They've got to be some sort of wizard behind the curtain. And peeking behind and seeing that even companies that were doing as good a job as any were, not really sure what they were doing. It was kind of an eye-opening and interesting experience. And so when I finished my biology degree, Marty Hellman retired. He kept sending me some projects that he was no longer doing consulting. That was the seed capital for my company, which started out by doing services, mostly breaking stuff and then trying to sometimes pick up the pieces afterwards. So there was a presentation at Stanford. I can't remember who gave it, introducing mainly linear cryptanalysis, which was relatively new, but also talking about differential cryptanalysis. I thought this was kind of cool, but I went off and figured I'd go try to improve this and implement it and make it work as best I could. And it was really, really frustrating. Because the correlations were just terrible. I mean, dealing with things that were two to the minus 50 when all you've got is a PC of this era, wasn't very fun. And I couldn't get the attacks to work, but I had known from profiling the code that I had written that there were these different non-constant timing effects that were popping up because sometimes the code would run faster than other times and understood the reasons why these were there. And that led to the timing attack paper that Benedict mentioned in the introduction. I'm not going to explain the attack here, because I think we've reached the point where everybody in this audience knows, or if you don't, you can find the paper. But the one set in summary, though, is that given a whole bunch of timing measurements from a device with a key, you can use some statistical techniques to identify correlations that can let you figure out what that key is. Now, the implications of it are maybe a little more interesting. I mean, from just a practical perspective, this gave me the kind of strong correlations that I wanted. I mean, the kind of thing that I could go do and play around with the PC that I have. So this was enormously fun compared to trying to make differential cryptanalysis actually work against a live cipher.  I mean, we have these cryptanalytic techniques that we're exploiting much, much, much smaller correlations. And so when you get something strong, like the difference of many clock cycles that you can measure, that that ends up being important from a cryptographic perspective. It also is now, I think, obvious to people that the real implementations that we have in the world aren't these sort of tidy black boxes where M comes in and C comes out, and everything just happens through some completely opaque machinery that we have no insight into. But there are all kinds of things going on inside there that become important. And also tied to that optimization, the whole quest of computer science to get the M translated into the C as fast as possible actually can make things a lot worse when you're trying to worry about security. And tied to this, then, is the question of this disconnect between the algorithm and what its requirements are in the real world against what you actually end up, what the security assumptions underpinning the strength of that algorithm might be. And so you end up with these incorrect assumptions that the implementer makes, and there's not even any language that we typically have for expressing really what assumptions there are and verifying that those assumptions are met by an implementation. And then, last of all, is a theme I'm going to touch on several times through this talk, really this idea that cryptography is a lot more than just the algorithms and the mathematics. It's actually how you solve a problem for somebody. And I'll talk about that a little bit more later. So back to history. So started cryptography research, had clients who are having me do various projects. A lot of them were deploying smart cards at this time. And there were some just crazy security claims being made around how it'd take $15 million and this massive equipment lab to actually break anything. And I had student loans still just out of school. I didn't have $15 million to go attack these the way you're supposed to attack them. So instead, I took on protocol reviews and started looking at the protocols people were using. And they were horrible. And there were things like time memory trade-offs against DES or places where you could get lots of identical plain text with many keys. And if you could break any key, you could load arbitrarily large amounts of money onto it. Macs that were using DES in ways where you could actually use the same key for encrypting chosen messages and break the Mac, all kinds of terrible stuff. I mean RSA where you did a cert where you put the public key inside just with no padding whatsoever inside a slightly larger certifying public key. And many of these systems had proofs of security with big quotation marks around it. So lots of things were bad in these kinds of things. It was kind of fun because, again, you could go out and make these systems better, see what was going wrong. But one of the other things that you quickly find if you're working doing analysis and practice is that as soon as you break somebody's system, they get defensive. And defensive means they deny it at the attack work. So I had to go and implement the attack to show that I could load money into these things. Or break the protocol in practice. And when I did this, I also went and figured, OK, these guys surely have read about the timing attack papers that I wrote. So they must have fixed that. So I looked for timing attacks on these devices. And they were just consistently bad. Again, I mean you could break RSA through leaks of whether the result mod p or mod q is larger and the CRT pin verifies are still in lots of devices when there's a little comparator that runs through and checks the number of characters that match. The other thing you could do that wasn't cryptographically interesting, but you could see what the sort of decision tree in the software was for commands coming in. So if you send a command byte and it says another one, another one, it says illegal command, how long it takes you to tell you that tells you how many plausible bytes were submitted. And so you can find the sort of space of all commands that the thing can support. And so finding these undocumented testing and backdoor commands was another thing that just kept popping up. So there'd be the magic global password for all the devices with a mem compare on it.  Other issues like time to reset counters. So in a lot of eProms, you first go through, if you're going to have a counter, the right function will do a bit clearing operation first. And then it will go and set the bits back in. So if you have a reset counter that says you're only allowed to check a pin 10 times as a user, well, if you zero your counter and then set the bits, well, if you set a reset right in the middle, the counter goes back to zero. And we still see this problem regularly today. So this isn't the kind of thing that's quote unquote fixed. It's just not cryptographically interesting. And we also did some glitch attacks as well. But again, glitch attacks, we just caused the device to output its entire memory space as opposed to breaking the crypto in some more mathematical sort of way. So I was doing these and I wanted better data. So I went off to Fry's Electronics and bought the cheapest oscilloscope that they had. I think it was about $230. CRT screen. I had a Radio Shack electronic project lab that my parents had bought me, who are actually in the audience here today, that I happened to have laying around, which had resistors in it. So I took some alligator clips and stuck the resistor in on one of the smart cards I had. And instantly could see keys. So just one of those like, oh my gosh, people just clearly haven't ever had a cheapest oscilloscope, a resistor, and a cryptographer together in the same room. What on earth is going on here? You'd think that there was some reaction that would occur. So you can see all of this sort of stuff. Even like DES, which you might think, OK, you're not going to instantly see that on an analog scope. But a lot of the software implementations would do the C&D shifts where you've got this 28-bit shift register, so you shift the thing. The bit comes off the end. If the bit's a zero, well, you just do a shift. If it's a one, you have to move the bit back in. And so you could see the DES keys falling out as well. And with DES, though, we could only do that at night, because the CRT on the oscilloscope has such a crappy phosphor that if there was any light coming in, then you couldn't see it with enough persistence. So this was the problem. So finally, OK, there's enough stuff I'm breaking here. We went and we spent several thousand dollars. And we, at this point, was myself on Josh Jaffe, who was actually a friend of mine that I'd hired him. I was my first employee. So we went and we got a digital storage oscilloscope. And this was absolutely amazing, because we could do stuff in the daytime now. We were no longer like vampires. And so we could, this had storage. We could see one-time events. We managed to get the data pulled into the PC. This was a picture from one of the press articles. And both the oscilloscopes that we owned at this time were carefully stacked in the background to show much equipment we had to give you a comparison to the labs that had real equipment. And that's Josh and Ben, who were my co-collaborators on this. So at the same time, we did this major push on countermeasures, because when you're seeing a new attack that's causing all kinds of devices to fail, saying things are bad and not doing anything about it, on one hand, isn't useful. And also, there's the question of, OK, I've got a company here. I need to actually make some money. So that was one of the things that we did, was to file a bunch of patents. And I never actually got around to submitting a paper to conferences, describing the countermeasures we came up with. If you want to see what the muddled state of mind at that time was, though, you can actually go and see these things. But in parallel, we were looking at smart cards. And I actually said, breaking everything we tested. There was one smart card we couldn't break, because we put it in a reader and wouldn't do anything at all. And it turned out there was actually no chip on it at all.  And that was the first smart card review that we came along with, where we actually said, there is no security problems that we were able to find in the smart card. This was a bank that was trying to impress their customers with their new smart card technology. At the same time this came up, there were some fairly complicated ethical questions that were coming up here. There were customers we had who were panicked about the problem. They had payment systems in the field, including some where you could, in a non-auditable way, load arbitrarily large amounts of money into them. And what do you do? And I was under NDAs and things got complicated. Fortunately, somebody at one of our clients had briefed all of their senior VPs about what to do if they were asked about the issue. And a reporter asked a question that had nothing to do with cryptography. And the guy gave the response about this power analysis thing. And the reporter realized, hey, there's something kind of interesting here. And his name is Jeremy Flint. I forget the name's reporter's name. But he wrote an article in Australia. And finally, that kind of allowed us to talk about what was going on. In retrospect, though, I don't quite know how long keeping something like this quiet amongst one's sort of clients and their inner circle is the ethical thing to do. And the responsible disclosure discussions around software obviously don't apply always the same way to hardware, like Adi's question last night about Phillips with their light bulbs. It's another classic example of what do you do here when you have lots and lots of light bulbs in the field? And that's a lesser issue than something where you have a significant payment scheme where large amounts of money can be stolen. So again, in retrospect, this is absolutely completely obvious. I mean, the idea that electrons moving around affect your power consumption.  And you can see them coming in. And that you're going to get EM emanations based on the movements of, I mean, this isn't even like physics. This is sort of pre-physics here. And that these measurements are correlated to the secret intermediates.  And again, same kinds of things around cryptanalysis, being able to use tiny correlations.  Surely you can't pull the key out from that. And if anybody who's in doubt about that, the answer is, yes, you can. You don't need strong correlations to break keys. But even that is not obvious to a lot of people who haven't looked at the cryptography. And I think the most important thing, though, that, again, is obvious in hindsight, is that the strong algorithms are the beginning of cryptography and not the end of cryptography. So I've been using this sort of phrase obvious in hindsight for a while. And part of the thing that anybody who's a practitioner here is going to be thinking, well, telling me that this was obvious in hindsight really isn't very useful, because you want to actually know in advance what the problem is. Now, it actually is useful if you want to assign blame. But aside from that, again, it doesn't help you protect a system. So the question of why the problems aren't obvious beforehand is one of the things that we actually have to understand if we actually want to make practice better. And the analogy that I like to think of for this is one of fractals. So if you think of a system, it's kind of like a fractal. And you've got these different levels that you can look at in detail. And at the very finest level of detail, when you stare at something, it's absolutely obvious that you may be looking at a bug. I mean, if I give you the lines of code that Apple had was going to go to fail here, it's pretty quick for you to understand that this is not the right way to actually implement your certificate verification. So the individual vulnerabilities are really obvious, especially if you have this sort of n-squared amount of effort where you can take every line of code and every academic paper that has been written and try to see whether there's a match between the problem that might be in that line of code and this academic paper. But the amount of human brain power required to do that is absolutely staggering. Now, there's another view of the system where you can step back and say, OK, let's look at this whole system in its totality. You can actually get a pretty good idea of what some of the risk profile here is. I mean, if you're going to tell me that you're going to go launch a new Bitcoin exchange using the same kinds of key management approaches as some of the other Bitcoin exchanges, I can give you probably a pretty, you know, within an order of magnitude guesstimate that your risk is probably pretty high, that your bitcoins are going to get stolen. Now, I have no idea what your bug is going to be or which employee is going to be the insider that breaks you or what is going to go wrong. But I can understand very quickly that the risk profile of what you're doing is actually pretty high. So if we step back and look at there, there are three trends tied to this that are really driving the technology industry today. We have exponential growth in the number of devices that we're making. We have probably also exponential growth in the economic value of the data that's going on those devices. And through Moore's law and related trends, we have exponential increases in the amount of complexity of those devices. So if you put the bad guy hat on for a second, this means I have more targets, more reward when I break something, and more vulnerabilities. So these three trends together make the defensive job very difficult. And you can look at what happens as the complexity of a system increases, that your odds of getting all the bugs out fall off, basically, exponentially. So if I double the number of lines of code, I roughly square my chance of being successful at getting the bugs out. If I assume that my number of bugs is proportional to the number of lines of code, reality is usually worse, because you have these unintended interactions that occur between components. If you look at the number of interactions, and you say that my bug rate per interaction stays constant, my probability of success falls off at the fourth power. And even worse than that, if your number of engineers working on a system doesn't scale with its complexity or number of interactions, so lots of things work against you as systems get more complicated. And I will come back to that in just a second. 1924, there was the silver bridge that was built over the Ohio River, and it was a really innovative design. Instead of using steel cables, they used high-strength steel I-bars that you can just kind of see barely on the here. So this isn't a cable, you've got chunks of metal that are holding up the sides of this bridge. And being a crypto talk, everything always, of course, is depressing, so you kind of know what happens to this bridge, and it collapsed in 1967 and created awareness of what structural engineers call fracture-critical components, things where if they fail, something catastrophic occurs. So how many fracture-critical components do you think there are in a typical mobile phone or connected device today? And you start looking at papers like the Rohammer papers and the number of software lines of code you have and the things that you actually assume working perfectly, and you're somewhere around maybe 10 billion fracture-critical components in a typical device right now. Now if we continue scaling at Moore's Law, which is a doubling every 18 months, which isn't exactly right but good enough for kind of an approximation, it means in about 10 years we're going to have a trillion individual single points of failure in the devices that we're making. And you might think, well, maybe we're not going to scale that way, but you look at things like the coming of AI and its use in computer systems, we may actually end up scaling faster than that rather than slower than that. Now the defenses we've got today have failed to scale to the problem that we have right now in time. And when you start looking at these more complicated devices and these connected things, we're actually taking a problem that we're failing at right now and we're making it orders of magnitude more difficult for ourselves. So things like the question of how sophisticated are the vendors? You know, Phillips with their connected light bulbs that Adi talked about, they are pretty sophisticated in terms of their security understanding compared to a lot of the vendors that are currently making devices that are not connected. And you look at the product lifespan. We're going from disposable connected products to very long-term products. We're looking at devices where I'm willing to spend an hour making sure my PC works properly. I'm not willing to spend an hour to make sure every light bulb in my house works properly. I'm tolerant of my PC or my phone having some issues because it's a very valuable thing to me. An individual light bulb is not nearly as valuable. You know, my car has a much more physical impact on my world than my mobile phone today. So the potential for damage, again, is changing. And the number of software platforms we have with iOS and Android and PC and Mac may be on traditional computing devices in Linux. Maybe five or six of them. We're going to start having this huge proliferation of different firmware images that aren't even really platforms. You're going to have firmware version 1.7 that somebody cranked out for that particular release of light bulbs. And it may not even have a traditional OS and all the stuff attached to it and the on-device security tools that you're used to. So all of these things that we've been able to do to manage security and make the problem even be survivable, we're going to start losing a lot of those tools. So what do we do? And I'm going to look at two parts to this here. One which is focusing on outcomes and one looking at some foundations that we need to build. So when you give a talk, one of the first things you want to try to do is figure out, what does absolutely everybody agree on? Well, we kind of agree that the probability of cryptanalysis for our best algorithms is very small. And the probability of a mistake is very large. So I think everybody wants to narrow this gap. And there are sort of two general approaches. So the FBI has one. We make the probability of cryptanalysis really, really huge and this gap goes away. That's not what I think we should do. I think we need to try to figure out how to get this probability of mistakes to be a lot smaller. So we need to start thinking of probabilities, not certainties. And this means that a proof is no longer a proof of anything. It's evidence. You don't have 100% confidence in a proof itself because people can make mistakes. I have certainly had math exams where I was told to prove something. And I came up with a proof and it was wrong. And we've had errors in proofs before. You can have automated proof checkers. They can have bugs. But even much more important is that the assumptions and the relevance of that proof to the real world may be very tangential. And in many cases, a proof that gives you confidence that is misplaced is a dangerous thing. In fact, generally, if you look at the history of cryptography, the place where things really, really go wrong is where you believe something is strong and it's not. One other thing to keep in mind about proofs when you're looking at a real world that's got exponential scaling is that you may have some gap between your proof and reality. But the size of that gap typically scales exponentially as the systems get more complicated. So if you say, well, OK, I'm assuming that the software is correct. If I have 50 lines of software, that has a certain probability of being a correct assumption. If that's software complexity scales up to 5 million lines of code, I have a very different probability of being able to actually achieve a system that meets that assumption correctly. So if you look at the different kinds of systems that we've built, there's a question of what is the probability we're actually going to get the outcome we desire. And certainly we can see in retrospect that for the Germans with the enigma machine that they did not get the outcome they desired. Or the Bitcoin exchanges. Or with our operating systems. And I am with SSL 3 as the lead author on that. Certainly there were some surprises there that the protocol, on one hand, did certain things fine and certain little things that you miss, are critically important from a security perspective. And we have a history in our community of being massively overconfident. And there's some reasons why this happens. It's partly that our brains are tricking us. Because when we think we understand something, like I think I understand transistors, that doesn't mean I actually understand operating systems, even though I can map the operating system sort of some model in my mind that connects these two together. But you have these emergent properties that make you feel comfortable with the things you understand. And you tend to be a lot more blind to the things that you don't. The same thing happens in crypto. You feel like you understand an algorithm. So you infer that you might understand the protocol built with those algorithms. But really we don't. And when you go from a protocol to an implementation to an executable to some absolutely critical use case that the world needs, that connection gets very, very hard. And our brains tell us we understand it when we don't and we get overconfident. So one of the important research questions here is to ask the question is, what does cryptography for fallible humans look like? Not cryptography for people who are working in a world of just pure mathematical symbols. But in a world where we have biological people who are building things in the languages we have today, with the transistors we have today. And one of the things that you very quickly realize is that our goals need to be around safety and assurance. We don't generally need to be 10 times faster. We need to be 10 times safer. And we need to come up with systems where a mortal practitioner can usually succeed. And if you look at medicine, most of the doctors who are practicing today are not absolutely state of the art researchers, they're ordinary enough GP's working in ordinary enough environments. And there are certain things that they can do that mean that for most of the patients walking through, they help more than they heard. And we need to be able to get to the point where we can do that. And it means making some pretty different assumptions and different metrics and different trade-offs. We need to look at implementation risk as a critical part of what makes a system better than another system. How many lines of code and special use cases are needed? How do we achieve high test coverage for something? If you have a security critical branch that needs to be done correctly by software that the attacker can tickle but the defender's test harness won't actually explore correctly, that's something with a very high likelihood of being a failure. And to go build a system that has that kind of design property in it is something where you're putting the ultimate people who are using it at a significant amount of risk. We need to figure out how to build safety margins and what they mean. If you look at this building around us, if it was designed by computer scientists, they would have optimized out almost all of the structural supports because they are clearly unnecessary. But when the earthquake comes, we're actually would like to have those there. And if you think about how much money have you spent indirectly paying for completely unnecessary things like airbags and redundant structural supports, you're spending hundreds if not thousands of dollars a year for things like safety. And yet we're in a world where you walk up and you say, look, I'm going to add two cents to the price of this thing to make you safer. People say, well, I don't know if I can afford a two cent budget. Yet the amount of steel that went into this building is probably two cents for each of us just sort of amortized over the time that we're here. It means we have to be very different than we're currently being about our terminology and our understandability to other stakeholders. So when you write a paper which is in math terminology and you hand it over to a programmer, there's a big language gap there. And if you can't clearly understand what it means in terms of bits and bytes, you don't have a system that is safely implementable. You have an interesting mathematical construction, but you don't have something that should probably be used in the real world. It means we have to be very precise about things. What is the internal state that you're going to track? What are the computations you do? What are the messages that come in and out? When I think about protocols in the post-SSL world, having had lots of scars that are covered up by my shirt here, from having designed that, I've learned that if your protocol isn't completely clear from the message perspective, the computation perspective, and the state perspective, whichever one of those three was ambiguous or underspecified tends to be the place where the security problems are lurking. So we need to document those things. We have to document our assumptions a lot better. And then you get questions like best practices.  Best practice has nothing to do with what I'm doing. But if you actually want your stuff to have real world impact, we actually have to figure out how to translate into what the real world actually can use. What should a cryptographic API look like? And if you look at pkcs11 is not what a cryptographic API probably should look like. I think we can do better than that. But I don't think we know, even from a research perspective, what are the properties that we can reasonably achieve? What should it look like? I mean, giving somebody just raw mod exp as your sensitive API and assuming that you've got your untrusted thing that can do a mod exp with a secret key doesn't feel good. And I think we can do better than that. And we have to ultimately figure out how to get things to be more resilient. So this is actually a really, really important graph, if you think about it. If you were to go back to the 1960s and had the 1960s aviation safety success rate today, several of us would be dead. But through time, there has been exponential improvement in the safety of aviation travel. If you were to draw a similar plot, I don't have good data for it, but looking at the safety of electronic systems, we're probably getting exponential increases in the danger that we're exposing people to. And this means that in order to do this, there were a couple of things that the aviation industry figured out pretty early on. First of all, that they had to build a culture of safety. It wasn't about whether it was possible for the plane to get from point A to point B. It's what's the probability that plane fails to get from point A to point B. It also required realizing that aviation was a whole lot more than just aerodynamics, because questions of what is the user interface in that cockpit is an issue that gets a huge amount of thought, because if that user interface is something that a somewhat distracted, tired, moderately competent pilot is going to make a mistake on when one component fails, that's not a good thing, because there are going to be people who are going to make that mistake. So if we want to step back and say, what can we do to try to make this situation better besides just bemoaning the scope of the problem? My argument here, and my thesis for the rest of my talk, the final part of it, is that we actually have to be able to make foundations that can bear what I term as the security pressure. So when I think about a security system, there's a certain amount of desire attackers have to break it. There's a certain amount of work they'll put into it, and it's hard to sort of quantify this, but you can get a sense of how much pressure is going to come to bear on the system, and if it can't withstand that pressure and it fails, then you end up with the attacker winning and some catastrophic outcome, generally, for the person who's on the defense. Conversely, if it can take the pressure, then you end up with a system that can function pretty well in the real world. So what do we need to do to make foundations here that are strong enough? Now, we know that at the lowest layer, we have crypto algorithms that look pretty good, and we understand this problem. We have the basic building blocks that we need, ciphers, hashing, signatures, key agreement, and I put secret sharing and threshold schemes on here as well, and they're vastly underused, but if you pick the basic building blocks that you need to construct this building around us with, we have those mathematical constructions. Now, there's one little asterisk around quantum resilience not being as boring as a practitioner would like, although of the things that are causing fatalities in the near term, quantum attacks are pretty low on that, and we don't have scaling and qubits at this point. So it's an important issue, and I think it's one that's being dealt with in the right way, but it's not the most important issue that the world faces in terms of cryptographic security at this point. So we have to solve basic crypto problems now. Protocols and constructions get a lot. So I should say we really understand how to build strong protocols in theory. The theory of how to do it is great, but when you actually map to the real world messiness, and this is the distance between the middle age physician and the barber, you have a much, much messier set of constraints that don't actually map always very comfortably back to the theory. We are not really at the point where you can easily say, oh yeah, it's really easy to go make a protocol that will deal with all of these real world things. And some of these are things where you have cryptographic failures that result, some of them result, and other problems. But if you look at issues like compatibility between versions or ECC curve proliferation right now, is an absolute security problem, because it means you can't go and hardwire a nice single state machine for your accelerator. You have all these different choices, which means you end up with the security surface area of your system growing dramatically. Certificate syntax, if anybody needs to break something, go look at the X509 parser, because nobody who actually had a choice in what jobs they were going to be assigned the X509 parser. So there's always a bug there if you need to go find a bug, so that's just a little hint if you ever need to break something. We often ignore the economics. And in the SSL3 protocol, I had the assumption that one, two, three root CAs. It never even occurred to me what the economic forces were going to be that led us into the non-cryptographic disaster that we have with a whole lot of CAs who manage the root key to the kingdom, who have economic incentives that are actually diametrically opposed to security in many cases. Side channels, implementation complexity. There's a lot of these things where when you actually ask the question of how do you go make a protocol where somebody can actually verify that the implementation works in practice, it becomes a much, much thornier problem. But we've made a huge amount of progress here, but it's one where we still have, I think, a ways to go to deal with many of the real world cases. Some of them work much better. But if I ask the question, it's been 20 years. I think SSL, TLS has probably been the most reviewed protocol family that we have today. Do we actually understand this? Or is there going to be another surprise at some point? I'm not sure I'm comfortable promising that there won't be another surprise. Or another way to ask the question is if somebody needs to build a system that they cannot upgrade, can they put TLS 1.3 in and be confident that that's going to last for the next 100 years? And I'm not sure I can say yes to that either. So we need to be able to get to the point where we can tell a practitioner that it is OK to go ahead and do this and that you're not taking an unacceptable risk by committing to something. And if you tell the practitioner, no, you can't rely on any of your cryptography, well, they're going to then go around and hard code their own software update mechanism, which is going to create a whole bunch of new risks. So there's not a question where you can say, look, I'm going to punt on this problem and tell the person to be totally flexible and actually get a good outcome from that either. Now, I call the $2 trillion question in many ways it actually is. How can we actually enable secure computations to be actually done in the real world? And this is really a prerequisite for all of the fancy cryptography that a lot of us are working on. And when we look at what's actually happening today, in practice there are these massive, massive failures for even very simple use cases. Can your web server hold your private key for your SSL session in a way where somebody can't steal it? Can you hold the key for your Bitcoin in a way that somebody won't actually steal it? And you look at the empirical evidence that we're getting and the answer is that the failure rates here are not just significant, they're very, very, very high. So one thing you might be, some of people will be thinking, oh, we'll solve this through fast, fully hemomorphic encryption or some kind of obfuscation scheme, some miracle occurs, that won't help us because you still need secure compute. You've gotta have a trusted compiler to go make your system that has to run on some computer. You need to have somebody who's talking to the fully hemomorphic encryption system that needs to generally know some secrets to do something useful. And you're gonna create a whole lot more buggy code. So there's no miracle that's going to save us through some kind of a new primitive that comes along. We're also not gonna have a miracle where somebody finds the last bug in Windows and we're all good here because the new product will come along, it'll be obsolete, there'll be new bugs that get added. There are bugs being created faster than they're being retired still. So even if you're trying to bail out the water with a bucket, the river is still pouring in faster than we're emptying the lake. And again, maybe artificial intelligence can come along and find all of our bugs and then we get the singularity and it's probably not good either. And actually, I think actually AIs are super important but I don't think they're gonna save us from our problems either. So then maybe you can say, okay, how do we take where we are and what do we do to sort of get towards having a place where we can run secure compute? And there's the sort of traditional computer science approach which is you scale things bigger and bigger within a one security perimeter. You put SGX into your Intel processor and you assume the processor is good and you pack more and more security stuff into this big perimeter, your ring zero code keeps getting larger and larger and larger and this is sort of like this Serbian ammunition depot that we saw where you pack more and more stuff in and when you put more things in, the odds of failure go up and the consequences of failure go up and I believe it was this depot that exploded in an absolutely gigantic explosion shortly after this picture was taken. Or you do like what the US does and we're storing large amounts of ammunition. This is a satellite picture of the Black Hills Ordnance Depot and you have lots of little security perimeters that can live and die independently of each other so you have small, much more survivable failures that can occur. So the architecture that I'm advocating for here is one where we start building little bits of security and this is based on the assumption that our current, first of all, and do these in an additive manner. So starting with the assumption that our legacy platforms that we have are too complicated to debug. We will not get the bugs out of them. They will remain this sort of cesspool that we have today and they're too valuable to abandon so we can't run away from them. But we can add stuff and in fact it's possible to put on a chip or into a larger device. A secure thing that runs separately and manages your more important things than the Pokemon Go game that happens to be running on the main processor. And hardware in this regard is absolutely unique in the sense that it is the lowest level. So if you try to go do something nice in a piece of application software, there's always these lower levels that sit underneath. So when I want to attack a system, for example, looking at the USB stack is a great example of where to go because it has lots of power. It comes on first and again it's written by somebody who probably wasn't thinking about security too much. Whereas if you go do something in hardware, the software running that USB stack in your legacy device is not going to be able to build little mechanical arms that come up from the chip and edit some other part of the chip. You can actually get some kind of security separation here. And it's the one place where Moore's law helps us because if structural components for buildings were getting exponentially cheaper, we could make our buildings very, very strong at a very low cost. And we actually have this benefit that the transistors that we use to construct our systems are getting exponentially cheaper. So something that we might put in that costs a dollar today in 10 years may cost a penny. Assuming we get 18 month Moore's law maybe takes a little longer than that. But if you start building something now which is slightly expensive by the time it comes to market it's not going to be so expensive. And that's an exponential improvement that we're seeing. And it means finally that we can get this separate scaling between the security critical pieces and the overall complexity of our system. So one of the things that my company for quite a few years has been trying to, has been doing is building crypto hardware bits that do useful things for customers. Whether it's helping to decrypt their pay TV signals or authenticated device from anti-counterfeiting perspective. But when you look at this from a research perspective we have kind of this model is pretty straightforward at some sort of academic level around okay we have some kind of persistent secret we have some crypto we have some countermeasures to side channel attacks and glitch attacks. But when you actually ask the question from an engineering perspective what is the research community suggesting that we do in terms of building that crypto block? What should it look like? I mean it's not just AES doesn't really answer the question there very well. I mean should it have redundancy and should it have five pieces of hardware that work separately and five bits of key that go into them so if one fails that the system doesn't fail. Can we build our side channels at the algorithm level rather than having to build them at the hardware level? Can we put what does an anti-glitch system really look like in a piece of hardware like this? And then you have to ask the question what's the probability of failure against a non-invasive attack or against an invasive attack? And I think we're getting to be at the point where we can have pretty good confidence that we'll survive the non-invasive attacks invasive attacks trying to actually map things to probabilities gets more difficult and we don't have as good tools there. Again our sort of ad hoc results the barber is going out and doing stuff a little bit chips that we're actually building are doing pretty well for the most part. We've been building cores that manage keys and seem to survive and we're building DPA resistant things that seem to do pretty well but there's a lot more work that needs to be done even to build just this most simple construction of a keyed function that holds a secret. Now when you expand this problem just a little bit it actually the solutions get a lot more useful. So in the previous slide I was talking about just doing something that might do challenge response authentication or some basic operation like that but if we increase this to actually including sort of true compute we want to do run arbitrary algorithms in here in some interesting ways. At this point I don't think we have really even a consensus as to what this should look like should it be a thing that can do NAND operations and it kind of emulates a fully homomorphic type operation using some trusted gates should it be an FPGA like thing where I can run some kind of diagnostics on it first to understand that it's not been trojan and I can force my hardware to be built before my bit file so that I can kind of separate some things should it be I mean I'm pretty sure it's not an Intel current like a processor or even an ARM processor in terms of the best way to do it but I don't think we know yet and this is a critically important question for us to figure out what this ought to look like and what are the things it needs to do and so there are lots of interesting crypto problems here that have a really, really big impact in the real world and the impact here ultimately needs to be measured and what is the probability that the bitcoins being protected by that key gets stolen or what's the probability that the SSL private key that is ultimately secured back to this piece actually gets stolen. Now there's another thing I put sort of in gray here on the left sort of this shadow around manufacturing and stuff so in terms of the amount of engineering work the sort of live in the field use case is generally a small minority of the engineering work that goes into actually building something. Now you can say well okay that's the applied stuff and I'm a theoretician but no this actually needs people who understand the cryptography to be thinking about it so when a cryptographer just writes there will be a key secret key known to the device and it's gonna be computed as some function of a master key. Pretty straightforward all of us kind of understand what that means mathematically but what does that actually mean in the real world? Okay so now I've got a master key where am I storing that? How does this drive key get in the device? Most implementers will think okay great I'll go send the master key to the device and so that it can go compute its drive key and believe me I've seen plenty of times where the master keys end up in devices because somebody logically took this and didn't build this plumbing in the correct way and so you end up with these sort of statements but when you look at what actually has to happen here you don't even have a single use case you need to solve because my mobile phone is got more and more use cases that are being piled onto it so I actually have to build a system that can work for many keys and many product types and many different component vendors and many different protocols and use cases and security requirements and I can't grow my factory downtime in some way that grows basically exponentially with the number of boxes if I have to put a new box for every sort of point here my factory is never going to operate if those boxes each have 90% uptime whereas if I have one system okay I can understand how that's going to actually work so if I look at just sort of the things that my team puts work into the back end stuff actually just dominates the sort of simple infield use cases and so like in our crypto manager business getting boxes that can work in factories is really really hard and then the last thing here is this question when we start having secure computing what is the program that we run into in this? Now, and so if we have this beautiful foundation and some structural supports what is the thing that we're going to build on top of that? What are the programs we're going to write and there will be new problems that arise but in many ways the perspective that I have again coming from something of the practitioner view is this is completely irrelevant I mean dreaming about these advanced surgeries when we don't have basic sanitation I mean it's nice but that's not really a problem that's relevant yet we have to go and figure out how to get some secure compute before we can devise enormously complicated calculations that run on it now there certainly is some co-evolution that may occur there for example if we can adjust the compute to accommodate the programs that we need but the basic question how do we run operations in the real world in a way that's as strong as the crypto that we have is the critical issue that I think that we face so in conclusion here if I step back and kind of look at what's happened to kind of the world of cryptography over the time that I've had the honor to be involved with it it started out as this fairly clean circle involving keys and algorithms and I and many others have done things that kind of sort of blurring the edges of that you know I remember after giving the timing attack paper somebody said you know why is this a crypto this is an engineering paper rather than a cryptography paper thought about that and I'm not sure I even know what is cryptography and what is engineering in fact you kind of get this sort of old view of what cryptography was and you get this sort of new notion of what cryptography is and it's this very large set of different components and things that go into solving problems for somebody in the same way that if you think about what is medicine and what does it take to get a patient who comes in with an ailment and comes out healthy or what does it take to do structural engineering or aviation you know aviation isn't just one little thing it's many different things that all blur together and we are realizing very quickly that we're in a really wonderfully diverse set of different problems that all connect together in terms of solving a problem for somebody at the end of the day and when you sort of swirl all these things together you get this really sort of psychedelic mess of stuff but in terms of solving these issues I believe that the cryptography community is much more likely to succeed at solving these problems than other areas are likely to go and figure out cryptography and then successfully apply it so of the groups in the world that can solve these issues it's the people in this room and we're not gonna have somebody coming and saving us from the outside we have to go out and figure out how to solve some of these really really hard problems and part of that requires going out and thinking across disciplines and you know having studied biology and looking at cryptography you know get a somewhat different perspective and if I could get a single thing that I think would have an impact here if I could get everybody in this room to try to go out and just have lunch with somebody in a different field and talk about the problems that you see in cryptography and what their field does to solve something that's the most connected or related to that you know how does a structural engineer think about a problem like contractors cutting corners go have a lunch ask these questions and think about how some of these problems map back to the again the real world of what cryptography is and what it needs to be and the out in sort of in conclusion so that the results of these problems really matters so if you look at what happens to system scale you put the most valuable things in first so making my phone go from two processor cores to 16 processor cores makes a little bit more useful it's not eight times more valuable because you put the most useful stuff in first but the risks of these systems is growing with complexity which means that the net value that we derive from technology at some point starts to decrease you know if this 1995 Mercedes had Windows 95 built into it and was connected online it would be a less valuable car than that car is as an offline car and that's really important in terms of asking the question of if I take the car and the operating system and I put them together am I making something more valuable and if we can't make it more valuable it means that society does not get the benefits of the things that are possible and so we have to figure out ways to make it so that these systems get better now from a macro perspective there is no magic technology is going to make the security situation at a global sort of overall perspective better in the next three to five years things are just going to get worse they have been getting worse it's hard to imagine how they will get worse and you can't say exactly what the specifics in that fractal will be but there will be an overall worsening and there will be individual systems that do fine and do better and as a company I'm trying to be deliver my clients that individual success that is better than the average but from a macro perspective it's going to be a while until we can start even sort of leveling out the curve about where things are but the technology industry's future depends on finding solutions to these and in terms of doing that cryptography is the place we have to look to and it's a very broad, very weird very wonderful set of problems that we have and a really fantastic community that's been really just wonderful for me so we have to all kind of work on this think about what it is and there's a huge amount of really great research results that lie ahead that will be connected toward these problems so thank you very much for listening to me as a failed veterinarian I hope all of you will grab me in the sessions afterward I'd love to talk with you more about this and depending on how much time we have I'm happy to take some questions thank you very much