It's a brain that wants to pop out of the room. How do we articulate to the youth that what they feel is useless and meaningless? Like literally meaningless. Also, you're not entitled to an opinion. You don't deserve an opinion. You can have an opinion. You can have an opinion. It's just meaningless. Like how you feel means nothing. How I feel means nothing. How you feel means nothing. How you feel means nothing.  Well you can't, it's easy to say, but when you got motherfucking people reacting to what people are saying on social media and you got celebrities apologizing and you know, people backtracking on stuff and people losing it and stuff. Yes, you make you feel like your opinion is validated. Like it doesn't feel like your word means something. You should have to earn an opinion in public. I don't think you should just be able to. You should be able to. Take it seriously. You should be able to. When words on paper, you just have to pay for that shit? Magazines, books, all that type of stuff. And that was the only way you could get media? You just have to earn your opinion. Like why do I care what this person has to say? Oh well, he wrote this, this, that, and the third. He did this. Let me read that now.  Yeah, and podcasts wouldn't exist if that was the case, Akash.   So, I feel like I earn an opinion. I don't think a lot of people know you a stand up though. Well, they've been to find out. Oh, I like that. But at the same time it is something that you're doing, right, like there is some sort of qualification. I disagree with you. I think anybody should be able to have an opinion. But I think that we need to- There's a fire? It don't matter if it's fire or not. I think we just need to realize that like, just your opinion is meaningless. Like when people say- There's no power behind it. There's nothing. It means nothing. It means nothing. It only means nothing. I didn't like this restaurant.  I'm not gonna lie, I love a good Yelp review. I love a good Yelp review, guys. Oh, I hate it. I will go read a few Yelp reviews. I hate it.  It's gonna be crazy. Sometimes I hate read them. Well, the wait set was all right.  You need to take your time and do that. Unbelievable, man. I did a show for Yelp and I told them, guys, I don't even respect professional critics.  That's a great point. Even like when we look at professional critics, when we literally look at the movie critics, all these people, who are the professionals now, though? I gotta show this, this image. Did you guys see what happened with the fucking, not only Dave Chappelle, but there's another, okay. So there were two documentaries or two things. One was the Dave Chappelle thing, Rotten Tomatoes. You guys know Rotten Tomatoes? Yeah. Okay, so Rotten Tomatoes gives, first of all, no score to Dave Chappelle, right? Like the tomato meter or whatever. Now they do two scoring systems. One is by their reviewers, whatever. And then the other is by the people. They got a lot of flack for not giving any score for Chappelle. So they let seven people review it. The score was 24%. Then they let the people review it. 100%. 99%. See, that's my problem.    Hard to keep in mind because it's so in your face, though. Yes, but it's not the market. The market will always determine whether or not you're good because that shouldn't even be fair. At the end of the day, people should be critiquing Dave Chappelle's art. Yep. They should be critiquing Andrew's art. They should be critiquing Kaz's thighs. Like, they should be critiquing like what it is that we do. Right.  Was it good? That's it?  Knocked down the house. Have you guys heard of this documentary? The what? Knocked down the house. Have you heard of this? Was it about Three Little Peaks? What's it about? It's about the squad. Oh. Okay. Maybe Froome calls them that. Oh, the squad. Oh, okay, yeah, yeah, yeah, yeah, yeah, yeah. But it's... It's on Netflix, all right? Exactly, so, or something. And the tomato meter, which is the in-house version of Rotten Tomatoes, 100%. The audience score, 35%. Dave Chappelle's Tomato Meter, 29%. The audience score, 99%.     That's it.  The most is advertisers. If they learned what you're saying, Twitter isn't the market. It's not the market, baby. We don't need to respond to some angry tweets that are outraged. It's A market. Everything goes back to normal. It's not the market. I think it's a small, small slither of A market. Every article that's, this is outraged, it's like five tweets from people being outraged and then you've got enough for an article and then the article gets enough more people to be like, well, I'm a little, then you got a thousand people. It's a thousand. I read an article this morning. Fat women with short hair. Those are the only people writing these articles and they're the only people that have complaints about these opinions. If you just ignore them. And when I see those articles, I'm reminded why Beyonce hates her fans. Oh. Yeah, but you got some people nowadays, man, like they're a pain. You know how we clown Magic Johnson?  You got a group of woke tank claim. Woke tank claim.   Because I talk to you.  Stop already. It's a brand now. It's a brand. It is wack.  I'm like, for what? Like, where are you getting business to do this? I'm like, it's a brand for you now. Like, I know you like, I know how you think. I've had conversations with you. We drink together. I know how you really think about a lot of this shit, but I know you're following. I know how you pay your bills and I know you have to say certain things and write certain things because that is what you've cultivated. You know why it's wack?  I can tell you exactly what they're gonna feel it. They're gonna feel it when eventually those guns turn on them because what they don't understand about it, it's a circular firing squad.    And the second your opinion diverges from what they agree with, you are part of the food.  That's why, here's the thing about what I realized about the woke folk and the people who run the woke folk. It's the easiest way to get a following, right?  Look what a good person I am, but it's the quickest way to lose. Oh, for sure. Think about the people who got it this year. Bro, they gave it to Lena. It was Sean King. Lena Waif. Sean King got it too, but they gave it to Lena Waif. Wait, what happened? What happened with that? Oh, they came at Lena. What? Dude from Straight out of Compton. Jason Mitchell. Jason Mitchell, right.  Once I saw that shit, I was like, I'm done.    What were you, bro? I was home. Okay. I was home chilling, bro.


Inside Hawaii real estate, I show dedicated to providing up to the information used to Hawaii home buyers, sellers, and investors. I'm with my co-host, business partner and wife, Leonie Lam, a realtor with over 20 years of experience in various leadership roles in the Hawaii real estate industry. Thanks, Will. Will is a lawyer and also was the former head of a Hawaii title and escort company. And now we work together as a team to bring you the latest in Hawaii real estate. All right. And, you know, in terms of the interest rates, you know, today is actually below 7%, conforming rates 6.75%. So it's a really positive news for both buyers and sellers looking at Hawaii real estate. And today we have a very special guest, Richard Emery, a colleague of ours on Think Tech Hawaii, is also a real estate commissioner. Hawaii real estate commissioner, principal broker of Hawaii First Realty, vice president of Hawaii Affairs for Associate Hawaii out of their corporate office. And did you know he's also an expert witness and instructor for continuing education classes for realtors. Wow. So today is all about the future of condo ownership. So we're going to talk about the future maintenance fees, reserve studies, and affordable housing in condos. Welcome, Richard. Welcome, Richard. Both of you. Nice to see you both again. Thank you for inviting me. Thank you so much for being with us. And Richard, you do such a fantastic job with educating realtors and the real estate community. And so based on your current courses, I just was wondering, what are the key trends that we should know about in Hawaii real estate? And what about the legislation, legislation and everything like that? Can you kind of give us some ideas of what you're seeing or what you're teaching? Well, with regard to the legislation, we see our legislators always interested in more consumer protection. So you see new laws passed every year that fine tune or add consumer protection requirements for buyers of real estate and or condominium association boards, whatever they may be. So you're seeing a lot more consumer protection driven. And today, more of the this past year in 2023, we had about 70 bills introduced affecting condo associations. Only four or five pass, but every year they're trying to tweak the consumer protection side of this. And so we saw some major shifts in legislation this year with regard to condo association particularly. What can you tell us more about the major shifts that we saw or that we're going to be seeing? Well, you know, there were several, I'm going to call them major events in the last couple of years. We all heard about the Florida condominium Champaign Towers West or South, I think it is, that collapsed, you know, and people lost their lives on top of that, lost their homes and they had mortgages. That's another story. Well, then on top of that, we've read in the paper here locally of several larger condominium towers where they've had major multi-million dollar assessments that were not planned for resulting in major assessments, special assessments to the homeowners of up to $50,000 per unit. And so, you know, we had a reserve law adopted in 1992. So how can that happen if you're doing your reserves correctly? So the laws we've seen have been impacted was to bring our budget reserve studies side more in line with national standards. And number two, a greater emphasis on disclosure, which is our core classes, your disclosure, disclosure, disclosure. And more requirements for associations to disclose more in summaries in the budget when they distribute it to the homeowners or potential buyers. So a lot more emphasis on the reserves and the financial situation of the association. Well, that's good news.  Over 400,000 condo residents. And there's millions and millions of dollars in special assessments. On average, maybe close to $300,000 in special assessments per condo. And I think you had mentioned on one of the slides, there's, you know, of course, residential, multi-zone, commercial, I mean, just a whole myriads of types of condos. So when it, you know, when you're talking about $600 million in special assessments, what type of assessments are we really talking about with these buildings? Well, probably the correct term would be regular assessment. And that is the maintenance fees that are charged on a monthly basis to the owners. I've never particularly liked the word maintenance fee because you get water sewer, you get insurance, you may have some of these cone shares level condominiums, cone shares and front desk services. So it's more of an operating fee, but over the decade, we've called it a maintenance fee, which kind of tells people it's for maintenance, which is not true. It's really an operating fee. The problem is when 514B, originally 514A was written, it really established a condominium as an organization. And as an organization, the legislature has a little power to change that contractual relationship between a board and the owners who are in the governing documents and the founding documents. The legislature can't interfere with private contracts. So you're kind of stuck with that, to live with that aspect of it. But these maintenance fees, you see, for some reason, my experience has been, boards have this thought. The third goal is to keep from raising maintenance fees. That's their purpose in life is not to raise maintenance fees. If they didn't do, if they do, they've done a bad job. But in logical perspective, under the law, a condominium budget is prepared on what we call a zero sum basis. That means you add up all the operating expenses, you add up what your reserves should be based on a reserve study, and you multiply it by a percentage of common interest. So that's what the maintenance fee is, or the operating fee, regular assessment under the law. But what happens if you underestimated the electricity? Electricity is $100,000 more this year. But where does the money come from? You didn't collect enough from everybody to do it. It comes typically because they don't fund the reserves because they're short money and they got to pay the electric bill, and they haven't been putting enough aside that they can fund the reserves per the reserve study. So what we're seeing is a problem in the industry is all this with these older buildings now is hitting the fan. That's a huge assessment for those associations that did not properly plan and put enough money aside. Richard, let me ask you, that's a great point in perspective. And in terms of these budgets and reserves and the financial aspect of it, is it the board members who's overseeing this? Is it the property managers who's actually ultimately responsible to make sure that each of the condo buildings have enough funds and they're looking 10, 20, maybe even 30 years out? Well, that's a good question. The short answer I always tell everybody is that in the end, the board is ultimately responsible for everything under the statute. They have the ultimate responsibility. They may hire lawyers or reserve specialists or property managers to guide them. But there's nothing the law says that the board has to listen to them. And so the board ultimately is responsible, but one of the standard of care for a board is relying professional advice.  So I think the overall problem has been is that the boards just don't want to raise maintenance fees. They don't look at the true cost of what it costs to maintain a building. And they want to skimp on the budget saying, well, we'll make it work at a lesser amount than it's actual. If you take the one recently in the paper, which was I think one Archer Lane at $17 million was the assessment if I remember correctly. I have a database of all the reserve contributions of all the maintenance fees for most of the projects in Hawaii. You can take that one project and look at their comparison of maintenance fees with other like projects or similar projects. And they were paying per average unit about $200 a month less than similar projects in the state. Well, if you take $200 times 400 units times 15 years, there's the $17 million short, you know, around term. So I think at the end of the day, the board is ultimately responsible. But what's interesting in the current legislature 2023, they passed the law because under the current law, the board can do the reserve study themselves. They don't have to hire professionals. So the law was amended and changed the effect of 2023. Every board, not less than every three years has to have that reserve study, if not prepared by a certified professional independently reviewed for adequacy. Now the interesting thing about laws are you can say a board can say, okay, I'm going to go hire somebody to do that. And they can get the review and the board can then shrug his shoulders and said, thank you for the review review. I'm still not going to do that. So it's not a perfect world because under the national standards. And you may, I may have mentioned to you that I'm in the National Task Force Republic Policy and Reserve Studies. So the title is, it's a budgeting tool. It is not science. You don't go out and get engineers and architects to look at issues. It's kind of budgeting a cash flow to give you the best chance of having enough money when the money comes due. And if thoughtfully done, works out really well and you see associations not having major assessments and problems with the reserves. Richard, I'm so curious, like how did you get, how did you become so passionate about condominiums in Hawaii or real estate in Hawaii? Like how did it all begin? I had bills to pay. I needed a job. Now, it's, you know, it's interesting. I shouldn't say this probably, but I use this as kind of a joke because there are kind of many management, the top business with all the homeowners, the agendas, the private issues. You know, all the condos are different. There isn't one size fits all. So I got into the industry in 1992 and fell in love with it because I have a good ability to talk to people and bring common sense to the table. And that caused me to get more and more engaged in the various technical aspects. But the joke I use often is that, you know, two guys are talking and are looking at me and they're saying, you know, he's in condominium management. They're saying, no, not condominium management. And he looks so bright. And the other guy says, well, just remember that the speed of sound is slower than the speed of light. You know, but no, I am passionate about it because I feel the boards, even management companies today, don't have in all cases the technical expertise to understand the options. Even if you're underfunded reserves, there are choices today you can make to get yourself back on target without it being too punitive.  Now, why would they raise it 50%. Well, prior to then the old board took honor and in fact they hadn't raised their maintenance fees in 10 years. And what do you think they did that a reserve contributions over 10 years because cost went up. They reduced the reserve contributions every year, every year. So this large project. At the end, before I got to be a consultant for 400 units was contributing on an annual basis $5 a month per unit towards reserves. Wow. I mean, that's horrible. So I think that we need to have more education with board members, more workshops, more solution based answers because it's solvable. I'm not going to say you don't have to raise fees because in that case they had a race fees 50%. You know, but they had 10 years of a free ride. You know, so I just think boards need more education. They need to understand that their fiduciary duty is to the association and the preserve and protect the assets and make the place a nice place for people to live. That's the equity portion of it. You know, as it pertains to the condo owner themselves when they are when an assessment's imposed, I mean, what are their choices really because what if they're not financially prepared to pay whatever assessment it is if it's, you know, 10s of thousands of dollars and what have you seen in that in those cases. Well, what I say to boards when we come across that, let's just say they have a $10,000 assessment per unit. And I mean, no disrespect by saying this. You have haves and have nots. Some they'll write you to check for 10 grand or they have the bank ability to just go borrow from a bank. But then you're going to have the have nots. So if you're assessing the amount of money you need and only 20% don't have the money. You're 20% is shorting and paying the vendor. So what are you going to do sets the other 80% the ballot to pay the vendor you have to pay the vendor. So we always promote a dual choice. One, approve a loan. Over you get up to 20 year amortization and maybe that's $100 a month. And those owners who want to pay the present value and not have the $100 a month for the loan can do so. So you give the house and have not the chance to keep their home and not be affected by that. So we promote loans and borrowing. If you build the concept correctly, we have present value payoff. So that owner sells this unit. The new buyer demands the present value be paid off at all sorts of self out over time. So we promote don't stick your head in the sand. Come to the financial plan. Because if the answer is $100 a month, you know, even that's a lot of money to some people, you still have to deal with it. And what I've been saying all along to the legislature just everything they do and they make these legislative mandates only make it harder for affordable housing because the money has to go to somebody if it goes to the association. And it all for me goes to the owner. So someone's got to pay for it. So we need better planning and better analysis of how this works. Not so bad really what you really turn looking where your choices are. Hey Richard. So, you know, in terms of perspective buyers looking at condos.  And, you know, you're looking through the condo documents and you're trying to get information. What would you be paying the most attention to? Good question. In July of 2023. Governor signed a new law that required seven specific disclosures in the condominium budget. I'm very familiar with it because I wrote it. And the problem is that people who are new time first time owners even long time owners. Don't understand these documents and they're usually about three or four inches thick and they don't know what to look for. So the new law that was adopted mandated. Beginning with all practical purposes 2024 was effective in 2023, but most condo budgets are calendar year mandated seven specific disclosure. And they were kind of as follows in short firm. Number one, how much money do you have in reserves? How much money did the reserve study say you're supposed to put in? Did you last year put that amount of money in the reserve study? If you did not, what is the impact on the future contribution? What does the reserve study future contributions show? Because you can do a reserve study that shows 10% increases in contributions every year. Not main list fees, but the reserve portion of the main list fees. And then you have to disclose all these future financial obligations that either weren't done in the prior year or need to be done next year. If the budget summary is included as required by law. That's the first thing I would look at at the seven things, which because you're really lit this test on the financial condition of the association and simple layman's language. Awesome. So definitely by 2024, we should see that sort of summary with the seven, seven things to look for within the condo docs that are like you said, three inches, three inches high in most cases. I'm hopeful the managing agents get engaged and the board get engaged in this because I'm telling you right now that mortgage companies going to be looking at reserves closer. And it'll be harder to get them. I know projects today can't get a mortgage because the reserves are such bad shape. And so you're going to see that aspect of it. I see often they do this expert work where new owners buy and there's a special assessment. And they sue the board and the managing agent saying your budget and your reserves, they didn't comply with the law. I mean, there was no identification that there's going to be a we're underfunded. They needed to have a special assessment the year after they bought in that particular unit. So you're going to see more and more lawsuits regarding that issue. And that's why I'm hopeful the managing agents take this mandatory budget disclosure and put the time and energy in to make it worthwhile because I think the industry is going to work itself. If we have the penalizing the board and say we're going to find the board $1,000 is not going to work. Nobody's going to serve on the board. You know, so you need to have more disclosure and that the mortgage companies and the banks and and the buyers affect the real estate values. And then things will start to write itself. My opinion anyway. So, you know, just those seven items that you discussed. I mean, I think that's really vital for any prospective buyers. So if if you see something like, okay, there's a big special assessment coming up or increase in maintenance fees of 20% or there's pending litigation. How do you view those items? I would look at what it says and determine how much it may not bother me that they have a loan and they're going to fix everything. I love the building and it's still affordable to me to pay the loan and the and the maintenance fees. So it may not bother me may make it more positive because they're fixing the building and taking care of it. Right. So I have to take each case separately and look at what what the report says, but the fact that it's a mandatory disclosure. There really is no excuse for a buyer not to read that one page or two pages depending on the complexity and understand fully what they're buying into with the financial future it's going to look like for that project. And I do a lot of consulting on reserve studies and and there's some good reserve studies out there and there's some very bad reserve studies. And I teach a CE class called understanding condo financial statements. It's written for licensees is not written for property managers. I think that's all the financial document pointing out the areas you should use a licensee should be aware of, but again, a licensee is not trained at this either they're not going to want to offer professional opinions on something. They can always say, I would talk to a reserve expert or this is what the document says, not opine on whether they agree with it or disagree with it. You know, but I think the more disclosure we can have the better off with the industry.  Yes. Yes, and I'm wondering, can you just kind of generally just what what are the responsibilities of the Hawaii real estate commission. What is their function, what do they do, what do you do. Again, there's the staff, which is the real estate commission staff, which is the full time employees of the state, who really handle the operations on a day to day basis. The real estate commission is a part of the Department of Commerce and Consumer Affairs and everything I'm saying to you as an individual, I'm not speaking as a commissioner. So, when you look at that you have basically with the DCCA when it gets to licensing to agencies which are separate. One is called the regulated industry complaint office, which handles complaints for all licensees, whether it be a hairdresser use car dealer real estate licensee. And then you have the real estate commission, which sets the policies of the real estate under the laws and the statute. So what do we do as a commission. Well, first of all, we're approving those people who pass their tests and have qualified to be a licensee were approving their licenses in some cases because they have some prior legal baggage. We're giving them predeterminations that if they take the classes and pass them and they're not wasting their money, we would still approve them as a licensee because people get drunk driving violations, all sorts of things in the past. They don't want to spend the money for classes and if they aren't going to get approved because of whether they have to have the real estate commissions approval. Then we have matters where Rico has negotiated a settlement on a violation of the real estate law. They are handled by the real estate commission for approval. So we will have three or four cases a month where there's been some issue could be misrepresentation could be failed to keep the trust funds correct. There's a zillion of those where the Rico has negotiated a settlement and and and we approve the settlement. Now, if they're unable to agree upon a settlement Rico and and the licensee, they would actually go to a formal hearing before the real estate commission where you present your case and do depositions and and make arguments. We don't see that too often. Usually these things resolve themselves pretty quickly. People may not agree with all the resolutions, but there is a fairly significant penalty to a licensee for not following the law. You know, so that's kind of what we do. We approve CE classes. We approve core classes. We have subcommittees for condominiums and laws. We do lobbying into legislature and proposed laws and things like that. It's done by nine member commission. Some are from the public at large. Some are frienders. Some are licensees and from wide variety of brokerage firms. And they're pointed by the government by the Senate and the chair is appointed by the governor. Thank you for sharing about that because I think that's good to know, right? Not everybody knows about the real estate commission. And so you find it so eloquently. Thank you. And simply to understand. Well, it's interesting because it's a volunteer job. You don't get paid for it. And this is a three to six hour a month commitment. It has very regulated policies and procedures to public hearings and openness and sunshine, all kind of stuff. But you can aid the community and the licensees as a whole and the consumer protection by having people who are knowledgeable and not no conflict of interest trying to keep the industry safe and solid because in the real estate world, we have very few lawsuits on real estate matters compared to the other licensee type organization. So it says a lot about our training and our ethics and integrity. That's great to know. And you know, just kind of going back to the condo topic. Would you actually consider yourself an advocate for condo owners or for the associations? That's a great question because I'm an expert witness, right? Probably three out of four of my cases I represent condo owners. And one out of four I represent associations. I'm very proud of the fact you can take all my expert opinion and you'll never find I ever contradicted myself. I've been consistent on the four pillars of good governance and what, you know, either the owner is wrong or right or the board's wrong or right, but I advocate trying to get together and resolve the issue versus spend lots of money on legal fees. That's great to know.  I mean, this could be like a five part series. You know, with that said, is there any last message that you want to share with our audience? The thing I say always to the audience is remember this. A condominium is a organization established by statute or by laws. As soon as you live or buy an economy and you're subject to statute and laws. And that means you have to give up certain rights. The appellate court recently ruled on a case that sometimes condo owners don't know they have to give up certain rights like on how they walk their dog or when they can. I do a wonderful class on rulemaking. Like, can you can a board keep you from flying or flying the American flag? That's quite an interesting one of my core cloud or my CE class. But the reality is we live in a condo. You have to give up certain rights and you're better off. You have a problem.   All the areas of expertise that you have and we were just so appreciative that you came on inside Hawaii real estate to share your knowledge and we learned a lot. Well, thank you for inviting me. We wouldn't want to come back on another topic someday. But I have a passion for the industry and and we have a good industry, not that we don't have areas we can improve. But I think that was the national liaison for all the states for CAI Community Association Institute. Our laws are more robust and work into our protection than most any other state. The one thing all condos have in common Hawaii with every other state is a function on self governance. Well, thank you so much, Richard. We really appreciate all your time. Yep, I hope we get together sometime and talk story. Thank you. Thank you, Richard and Aloha. Aloha.


So, okay, I'm in the corner. Hey, I'm in the corner. Hey. We're back, so we know who's going to call.


We know so far so we're looking at how do we deal with keys because In practice that could be a major flaw in the security of our system if someone can find our key Then it doesn't matter how strong your encryption algorithm is they can defeat the security We're going through different approaches for distributing and managing key some of the principles that we've heard so far Yeah, we'll get to KDC but one principle is Don't use a key too often change keys Okay, that is don't use one key forever So this leads to this principle of having a key hierarchy We talk about often a master key and a session key Use your session key to encrypt data, but change it on a regular basis and When you want to distribute that session key encrypt it with a master key So this hierarchy of keys This concept that we usually want to when we have a lot of data to encrypt use symmetric key encryption It's generally faster than public key encryption For symmetric key encryption. We need a shared secret on either side So we've gone through It's hard to see here, but symmetric key distribution using symmetric encryption that is Distribute master keys somehow Somehow may mean manually doing it Distribute master keys and then to distribute session keys encrypt them with the master key So we can send them across a network securely and we saw different ways for doing that and one was KDC the key distribution center where we all go via some trusted third party Another way to distribute Symmetric keys that is secrets Encrypt them with public keys Okay, if I encrypt with your public key a Secret I can send the ciphertext to you and only you can decrypt it even if someone else intercepts so using Here we call it asymmetric encryption, but maybe easier public key encryption to encrypt symmetric keys shared secret keys We saw we saw an example of using public key encryption or public key algorithms to distribute a Secret anyone remember the name of the algorithm to distribute a secret using public key No Has an F in it all done Anyone else want to have a closer guess What's the algorithm that we went through towards the end of the lecture last week? Named after two people Diffie helman Diffie helman to people they invented well, maybe not invented, but they were the first to publish about the concepts of public key cryptography and their algorithm the one that we saw was that You want to get a secret between a and b by using the Diffie helman key exchange. You can do that and It's secure under a number of conditions So we went through that and we'll see that again today Another thing we've seen is that okay if we want to distribute public keys One way is I just tell you what my public here, but we saw that a man in the middle attack Makes that not very secure someone can intercept and modify the public key and pretend to be everyone else Any questions on Diffie helman? So we can have a quiz on Diffie helman Okay, you'll need a piece of paper. Just pass around the blank pieces of paper actually It won't for you. Just one piece of paper an informal quiz an Informal quiz that is it won't be assessed If this is we use steganography to hide the quiz questions okay, no just a blank paper so we can do some calculations and Hang on to it. It's okay Others may want it Not a quiz just a task and we'll use we'll just give you an example of using Diffie helman So I'll show the slide Because I maybe you don't have it from earlier lectures Let's go back Where is it? Diffie helman just give you a task of using that algorithm and You can do it. How many people do we have a big turnout today we can do it in Triples three people One will be the sender one will be the receiver one will two two users want to communicate and one will be malicious So you'll see how it works I'll show the algorithm. Maybe hard to see but give you hints so I'll give you some parameters in a moment what I want you to do to get started so everyone can do it on their piece of paper Is that You're going to let's say One person is going to Wants to share a secret with one other person Okay, so two people want to share a secret so you're going to use the Diffie helman algorithm So the first person will follow the steps and the second person will follow the steps. I'll exchange the public values Tell each other their values Generate their secret key and then with that information we'll see if someone else can can defeat and discover the secret so This is the algorithm. It's a bit hard to see on this diagram, but To make it simple we'll use small numbers so you can do some calculations. So let's There are two two public values and you can all use the same value Q and alpha Q should be a large prime number Alpha is a primitive root of Q. Let's give you two values. Let's choose Q and so everyone can use these values Q is being a Large prime number 19 not too large, but Enough for you to calculate the answers with Diffie helman hand. Okay, so of course Q should be very large in practice 19 is not Not appropriate, but just for manual calculations It's small enough that you can do on paper and alpha is three So these are public values everyone knows them so everyone can see them then For you to exchange a secret with another you follow the algorithm and the algorithm is that what you choose Your own private value X Which is less than 19? So choose a value less than 19 now write it down actually Yeah, maybe if you haven't written it down. Don't write it down. Just memorize it You can write it down. We may have to tear the paper off to give to someone else in a moment. All right write down your X Don't tell anyone So you choose some X in In the algorithm. We've called that X a that is user a chooses an X user B does the same thing and then you calculate Y as Alpha to the power of X mod Q so for your value of X Calculate Y for those that arrive late. We have some spare paper for you Can X be minus one? No X in theory. We're using modular arithmetic. We don't deal with negative numbers X should be zero to 18 You should choose it randomly X So Choose your X. Don't tell anyone Then calculate your Y Where everyone is using the same alpha and the same value of Q You've got your own Y value Now you may need a calculator or Some of you may be able to calculate it depend upon the values your phone will probably calculate these I Think you can calculate these with a simple calculator. You don't need much Who has their Y values? So maybe a calculator a tablet or phone is your chance to use your laptop So your chosen value of X a random value between zero and 18 And each integer Then calculate your value of Y.  I've written X a and YA, but from your perspective. Let's just say X Of course both users will do it B would do the same But you don't have to do this just do it once one X calculate Y a General algorithm.  Don't copy the screen choose some X and Use the equation Y Equals alpha to the power of X mod Q Y equals alpha to the power of X mod Q Don't copy the screen you'll get it wrong Okay, calculate your value of Y good Okay, some people have their values of Y. Okay needs his calculator just do it for you Don't do it for B The other person in the room is going to be B user B your user a So you'll need your calculator Just do it for one value of X Okay Can you calculate that? Okay, there's for those that are not quite Following don't worry about copying down the screen. I'm just repeating the algorithm from the lecture notes What you need to do is choose a value of X Should be less than 19 an integer less than 19 less than Q and Then calculate Y alpha is 3 X is the value you chose Q is 19 and For that maybe you need your calculator when we have enough people will exchange Hands up for that who has a Y value Okay, a couple more minutes We have enough to exchange Those people that have a Y value may be the easy way to do it on The bottom piece of the paper can you rip it in half or so that you can so rip the paper in half? Or it doesn't have to be in half just rip a little bit off that you can write down.  Just wait. Let's get people Make sure they can write their name clearly so the algorithm is that So I'm drawing it from the perspective of two people. So the algorithm is that once the both entities of I've Calculated their Y they exchange them So you can do that your value of Y Exchange with someone so both of you swap your Y values. Doesn't matter who someone nearby Exchange yeah Okay, now that exchange was done in the public Someone we assume anyone can see those values. They are public. So imagine really you were sent them across the internet in an email Anyone could have intercepted and seen those values. So Yes, we could Maybe we'll do an attack at a moment But yes, we it'd be better if you wrote it bigger and everyone could see the values, but not so easy next step Once you have their Y calculate K and this is from the lecture notes you use the other persons Y and Raise it to the power of your X So B is from your perspective B is the other person Okay, when I write Y B it means the other person So take their value of Y that they just sent you Raise the value of your power of your X Mod by Q Here you Calculated it's going to be useful and of course So everyone follows that Your X There why? Plug them into the equation and find K You'll need your Mod Q. Yes, sorry mod Q everything mod Q in this algorithm where Q is 19 So calculate your value of K and when your partner has calculated just kind of now This is not what you do in in the real network, but Compare your values of K With your partner just make sure everything worked Make sure everyone did it correctly once you've calculated your K and your partner has calculated their K Just compare just trying to show that it works. Did you get the same values? Magic who's your partner?  Check make sure you calculate it first What is K the key? The secret. Yes, it should be the same But make sure you calculate it and make sure you do get the same value When you calculate your K and once they've calculated theirs see what you end up with You may need your calculator. What do you get? What's your partner? What do you get? Okay easy K you exchange a secret with who? Okay, okay Okay Why did you get the same values? Magically chose the same X It'll work his computer is slow He needs an upgrade did it work? Okay, you should find that you and your partner end up independently with the same value of K That's the algorithm saying We publicly exchange Y When I say publicly, I mean let's say we sent sent it in an email across the internet anyone can intercept them The idea is that both sides end up with the same value of K K is the secret Our objective is that A and B share the same secret and that's just showing that If you did it the calculations correct, you should get the same K The K. I'll denote this as K a The K B that your friend calculated they used your value of a their value of Your value of Y their value of X mod Q So both of you calculated K separately using the opposite values and you end up with the same value and That value K is the secret they should be the same This we did last week and then you use that so in practice You'd now use that K as your secret. Let's say if you're going to use a yes to encrypt some data Or to encrypt some other information to exchange so from now on You use your value of K as a key when you're using symmetric key encryption because both entities know that key so if I Use triple desk and the key is my K a I encrypt I send across the network When they receive they use their key K B and they should be the same and Therefore they can decrypt So you can prove quite easily and we did that last week why they'll be the same the mathematics is quite simple Just it do some substitutions and you'll get the same equations for both sides What's public in this? What does a malicious user know the public values Q alpha Y a and Y B They are public in that We assume everyone knows the value of Q what value of Q to use Okay, he's told everyone so everyone knows he used 19 not a problem Alpha was three and it's okay that everyone use the same value and The value of wise I know you exchange them physically But let's say we did that across a network you could have sent that in an email and Even if someone intercepts with those wise it should be hard for them to find K now Give your values of Y to someone else So the two people that exchange their wise give those pieces of paper to a third person the malicious person Try that so the two people that exchange their wise give both of those pieces of paper to someone else Give both of your wise to someone else down here There you go both of your wise That's fine Doesn't matter if everyone doesn't get one you'll survive So not everyone will have a value. Okay, so for example these two people give their wise to a third one Okay, now that third person Your challenge is to find K The third person who's intercepted those two values of Y find K So the third person just intercepted YA and YB They also know Q and alpha find K See if you can find it at least work out the steps that you would use to find K You're the malicious person now if you've got both of those values If you have those two values of Y of someone else Now try and find their K Try and determine the steps that you would use to find their secret Now, of course, not everyone has two values of Y So you've got two other values of Y that other people exchanged find their K and Alright That's your challenge How do you do it? Well, remember the steps that they used So it's not so neat here, but what did they do? You know why YA and YB You want to find K so use these equations to find their K Without hitting them on the head asking them for their X. You're not allowed to beat out of them No, their X is private Don't tell anyone your value of X You have two people's values of Y So if you have two other people's value of Y the two people that exchanged Given those values try and find the K that they found That's your challenge. That's one step. Yes We eventually want to find K. So you have two values of Y Make sure it's the two values that people used in exchange. It's not two random values of Y It's the two that the people exchanged you have those two values of Y Find the K that they have If you can find their secret key, the system is not secure By definition the secret key should be secret to those two users Some people may find it at least be aware of the steps to find it. So you are now C Not A or B. You are user C So what do you know you know why A why B the other two values of Y, you know alpha, you know Q You want to find K anyone found K yet K of someone else So this is the attack that you're doing as a third user Given those values find K and I'll repeat the equations so you can use them again You know the steps that the other users used You know exactly what they did so you know these equations So this is just the same as before as the attacker. This is everything you know You know why A why B your two friends values of Y and you know the steps that they use to get them So given all that knowledge Find either K a or K B because they should be the same K a and K B should be identical Anyone got someone else's K It's possible, but it's think you the brute force that how many possible answers are there mod 19? You may be lucky Let's see what you need to do.  Let's take a pair of someone's wise You chose you determined a Y. What's your why? Why? You had four and you had your value of Y To so I'll just take an example Two people exchange values of Y if I'm the attacker and I intercepted these two people's values of Y Then I learned that one was four and one was two That's what they had So this is everything I know So now I need to find K so we just look at the the Equations and see what we can do with them. So look at what's known and unknown for example here Y a I know is 4 Alpha is 3 X a I don't know and Q is 19. So one thing is the attacker. I know is that 4 equals alpha The power of some X a which I don't know mod Q and Q was 19 So now my challenge if I find X a I Can then use it in the second equation because the second equation I know is K a K a is Y B. I know Y B. It's true X a I don't know yet and mod Q. I know Q is 19 So this is one approach. I want to find K If I find X a it's easy I just take 2 to the power of X a and I'll get K, but I don't know X a but I do know this equation 3 to the power of something mod 19 equals 4. What is that something? That's my challenge So find the exponent in this case. It's possible. You could do a brute force and find it How many possible values? The way that we chose the primitive root of 3 here meant that all possible values that is 0 through to 18 There should be 19 possible values there. Does anyone know the value apart from the two people? Three to the power so with one way brute force three to the power of one Mod 19 does not equal 4 so X a is not one Three to the power of two nine mod 19. It's not equal four. So X a is not two three to the power of three 27 No, that gives us eight three to the power of four 81 Doesn't get us there. So we keep trying X a is one two three four five and Eventually, we'd get to three to the power and I'm not going to try I'm going to steal from someone else once eventually would get to X equal to anyone want to guess 14 three to the power of 14 If you try it three to the power of 14 mod 19 Try it on your calculator. What do you get? Three to the power of 14 mod 19 Check if he did it right Mod now mod 19 You need a calculator with a mod button Three to the power of four, which is some big number. Sorry three to the power of 14 Let's see if my calculator has what we have three to the power of 14 mod 19 for okay So my calculator says if X a was 14 I get four and That was the problem to solve. So a brute force attack a brute force attack would be to try What if X a what if it equals zero? What do we get? Well, we get three is the answer. So that's wrong X a equal to one Sorry three that we get one is the answer X a equals one three to the power of one mod 19 gives us three That's not that's not four Two and we keep trying and down to 14 Three to the power of 14 mod 19 equals four That's correct. Therefore X a is four 14 Get there if X a Is 14 Then K a is two to the power of 14 mod 19 two to the 14 mod 19 six Did I get it right? So your value of K that you calculated was six and you calculated K of six and Now as the attacker I found their secret. It's no longer secret. So this attack is possible because a brute force is possible Try X a of zero one two three until you get the answer here that equals four X a of 14 for three to the power of 14 mod 19 is four So therefore X a equals 14 plug it into here and you find K How do we stop the brute force attack make what bigger make Make the prime Q bigger okay, the way that we choose the prime and we choose a primitive root of it is such that The number of possible X a's that we need to try is equal to the value of Q here So in this case the worst case would try 19 values zero through to 18 and then we get the answer If Q is very large, we need to try many possible values of X a so Q is a Hundreds of digits a very large prime then a brute force would take forever So the way to stop the brute force is make your prime very large The so if we can't do a brute force The general step to find X a It's a logarithm Three to the power of something equals four So the inverse of this exponential is a logarithm and we can write it running out of space but X a equals the discrete log Why do I call it D log because we're doing a modulo arithmetic we call it discrete logarithm base is three mod 19 of Four that's the problem that we need to solve Find the exponent such that three to the power of that exponent Mod 19 equals four. There are no known algorithms that will do that in reasonable time with large numbers So if we make a game Q large enough Solving the discrete log is not possible and that's where the security of this algorithm comes in that is Because discrete log is computationally hard to solve just make the numbers large enough and no one can find K Except the two people who knew the values of X Any questions Diffie-Hulman you should be able to do it in the exam in a few weeks I will not require you to remember the entire algorithm, but Doing some calculations understanding what the challenge from the attacker's point of view It's the challenge of discrete logarithms Where is Diffie-Hulman used anyone Maybe some people have seen it if they took the lab on Monday Maybe some people did Diffie-Hulman is commonly used in secure shell Secure shell allows you to log in securely to another computer Okay, so there's a server you have your secure shell client You connect to that computer to log in and all of the data is encrypted But what do you encrypt it with you must encrypt with a shared secret key and those two entities the client and server use the Diffie-Hulman key exchange algorithm to exchange a secret So that's one common place where Diffie-Hulman is used Used elsewhere as well any questions on Diffie-Hulman key exchange Finally got the answer It doesn't help if you use the wrong key to start with then it's harder to break Okay, so of course your computer does this calculation for you. Did you get it? Who was the who worked together both of you what was your key? Did you get the value of K? One what did you find? Seven did you get a value of K? I Think you've both got the wrong but different values of K. That's a problem So some step went wrong when you calculated K And so it's hard to break Yep, then you once so in my case Once I found X a to be 14 Then I found K to be six and then I've won. I've found the secret of the other two people Everything they encrypt using that secret I can now decrypt So the goal was to find K So if you found it then you were successful any final questions. Did you find K? Whose K did you find and who did you share your value of Y with? So two people exchanged Y who? So you're You're supposed to find someone else's value of K Try that on paper at home. You can try it yourself. You choose your own separate values of X generate Y's and Then calculate the K's and see the problem you need to solve if you didn't know the X to find that the secret key K So Diffie-Hellman falls in the previous set We distributed a symmetric key a secret Using a public key algorithm and the public key algorithm is called Diffie-Hellman So we use asymmetric encryption to distribute a symmetric or secret key We will not try it, but you could have done it did a man in the middle attack in that case When you receive someone else's value of Y How do you know it's their Y and it's not someone pretending to be them who's in the middle who's changed the value? So a man in the middle attack is possible against that key exchange algorithm And that's a problem with public key key exchange. We need to Make sure that the public key that you receive in that algorithm the public value was Y Make sure the value received is the correct value We saw it an example where we saw an example with this scheme Last week we said we could do a man in the middle attack where someone Changes PUA to PUC and defeats the security this scheme. So The general problem arises. How do you distribute public keys? Your next homework task generate your key pair I think we need at least one more homework task this semester generate your public and private keys How do you distribute your public keys? How do you get your public key to everyone else in the same way? How could you distribute those values of Y? How can you distribute public keys? A simple way if you have a public key In this room, what could you do? Tell them okay a simple way to distribute public keys is to tell everyone All right, so if it's in this room What he could do is stand up and start reading out his public key. It's just a sequence of Thousands of bits, but okay read out the public key and now he's distributed the public key to everyone Maybe you can do that in a small environment like this room But how do we do it across the internet? How do you distribute a public key across the internet and make sure no one has modified it along the way and That's the problem. We need to deal with here. How do we distribute public keys? For four approaches will go through public announcement. Tell them Stand up in the room and yell out. This is my public key Or in the internet post it on a website Okay, so there's some website that stores public keys of users and here's the public key of Steve Here's the public key of Tanarak and many other users some announcement It has this problem that it's difficult or impossible to know if someone's changed the value So men in the middle attack is possible an extension of that have some specialized directory that stores public keys There'll be some server and then we'll see some modifications of public key authority and eventually Arrive at the main technique used today public key certificates public announcements Tell everyone user a Broadcast to everyone else. Here's my public key. But how do we know that if you receive? Some public key from a how do you know it's really from a and not someone pretending to be a so this is What we saw where the men in the middle attack. It's not Not security from the perspective if someone can modify And pretend to be someone else We can attack this system. So public announcements like on our website or in your email It's fine except we don't know if it's been modified or not. So there's a problem maybe in a network we could have a server and We must publish the keys to that server So user a has their public key They go to the server and they program in or publish this their key their public key in the server in some directory and Then when user B wants to find the public key of a You can contact the server or the directory and We'll see a variation of that or an implementation of that in the next approach So all users publish their keys in some central location an example in this class Everyone generates their public key and Private key you all generate your own key pair. Then you all come to my office one at a time. I Check who you are. All right. I know who you are So I know your name and therefore I you give me your public key and I store your public key on a server and Everyone's student publishes their public key to me the directory or server and Then when two users want to communicate they contact that server to get the public key of the other user So we'll see an implementation of that. Of course, we must trust this server or directory We must trust that that cannot be fake This is an implementation of that that we can do across the network Let's go through and see how it works We'll call it a public key authority two users a and B and We'll go through the seven steps That we can send packets across the network But before those seven steps, there's the first case of that the keys are published in the authority So we'll draw it as we go We're going to have the authority like some central trusted server and We're going to have the users a and B a wants to communicate with B Therefore a needs to know B's public key and vice versa B will need to know a's public key That's our aim learn each other's public key So the steps first We assume that the authority knows the public key of a and the public key of B A knows its own public key and it knows its own private key Everyone knows their own key pair B knows its own key pair What I'm going to do is draw these seven steps But there's another piece of information known the authority also has its own key pair and the Users know the public key of the authority You could draw that on the slide because that's the known information at the start of the scheme Everyone has their own key pair A has its key pair B its key pair authority its key pair We assume a knows the authorities key its public key B knows the authorities public key The authority knows a and B's public keys How do they know them Similar approach we need to somehow pre-configure. Let's say I'm the authority How did I know your public key? You came to me and gave me your public key some manual exchange or in a network that there was some initial Communications across a secure channel that we are sure that these are indeed the correct public keys They're not fake public keys So we assume that they are known at the start and the goal is for a to know B's public key and Similar B to know a is public key and Not allow anyone to issue fake keys So given the known information we then go through these seven steps one two three four five six seven or With limited time we'll just stay with this diagram So from the previous slide or the previous picture Just remember the keys which are known These purple ones are the known keys at the start Everyone has their key key pair They've also exchanged public keys with the authority a wants to talk to be so step one a sends a request to the authority Saying I want to talk to be The picture doesn't say the contents of the request, but it means this is a message saying I want to communicate with B Please give me B's public key That's the meaning of this first message It includes a timestamp T1 is a timestamp. So the current time so that if someone tries to replay Then we'd be able to detect if this is a repeat of a previous message because the timestamps should be Ballad not too old and similar the timestamps used in the response So the request and timestamp are included in response So the initiator a can detect that this response is for that initial request The authority knows the public key of B. Therefore it sends back the public key of B But it's signed by the authority So encrypt with the private key of the authority Meaning this confirms that the authority issued this public key. What does a do? What does a do now after receiving message to? Before it sends message three. What does a do a receives? the response it checks a Sends a request saying I want to communicate with B send me B's public key Authority sends B's public key. It's here PUB But importantly, it's signed by the authority encrypt using the private key of the authority So when a receives this message to it verifies How does it verify if it was encrypted with a private key of the authority decrypt with the public key of the authority? If it successfully decrypts it means it must have come from the authority and No, we've assumed that a knows the public key of the authority at the start So I will not draw it, but when the authority sends that second message to a a uses the known public key of the authority to verify that received message to make sure it's real It's not someone else sending it if it passes the verification step three is a sends a message to be and The message is the identity of a some name or some address Announce value. Let's say some random value that a chooses and one Encrypted with a public key of B And you know when you encrypt with the destinations public key The only person can decrypt is the destination so by encrypting with a public key of B When B receives this only B can decrypt Because only B has its private key Where did a get the public key of B from? from the authority So remember that's our problem When we have a public key, we need to know that it is indeed that person's public key It's not something doing a man of the middle and the way that we achieve that is that the authority Issues or signs the public key confirming. This is the public key of B When B receives message three It decrypts and It realizes a wants to communicate with be a is initiating some communications So now it requests a's public key from the authority so step four Send a request with a timestamp The authority sends a's public key In a response again signed by the authority confirming this is a's public key It's not someone pretending to be a So really one and four two and five are the same but from the different endpoints perspective Request the public key receive the signed public key step four request a's public key Step five receive a signed public key step six is Step six and seven are just final confirmations authentication to say okay now that B has a's public key encrypt The original nonce received and one and a new value and two Send it to a only a can decrypt The idea for the nonce values here is if someone repeats message three at a later stage We can identify and and we'll be able to detect any replay attacks So if someone malicious tries to send message three When the response comes back will identify that because no one else should know n1 And similarly for n2 in the last step So really three is a message to be saying I want to communicate with you it triggers B to contact the authority to get a's public key and Then there's final steps for authentication B sends message six to a and a finally respond saying okay everything's fine If one of these last messages don't happen then it indicates that something's gone wrong Maybe an attack so we don't trust it because Message three six and seven are encrypted with the destinations public keys only that destination can decrypt and we know that they are the destinations public keys because They were signed by the authority and we trust the authority questions T is a timestamp and is a nonce and Nonce is a number we use only once a good example is a random number so n1 choose a random number with the idea that When we send a response We include that same random number The only way that we'd know that same random number n1 is if we decrypted the first one And the only way we can decrypt the first one is if we know the private key of B and only be can do that and Yeah, the time t are timestamps again to confirm that this request and Response are related if someone tries to repeat the message five minutes later Then a would detect that because it will see the timestamp is out of date Okay, it receives a message from five minutes ago, and it can ignore it because the timestamp should be recent a small delay possible the result B Knows a's public key. It receives a message five a knows bees public key It receives it in message two and they've confirmed that they both want to communicate And that's the aim of this procedure get the public key to a and B What if a and C want to communicate? What happens? Everything we repeat procedure so another entity C a wants to communicate with C Then they follow the same seven set steps separately a sends a request to the authority saying I want to talk to C Message comes back a sends to C C contacts the authority gets the public key of a and so on so for every pair that want to communicate They go through these seven steps If we get these public key now Then in practice what we can do is we can cache that public key So five minutes later when we want to talk to be again. We don't have to go through these steps We don't have to request The key from be again We can just do steps three six and seven to confirm that this is the Communications a star about to start So once we've got someone else's public key. We don't have to keep asking the authority for it So we can cache the previous value we've received a Problem with this approach is that every time any two entities want to communicate at least start some new communications The authority is involved. We send a request the authority sends a response B sends a request receives a response So the authority must receive a lot of messages now imagine not just two entities, but millions of entities in the internet All going to the one authority Then the authority becomes a bottleneck in terms of performance Many messages go to the authority. It must process and send them back So the problem with this approach is the authority is a bottleneck. It's slow Depending upon everything for the bottle the authority The alternative which will cover Thursday is what's used commonly in the internet today is public key certificates a small or a small modification to make Make it such the authority is no longer a bottleneck in all the communications and And when you access a secure website and you see that little lock icon in your browser If you click on that you will see that you can find the public key certificate of the web server So on Thursday will move on to the the commonly used public key certificates will stop there In the firewalls lecture notes. I included a few other handouts towards the end So bring the firewalls lecture notes that extra printed copies that you collected last week on Thursday Because there are a few slides in there that we will use on Thursday. Okay, so the firewalls lecture notes a Few extra sub slides on certificates are attached to the firewalls lecture notes