This is a LibriVox recording. All LibriVox recordings are in the public domain. For more information or to volunteer, visit LibriVox.org. Reading by Mark Nelson The Cosmic Computer by H. B. Piper Chapter 5 The meeting was at the Academy. When Khan and his father arrived, they found the central hall under the topside landing stage crowded. Kurt Fawzi and Professor Kelton had constituted themselves a reception committee. Franz Veltrin was in evidence with his audio-visual recorder, and Colonel Zareff was leaning on his silver-headed sword-cane. Tom Brangwen in an unaccustomed best suit. Wade Lucas, among a group of merchants, arguing heatedly. Lorenzo Menardis, the distiller, and Lester Dawes, the banker, and Morgan Gatworth, the lawyer, talking to Judge Lidue. About four times as many as had been in Fawzi's office the afternoon before. Finally, everybody was shepherded into a faculty conference room. There was a long table and a shorter one T-wise at one end. Fawzi and Kelton conducted them to this. Both of them were trying to preside. Kelton, because it was his Academy, and Fawzi, ex-officio as mayor and professional-leading citizen, and because he had come to regard Merlin as his own private project. After everybody else was seated, the two rival chairman presumptive remained on their feet. Fawzi was saying, Let's come to order! We must conduct this meeting regularly!  If either of them took the chair, the other would resent it. Kahn got to his feet again. Somebody will have to preside, he said, loudly enough to cut through the babble at the long table. Would you take the chair, Judge Lidue? That stopped it. Neither of them wanted to contest the honor with the President Judge of the Gordon Valley Court. As a suggestion, Kahn, Judge, will you preside? Professor Kelton, who had seen himself losing out to Fawzi, asked. Fawzi, through one quick look around, estimated the situation and got with it. Of course, Judge, you're the logical chairman. Here, will you sit here? Judge Lidue took the chair, looked around for something to use as a gavel, and wrapped sharply with a paper-weight. Among Mr. Kahn Maxwell, who has just returned from Tara, needs no introduction to any of you, he began. Then, having established that, he took the next ten minutes to introduce Kahn. When people began fidgeting, he wound up with, Now, only about a dozen of us were at the informal meeting in Mr. Fawzi's office yesterday. Kahn, would you please repeat what you told us? Elaborate as you see fit. Kahn rose. He talked briefly about his studies on Tara to qualify himself as an expert. Then he began describing the wealth of abandoned and still undiscovered Federation war material and the many installations of which he had learned, careful to avoid giving clues to exact locations. The spaceport, the underground duplicate force command headquarters, the vast underground arsenals and shops and supply depots. Everybody was awed, even his father. He hadn't had time to tell him more than a fraction of it. Finally, somebody from the long table interrupted. Well, Kahn, how about Merlin? That's what we're interested in! Wade Lucas snorted indignantly.  There was an angry outcry. Nobody actually shouted to the stake with the blasphemer, but that was the general idea. Judge Ledoux was rapping loudly for order. I don't know the exact location of Merlin, Kahn strove to make himself heard. The whole subject's classified top secret. But I am certain that Merlin exists. If not on Poitem, then somewhere in the Alpha system, and I am equally certain that we can find it. Cheers! He waited for the hubbub to subside. Lucas was trying to yell above it.  Why are you certain it doesn't? Why, the whole thing's absurd. It's absurdly fantastic. Maybe it is to a layman like you. I studied computers, and it isn't to me. Well, take all these elaborate preparations against space attack you were telling us about. I think Colonel Zeraph here, who served in the Alliance Army, will bear me out that such an attack was plainly impossible. Zeraph started to agree, then realized that he was aiding and comforting the enemy. Intelligence lag, he said. What do you expect, with General Headquarter's thirty parsecs from the fighting? Yes, a computer can only process the data that's been taped into it, Kahn said. That was a point he wanted to ram home, as forcibly and as often as possible. I suppose Merlin classified an Alliance attack on Poitem as a low-order probability, but war is the province of chance. Klausowitz said that a thousand years ago. Fox Travis wasn't the sort of commander to let himself get caught, even by a very low-order probability. Well, how do you explain the absence, after forty years of any mention in any history of the War of Merlin? How do you get around that? I don't have to. How do you get around it? Huh? Lucas was startled. Yes. Stories about Merlin were all over Poitem, all through the Third Force, even to the enemy. Say the stories were unfounded. Say Merlin never existed. Yet the belief in Merlin was an important historical fact, and no history of the War gives it so much as a footnote. He paused for effect, then continued. That can mean only one thing. A dramatic suppression, backed by the whole force of the Terran Federation, a gigantic conspiracy of silence. Brother, if they swallowed that I have it made. They'll swallow anything. They did. All but Lucas. He banged his fist on the table. Now I've heard everything, he shouted and discussed. Not quite everything, doctor, Morgan Gatworth said. You will hear one of these days that we have found Merlin.  Lucas sprang to his feet, his chair toppling behind him. He shoved it aside with his foot. I'm not going to argue with you. Con Maxwell gave you a thousand-year-old quotation. I'll give you another, from Thomas Paine. To argue with those who have renounced the use and authority of reason is as futile as to administer medicine to the dead. I'll add this.  I don't know what his racket is, and I'm not staying to find out. You will, though, to your regret. He turned and strode from the room. There was a moment of silence after the door slammed behind him. Too bad, Con thought. He would have made a good friend. Now he was going to make a very nasty enemy. Well, let's get to business, his father said. We don't want to argue about the existence of Merlin. We know that. Let's discuss the question of finding it. I still think it's somewhere off-planet, Lorenzo Menardis said, the moons of Pantagruel. Evidently he'd read something, or seen an old film, about the moons of Pantagruel. No, that's too far. They'd keep it where they could use it. The old GHQ, Lester Dawes suggested. Suppose it's down under that, like the place Rodney found under Tenth Army? I hope not, Gatworth said. The planetary government took that over. Well, wherever it is, finding it is going to be expensive, Rodney Maxwell said. Now to finance the search, I propose we use this information my son brought back from Terra. Dr. Lucas was right about one thing. That's worth millions of sols. Well, I propose also that we set up a company and get it chartered, a prospecting company, to operate under the Abandoned Property Act of 867. My son and I will contribute this information as our share in the capitalization of the company. The work of opening these Federation installations can go on concurrently with searching for Merlin, and profits can finance it. Silence for a moment, then a bed them of cheering. Well, let's get organized, Gatworth said. What will we call this company? A number of voices shouted suggestions. Rodney Maxwell managed to get recognition and partial silence. It is of the first importance, he said, that we keep a real objective, Merlin, as close a secret as possible. The planetary government would like to get hold of it. And I leave you to ask yourselves how far Jake Weikhoven and his cronies are to be trusted with anything like that, and I have no doubt the Federation might try to take it away from us. Couldn't do it, Rodney, Judge Lidoo objected. Everything the Federation abandoned in the tri-system is public domain now. We have a Federation Supreme Court ruling. What's legality to the Federation, Clemseriff demanded, they fought a criminally illegal war of aggression against my people. Down the table somebody started singing, rally round the banner, the banner black and green. Well, I think it's a good idea to keep quiet about it myself, Kurt Fawzy said. All right, Rodney Maxwell said. Then we don't want this company to sound like anything but another salvage company. I suggest we call it Litchfield Exploration and Salvage. Good name, Rodney, Gawds approved. That emotion? I seconded. Really carried. They had a name now, anyhow. Everybody began suggesting other topics for consideration. Capitalization, application for charter, election of officers, stock issues. Conn paid less and less attention. Industrial finance and organization wasn't his subject either. His father was plunging happily into it as though he had been promoting companies all his life. Conn saddened doodled with his six-color pen, mostly spherical hyperspace ships. We can't get all this cleared up now, Lester Dawes was protesting. Your Honor, I mean Mr. Chairman, I suggest that committees be appointed. More hassling. Everybody wanted to be on all the committees. Finally they appointed enough committees to include everybody. Well, that seems to be cleared up, Judge Lidoux said. I suggest a meeting day after tomorrow evening. The committee should have everything set up and we should be able to organize ourselves and elect permanent officers. Is there anything else to discuss or do I hear a motion to adjourn? Somebody thought they ought to have some idea of what the first operation would be. You heard me mention a spaceport, Conn said. I can tell you now that it's over on Barathrum, inside the crater of an extinct volcano. I think we ought to have a look at that, first of all. I know you seem to think that yesterday that Merlin is off-planet, Fawzi said. I'm inclined to disagree, Conn. I think it's right here on Poitem. We ought to nail that spaceport down first, Conn argued. Conn, you mentioned an underground duplicate of Travis's general headquarters, Zeraph said. They thought we'd possibly send a fleet here to Blitz Poitem or they wouldn't have built that. And this underground headquarters would be the safest place on the planet. They'd make sure of that. Staff brass don't like to get caught out in the rain, not when it's raining hell-burners and planet-busters. Merlin would be too big to take there along with them, so they'd put it there in the first place. That made sense. If he'd been Fox Travis, and if there had been a Merlin, that was exactly where he'd put it himself. But there was no Merlin, and he wanted a ship. He argued mullishly for a while, then saw that it was hopeless and gave in. I want to find Merlin as much as any of you, he said. More! Merlin was the only thing I was trained for. We'll look there first. Somebody asked where, approximately, this underground force-command headquarters was. Why, it's in the Badlands, over between the Blaubergs and the East Coast. Great, goo! We'll need an army to go in there, Tom Brangwood said. That's where all these outlaws have been coming from, Blacky Perelis and all. Then we'll get an army together, Clem Zarev said happily. Might make a little of that reward money that's been offered. We'll need more than that. We'll need excavation equipment and labor. Lots of labor, Khan said. It's a couple of hundred feet below the surface. From the plans, I'd say they just dug a big pit, built the headquarters in it, and filled it in. There are two entrances, a vertical shaft and a horizontal tunnel. When they pulled out, they probably filled the shaft and vitrified the rock at the outer ends, his father added. That was what they did at Tenth Army. Another idea hit him. Mr. Mayor, do you think you could set up some kind of a public works program here in Litchfield? We can't start this thing till after the wine-pressing's over, and we'll need a lot of labor, as I pointed out. Now, it's important that we keep all our projects a secret until we can get our claims filed. If we start this municipal fix-up and clean-up program, we can give work to a lot of these drifters who haven't been able to get jobs on the plantations, get them organized into gangs, and keep them together till we're ready for the force command job. Lorenzo Menardis supported the idea. And while they were boondoggling around in Litchfield, we could pick out the best workers, get rid of the incompetence, and train a few supervisors. That's going to be one of our worst headaches, getting capable supervisors. You telling me, Rodney Maxwell asked? That was what I was wondering about, where we'd get gang bosses. And another thing, this municipal house-cleaning would mask our real preparations. Well, we need something like that, Fawzi said. We've needed it for a long time. I guess it took Khan, coming home from Terra, to see how badly we've let the town get run down. Franz, suppose you and Tom Brangwen and Lorenzo form a committee on that. Look around, see what needs fixing up worst, and set up a project. Who's city engineer now? Eiboliri. He died six years ago, Dawes said. You never appointed his successor. Well, I guess I never got around to that, the mayor of Litchfield admitted. In the meeting finally adjourned, they went up and got in the car. His father lifted it straight up to thirty thousand feet and started circling. An air-car was one place where they could talk safely. Khan, I was kind of worried down there.   As long as you agree with those people, you're a brilliant young man.  You let the older and wiser heads run things. You can't begin to hope to foul things up the way they can. Look at all the experience they've had. But we've got to have a ship. Everything depends on that. I know it does. We'll get a ship. Let Kurt Fawzi and Clem Zarath and the rest of them have this duplicate force command thing first, though. Keep them happy. As soon as we have that opened, you can take a gang and run over to Barathrum and grab your spaceport. Wait till they find out that Merlin isn't at force command duplicate. Then you can convince them that it's really on Koshai. CHAPTER VI The car Rodney Maxwell got out of the hangar the next morning wasn't the one he and Khan had gone to the meeting in. It was the one he had flown in from 10th Army HQ at noon of the previous day. An army reconnaissance job, slim and needle-like, completely enclosed, looking more like a missile than a vehicle, and armored in dazzling, iridescent, collapse-ium. There was something to living on Poitem at that. Only a millionaire on Terra could have owned a car like that. Nice, Khan said. Where did you dig it? Where we're going, 10th Army? I'll bet she'll do Mach 3. Better than that, I've never had her above 2.5, but the airspeed gauge is marked up to 4. And she has everything. All kinds of detection instruments, cameras, audio-visual pickups, armament, and the armor, you can take her through any kind of radiation. The armor was only a couple of micro-microns thick, but it would stop anything. It was collapsed matter. The electron shells of the atoms collapsed upon the nuclei, the atoms in actual contact. That plating made eighth-inch sheet steel as heavy as 12-inch armor plate, and in texture and shielding properties, lead was like sponge by comparison. They climbed in, and Rodney Maxwell snapped on the screens that served as windows. Khan leaned back and looked at the underside view in a screen on the roof of the car, as his father started the lift engine. Still think it's worth the price, son? His father asked. The price had begun to rise. Even so, he was afraid that what they had paid so far was only the down payment. Dinner last evening, Flora, who had evidently been talking to Wade Lucas, shouting accusations at them, his mother fleeing from the table in tears. As the car rose, he reached out and turned on and adjusted the telescreen for the under-view. Keep your eye on that, father, he said. That's what we're paying to get rid of. A distillery, bigger than the Menardis plant, long closed and now half-roofless and crumbling. Rose of warehouses, empty after the war, until taken over by homeless vagrants. Jerry built shanties with rattletrap aircars grounded around them. Tramptown, a festering sore on the south side of Litchfield. If we put this over, he continued, all those tramps will have steady work and good homes. We can have a park there, with fountains that'll work. Maybe even Flora and Mother will think we've done something worth doing. It'll be kind of hard to take in the meantime, though, but if you can take it, I can. Rodney Maxwell turned off the underside telescreen and put on the forward one. See that little pink spot over there? Sunrise on the east side of Snagtooth. Tenth Army's just behind it. Now let's see if this airspeed gauge is telling the truth or just bragging. Sudden acceleration pushed them back in their seats. The calibrations on the gauge rose swiftly. The pink-lighted peak grew swiftly in the telescreen. The gauge hadn't been bragging, it had been understating. The car had more speed than the instrument could register. Two and a half minutes from Litchfield they were decelerating and swinging slowly around Snagtooth, looking down on a tilted plateau that ended on the western side in a sheer drop of almost a thousand feet. There were ruinous buildings on it, barracks and storehouses and offices, an airship dock and an air traffic control tower from which all the glass had long ago vanished, a great steel telecast tower that had fallen, crushing a couple of buildings. Young trees had already grown among the wreckage. Look over there, on the slope below it, there's one entrance to the shelters. There was a clearing among the evergreens, half a mile from the buildings, and raw earth and a couple of big scows grounded nearby. They bulldozed rock and earth over the end of the tunnel. Then there's another one down on that bench, a couple of hundred feet below the edge of the plateau. They blasted rock down over that. The main entrance is a vertical shaft under the pre-stressed concrete dome. That was chapel, auditorium or something. They just covered it with sheet metal and poured a foot of concrete on top. They floated down above the broken roofs and crumbling walls, and grounded in the area between the main administration building and the offices, back of the ship docks. Once he supposed it had been a lawn, then it had been a jungle. Now it was a scuffed, littered, bare, trodden work yard. Men were straggling out of the administration building, lighting pipes and cigarettes. They all wore new, but work-soiled infantry battle-dress. All of them waved and shouted greetings. One about Khan's own age approached. As he got out, Khan saw the resemblance to Lester Dawes, the banker, before he recognized Ants Dawes, who had been one of his closest friends six years ago. They shook hands and pounded each other on the back. Hey! You're looking great, Khan! They all told him that. He'd begin to believe it pretty soon. Sorry I couldn't make the party, but somebody had to sit on the lid here. And Jerry Rivas and I cut cards for it, and Jerry won.  Rodney Maxwell said he'd been saving that for a surprise. When Khan asked Ants what was the matter with the bank, he said, For the birds, I'd as soon count sheets of toilet paper as this stuff we're using for money. Sooner! Toilet paper can be used for something, and this paper money's too stiff. Maybe some of this stuff we're dingy here isn't worth much, but at least it's real. That was something else the Maxwell plan would have to take care of. Gresham's Law was running hog-wild on Poitem. A planetary government soul was worth about ten centisols, Federation, and aside from deposit boxes, woolen socks under the mattress, and tin cans buried in the corner of the cellar, Federation currency was non-existent. Had breakfast yet, Rodney Maxwell asked? Oh, hours ago. I was out and shot another spike-nose. It's hanging up back of the kitchen, waiting for the cook to skin it and cut it up. He grinned at Khan. You don't get this kind of hunting in a bank either. Jerry's still inside? I want to see him. Suppose you take Khan around and show him the sights. And don't worry about him bumping you out of a job. Worry about the six or eight extra jobs you'll have to do beside your own from now on. Khan and Ants crossed the yard and entered one of the office buildings through a big breach in the wall. Ants said, I did that myself, ninety millimetre tank gun. When we went a wall out of the way, we get it out of the way. Inside were a lot of lifters and skids and power shovels and things. Labourers were assembling for work assignments. Most of them had been with his father six years ago and he knew them. They hadn't done any growing up in the meantime. They climbed into an air jeep and floated out over the edge of the plateau, letting down past the sheer cliff to where the lower lateral shaft had been opened. A great deal of rock had been shoveled and bulldozed away to expose it. It was twenty feet high and forty wide. Ants simply steered the jeep inside and up the tunnel. There were occasional lights on at the ceiling. Ants said they were all powered from their own nuclear electric conversion units. We don't have the central power on here. There's a big mass energy converter, but we're tearing it down to ship out. That was something they could get a good price for, maybe even one tenth of what it was worth. At least they wouldn't have to sell it by the ton. The tunnel ended in an enormous room a couple of hundred feet square and fifty high. There was a wide aisle up the middle. On either side, contra-gravity equipment was massed. Tanks with long ninety millimetre guns, combat cars, small air boats, rank on rank of air cavalry single mounts, egg-shaped things just big enough for a man to sit in, with quadruple machine guns in front and flame jets behind. Ambulances armoured against radiation, decontamination units, mobile workshops, mobile kitchens, troop carriers, jeeps, staff cars, power shovels, manipulators, lifters, all waiting for forty years to swarm out as soon as the bombs that never came stopped falling. They floated the jeep along the hallways beyond and got down to look into rooms. Work was already going on in the power plant. A gang under a slim young man whom Anne's introduced as Mohamed Matsui were using repair robots to get canisters of live plutonium out of a reactor. Workshops, laundrys, storerooms, kitchens, some stripped and a few still intact, a hospital, guardhouse and lock-up. More storerooms on the level above reached by returning to the vehicle hangar and lifting to an upper entrance. By this time gangs were at work there too, moving contra-gravity skids in, empty and out loaded. The CEO here must have had squirrel blood, Anne said. I think when the evacuation orders came through he just gathered up everything there was topside and crammed it down here, any old way. Honest to goo, this place was packed solid when we found it. Nobody'd believe it. Wait till you see the next one. You mean there's another place like this? You can say so. You can say a twenty megaton thermonuclear is like a hand grenade too. Anne's Dawes simply didn't believe that. When they got back to the administration building on top, they found Rodney Maxwell, Jerry Rivas, the general foreman, and a half dozen gang foremen in consultation. We're getting a hundred and fifty more men and ten farm scouts from Litchfield, his father said. Dave McCabe's coming out from our yard, and Tom Brangwen's sending one of his deputies to help boss them. We'll have to keep an eye on this crowd. They're all trapped town hoodlums. That's the best we could get. We're going to have to get this place cleaned out in a hurry. We only have about two weeks till the wine pressing's over, and then we want to start the next operation. Con, did you see all that engineering equipment down on the bottom level? Yes. I think we ought to leave a lot of that here. The shovels and bulldozers and manipulators and so forth. We can move it direct to force command. How are we fixed for blasting explosives? Name it, and we have it. Cataclysmite, FJ-7, anything you want. We'll need a lot of it. We're going to have to get a ship. I mean a contragravity ship, a freighter. First to move this stuff out of here, and then to move this stuff out of force command. And we want it mounted with heavy armament, too. We not only want a freighter, we want a fighting ship. You think so? I'm sure of it, Rodney Maxwell said. Where we're going is full of outlaws. There must be hundreds of them holding up over there. That's where all the trouble on the east coast comes from. Now, outlaws are sure thing players. They want to be alive to spend their loot, and they won't tackle anything that's too tough for them. A lot of guards and combat equipment may look like a loss on the books, but the books won't show how much of a loss you might take if you didn't have them. I want this operation armed till it'll be too much for all the outlaws on the planet to tackle. That made sense. It also made sense out of the billions of souls the Federation had spent preparing for an invasion that never came. If it had come, and found them unprepared, the loss might have been the war itself. The scous and newly hired workers began arriving a little afternoon. The scous had been borrowed from plantations where the crop had been gotten in. There were melon leaves and bits of vine in the bottoms. The workers were a bleary-eyed and unsavory lot. Khan had a suspicion, which Brangwen's deputy confirmed, that they had been collected by mass vagrancy arrests in Tramptown. As soon as they started arriving, Jerry Rivas hurried down to the old Provo Marshals headquarters and came back with a lot of rubber billy-clubs, which he issued to his gang bosses, regular and temporary. A few times they had to be used. By evening, however, the insubordinate and troublesome had been quieted. They would all steal anything they could put in their pockets, but that was to be expected. By evening, too, the contents of the underground treasure trove was moving out in a steady stream, and scous were shuttling to and from Litchfield. Rodney Maxfield was going back to town after lunch the next day. Khan wanted to know if he should go along. No, you stay here. Help keep things moving. Remember what I told you about the older and wiser heads? Let me handle them. I've been around them, heaven pity me, longer than you have. Just give me an audio visual of your proxy and I'll vote your stock. How much stock do I have, by the way? The same as I have, ten thousand five hundred shares of common at twenty centisols a share, but watch where it goes after we open force command. His father was back two days later to report. We're organized. Kurt Fawzi's president, of course, and does he love it. That'll keep him out of mischief. Dolph Kelton's secretary. He has an office force at the academy and can constrict students to help. He's organizing a research team from his seniors and post-grad students to work in the planetary library at Storescenda. There are a lot of old third force records there. He may find something useful. Of course, Lester Dawes is treasurer. What are you? Lester Dawes, president in charge of operations. That's what I spent all yesterday log-rolling, baby-kissing, and cigar-passing to get. And what am I, if that's a fair question? You have a very distinguished position.  The only other one is Judge Lidoux. As a member of the judiciary, he did not feel it proper to accept official position in a private corporation. Tom Brangwens, chief of company police. Clem Fawzi is commander of the company guards. And we have a law firm in Storescenda lined up to handle our charter application, Sturber Flynn and Chen Wong. Sturber is married to Jake Weikoven's sister. Flynn's son is married to the daughter of the secretary of the treasury, and Chen Wong is the nephew of the chief justice. All of them are directly descended from members of Genji Gartner's original crew. You don't anticipate any trouble about getting the charter? Not exactly. And Lester Dawes is in Storescenda now, trying to find us a contra-gravity ship. There are about a dozen in the hands of receivers for bankrupt shipping companies. He might find one that's still airworthy. Oh, you remember how I insisted on absolute secrecy about our Merlin objective? That's working out better than my fondest expectations. It's leaking like a machine-gunned water tank, and everybody it leaks to is positive that we know exactly where Merlin is, or we wouldn't be trying to keep it a secret. Three days later, Khan hitched a ride on a freight-scow to Lichfield. From the air, he could see a haze of bonfire smoke over high guarding terrace, and a gang of men at work. There were more men at work on the mall and along the streets on either side. He went up from the yard below the house, where the scow was being unloaded, and found his mother in the living-room watching a screenplay with one eye and keeping the other on a soulless machine like a miniature contra-gravity tank, which was going over the carpet with a vacuum cleaner and taking swipes at the furniture with a rotary dust mop. She was glad to see him and then became troubled. Khan, when Flora comes home, you won't argue with her, will you? Only in self-defense? That was the wrong thing to say. He changed it to, no, I won't argue with her at all. And then quoted Wade Lucas, quoting Thomas Paine. Then he had to assure his mother a couple of times that there really was a murder in Merlin, and then assure her that it wouldn't get loose and hurt anybody if he did find it. In the middle of his assurances about the harmlessness of Merlin, the house-cleaning robot began knocking things off the top of a table.  Oscar, deaf as the adder, kept on. Khan yelled at his mother to use her control. She remembered that she had one, a thing like an old-fashioned pocket watch around her neck on a chain and got the robot stopped. No wonder she was afraid of Merlin. He took advantage of the interruption to get to his room and change clothes, then went up to the hangar and got out an air cavalry mount. About fifty men were working on high-garden terrace, pruning and trimming and leveling the lawns. There was a big vitrifier on the mall, even at five hundred feet he could feel the heat from it, chuffing and clanking and pouring lava-like molten rock for a new pavement. And all the nymphs and satyrs and dryads and fawns and centaurs had had their pedestals rebuilt and were sandblasted clean. He landed on the top of the airline's building and wrote a lift down to the office where Kurt Fawzi neglected the affairs of his ship-line agency, his brokerage business and the city of Litchfield. The afternoon habituaries had begun to gather. Raymond Fitch, the used vehicles dealer, Lorenzo Menardis, Judge Liddo, Tom Brangwin, Clem Zeriff. Fawzi was on the screen, talking to somebody with sandy hair and a suit that didn't seem to be made of any sort of federation-armed forces material about warehouse facilities. The addresses they were mentioning were in Storacenda. No, Leo, I don't know when, Fawzi was saying, but don't you worry, you just have space for it and we'll fill it up.  Tom Brangwin, lounging in one of the deep chairs, looked up. Hello, Con. We're having a time. Another two hundred tramps came in on the countess this morning, and Goo only knows how many in their own vehicles, and they all seem to think if there's work for some, there ought to be work for all, and some of them are getting nasty. We can use some more out at the dig. The ones you sent out Thursday are doing all right, once they found out we weren't taking any foolishness. Fawzi turned away from the screen. Well, Con, we're in, he said. The charter was granted this morning, now we're Litchfield Exploration and Salvage Limited, and Lester Dawes has found us a contragravity ship. How much will it cost us? Fawzi began to laugh. Con, this'll slay you. She isn't costing us a centissole. You know those old ships on Mothball Row, back of the old West End ship docks at Storesenda? Con nodded. He'd seen them before he had gone away, and from the city of Asgard coming in, a lot of old army transport craft, covered with muslin and sprayed with protectoplast. The planetary government had taken them over after the war and forgotten them. Well, Lester's gotten one of them for us under the old 8-7-8 Commercial Enterprise Encouragement Act. She's an army combat freighter, regimental ammunition ship. Of course, she still has armament, we'll have to pay to get that off. Why? Fawzi looked at him in surprise. It would only be in the way and add weight. We want it for a cargo ship, don't we? That was what she was built for. What kind of armament? Fawzi didn't know. Clemseriff did. Four hundred and fifty millimeter rifles, two four and two aft, a pair of lift-and-drive missile launchers and midships, and a secondary gun battery of seventy millimeters and fifty millimeter autocannon. I know the class. We captured a few of them. Good ships. Fawzi was horrified. Why, that's more firepower than the whole air patrol. Look, the government won't like our having anything like that. They're giving her to us, aren't they? Menardus asked. Gahana with what the government likes, the old rebel swore. If they'd put a few of those ships into commission, they could wipe out these outlaws, and a private company would need an armed ship. May I use your screen, Kurt? Khan asked. When Fawzi nodded, he punched out the combination of the operating office at Tenth Army, and finally got his father on. He told him about the ship. There's talk about tearing the armament out, he added. Is that so now? Well, I'll call Lester Dawes before he can get started on it. I think I'll go into Storesenda tomorrow and see the ship for myself. See what I can do about ammunition for those guns, too. What's Rod, Fawzi protested, joining the conversation. We don't want to start a war. No, we want to stay out of one. You don't do that by disarming. We're taking that ship down into the Badlands, remember? Rodney Maxwell said. Every hear the name, Blackie Perales? Fawzi had. He stopped arguing about armament. Instead he began worrying about how much the civic cleanup campaign was costing Litchfield. You think we really need that, Rod? Of course we do. You'd be surprised how much labor we're going to need, and how hard up we're going to be for capable supervisors. This thing's a training program, Kurt, and we'll need every man we train on it. But it's costing like Niflheim, Rod. We're going to bankrupt the city.  Oh, don't worry, Kurt. As soon as we find Merlin, everything'll be all right. France Veltrin came in, shortly after Rodney Maxwell was off the screen. He dropped his audio-visual camera and sound recorder on the table, laid his pistol-belt on top of them, and took a drink of brandy, downing it with the audible satisfaction of a thirsty horse at a trough. Then he looked around, accusingly. Somebody's been talking, he declared. I've had all the news services on the planet on my screen today. They all want the story about what's happening here. They've heard we know where Merlin is, that Con Maxwell found out on Terra. They just put two and two together and threw seven, Conn said. A Herald Guardian ship-news reporter interviewed me when I got in and found out I'd been studying cybernetics and computer theory on Terra. What did you tell them? Complete denial. We don't know a thing about Merlin. Naturally, they didn't believe me.  What are we going to tell them? We'll all have to have the same story. I, said Judge Liddo, am not going to be interviewed. I am leaving town till they're gone. Why don't you steer them on to Wade Lucas, Conn asked? If you want anything denied, he'll do it for you. Everybody thought that was a wonderful idea, except Clemseriff. And he waited until Conn was ready to go and rode up to the landing stage with him. Conn, I know this Lucas is going to marry your sister, he began, but how much do you know about him? Not much. He seems like a nice chap. I don't hold what he said at the meeting against him. I suppose if I'd come from off-planet, I wouldn't believe in Merlin either. Ha! But doesn't he believe in Merlin? He makes noises like it. You know what I think? Clemseriff lowered his voice to a whisper. I think he's a Federation spy. I think the Federations lost Merlin. That's why they haven't come back to get it long ago. Pretty big thing to mislay. It could happen. There'd only be a few scientists and some high staff officials who'd know where it was. Well, say they all went back to Terra on the same ship, and the ship was lost at space. Sabotage, one of our commerce raiders that hadn't heard the war was over. Maybe just an ordinary accident. But the ships lost, and the location of Merlin's lost wither. That could happen, Khan agreed seriously. All right. So ever since they've had people here listening, watching, spying. This Lucas, he showed up here about a year after you went to Terra. And who does he get engaged to? Your sister. And what does she do here? Goes around arguing that there is no Merlin, getting people to argue with him, getting them mad so they'll blurt out anything they know. I'm an old field officer. I know all the prisoner interrogation tricks in the book, and that's always been one of the best. Then why did he act the way he did at the meeting? All he did was cut himself off from learning anything more from any of us. In his place, would you have done that? Oh, you would have tried to take the lead in hunting for Merlin yourself, now wouldn't you? Zaref was silent, first puzzled, and then hurt. Now he would have to tear the whole idea down and build it over. Flora was quite friendly when she came home from school. She'd found out somewhere that Khan had been the originator of the municipal facelifting project. He was tempted, briefly, to tell her a little, if not all, of the truth about the Maxwell plan, then decided against it. The way to keep a secret was to confide it to nobody. Every time you did, you doubled, maybe even squared, the chances of exposure. He told his father, when Rodney Maxwell came in from the dig, about his talk with Clem Zaref. How long's he been like that, anyhow, he asked. As long as I've known him, when it comes to melons and wine and bossing tramp labor and taking care of his money and coming in out of the rain, Clem Zaref's as sane as I am. But on the subject of the Terran Federation, he's crazy as a bedbug. What is a bedbug, anyhow? They have them on Tara, in places like Tramptown. They have places like Tramptown on Tara, too. Uh-huh. I suppose, in Clem's boots, I'd be just as crazy as he is, Rodney Maxwell said. One minute he had a wife and two children in Kindleburg on Ashwood Eye, and the next minute Kindleburg was a puddle of radioactive slag. That was in fifty-one, wasn't it? I read about it, Khan said. It was a famous victory. That was from a poem, too. Rodney Maxwell flew to Storescenda early the next morning. Khan rode back to Tenth Army on an empty scow and pitched into the job of getting the stores and equipment out of the underground shelters. More farm tramps arrived and had to be pounded into obedience and taught the work. At the same time, Litchfield was getting a steady influx of job seekers and a secondary swarm of thugs, grifters, and gangsters who fowled them. Clem Zaref, having gotten all his melons pressed, came out to Tenth Army where he selected fifty of the best men from the work gangs and began drilling them as soldiers to guard the next operation. The manual of arms, drill and salute he taught them was, of course, System States Alliance. A week later the ship arrived from Storescenda.  The delay had been in recruiting officers and crew. The Captain and Chief Engineer were out-of-work ship-line officers. The Gunner was a former Federation artillery officer, and the crew looked more like pirates than most pirates did. They christened her the Lester Dawes, because Dawes had secured her and because the name began with the initials of Litchfield Exploration and Salvage. From then on it was a race to see whether the 10th Army attack shelters would be empty before the wine was all pressed or vice versa. By H. Beam Piper Chapter 7 Fifty-two years before they had come to the Mesa in the Badlands and dug up pit on top of it. A thousand feet in diameter and more than five hundred deep. And in it they built a duplicate of the headquarters for Third Fleet Army Force Command. They built a shaft a hundred feet in diameter like a chimney at one side, and they ran a tunnel out through solid rock to the head of a canyon half a mile away. Then they buried the whole thing. Twelve years later, when the war was over, they sealed both entrances and went away and left it. For a month each winter, cold rains from the east lashed to the desert. For the rest of the year it was swept by windblown sand. Wiregrass sprouted and thornbush grew. Nature, the master chemoflure, completed the work of hiding the forgotten headquarters. Little things, not unlike rabbits, scampered over it, and bigger things, vaguely fox-like, hunted them. Hunted men came too, their air-cars skimming low. None of them had the least idea what was underneath. The Mesa Top came suddenly to life, just as the sun edged up out of the east. Khan and his father and aunt's daughters came in first, in the recon car with which they had scouted and photographed the site a few days before. They circled at a thousand feet, fired a smoke bomb, and then let down near where Khan's map showed the head of the vertical shaft. The rest followed.  And behind a queue of boats and scous and heavy engineering equipment on contragravity and troop carriers full of workmen and guards, flanked by air cavalry which circled above while everything else landed, then scattered out over a 50-mile radius. Occasionally there was a hammer of machine guns, either because somebody saw something on the ground that might need shooting at, or simply because it was a beautiful morning to make a noise. The ship settled quickly and daintily, while Khan and aunt's and Rodney Maxwell sat in the car and watched. Immediately she began opening like a beetle bursting from its shell, large sections of armor swinging outward. Except for the bridge and gun turrets almost the whole ship could be opened. She had been designed to land in the middle of a battle and deliver ammunition when seconds could mean the difference between life and death. Jeeps and lifters and manipulators and things floated out of her. Scous began landing and unloading prefabbed elements. A water tank landed, and the cook shed began going up beside it. A lorry came in with scanning and probing equipment, and a couple of men jumped off and huddled over a photo-print copy of one of Khan's maps. Khan lifted the car again and coasted it a half-mile to where the cleft in the mesa started.  Jerry Rivas and one of the engineers Kurt Fawzy had hired had gotten out of a jeep and were looking at another photo-print of the map. Rivas pointed to the head of a canyon where a mass of rock had slid down. That's it! You can still see where they put off the shots. The canyon was long enough and wide enough for the Lester Dawes to land in it. She could be loaded directly from the tunnel. The manipulators began moving in, wrestling with the larger chunks of rock and dragging or carrying them away. Power shovels began grunting and clanking and rumbling. Dust rose in a thick column. Toward mid-morning the troop carriers which served as school services in Litchfield arrived, loaded with more workmen. A lorry-lettered Storesenda Herald Guardian came in, hovered over the canyon, and began transmitting audio-visuals. More news-folk put in an appearance. The earth and rock at the top of the tunnel entrance fell away, revealing the vitrified stone lintel. Everybody cheered and dug harder. More air-cars arrived, getting in each other's and everybody else's way. Raymond Fitch, Lester Dawes, Lorenzo Menardis, and Morgan Gatworth, Dolph Kelton playing hooky from school, Tom Brangwin, with a score of the home guard to reinforce the company police. Clem Zareff called in his air cavalry to help control the sightseers. Nobody was making trouble. They were just getting in the way. At eleven Rodney Maxwell went aboard the Lester Dawes to use the radio and telescreen equipment. By then, two time zones west in Storesenda, the Clem's office was opening. He filed preliminary claim to an underground installation with at least two entrances in uninhabited country, and claimed a ten-mile radius around it. By that time the gang working on top had uncovered a vitrified slab over the hundred-foot circle of the vertical shaft, and were cracking it with explosives. According to the scanners it was full of loose rubble for a hundred feet down. Below that the micro-rays hit something impenetrable. Toward mid-afternoon the tunnel in the canyon was cleared. It had been vitrified solid. The scanners reported that it was plugged over ten feet.  There were more explosives topside. When Khan took a jeep up to observe progress there, he found the vitrified rock blown completely off the vertical shaft, exposing the rubble that had been dumped on it. The gang on the mesa-top had discovered something else, a grid of Orocopper bus-bars buried four feet underground. Ten to one radio and telescreen signals would be transmitted to that from below, then probably picked up and rebroadcast from a relay station on one or another of the high-butts in the neighborhood. Time enough to look for that later. He returned to the canyon where the lateral tunnel was now almost completely open. When it was clear, they sent a snooper in first. It was a robot, looking slightly like a short-tailed tadpole, six feet long by three feet at the thickest. It transmitted a view of the tunnel as it went slowly in. The air it found was breathable, and there were no harmful radiations or other dangers. According to the plans, there should be a big room at the other end, slightly curved, a hundred feet wide by a hundred on either side of the main tunnel entrance. The robot entered this, and in its headlight they could see reconnaissance cars and contra-gravity tanks with ninety-millimeter guns. It swerved slightly to the left, and then the screen stopped receiving. The telemeters instruments went dead and the robot's signal stopped. Tom, Rodney Maxwell said, you keep the crowd back. Clem, stay with the screens. I'll transmit to you. I'm going in to see what's wrong. He started to give Khan an argument when he wanted to accompany him. No, Khan said, I'm going along. What do you think I went to Tara to study robotics for? His father snapped on the screen and pickup of the jeep that was standing nearby. You getting it, Clem, he asked? OK, Khan, let's go. Half a mile ahead, at the other end of the tunnel, they could see a flicker of light that grew brighter as they advanced. The snooper still had its light on and was moving about. Once they caught a momentary signal from it. As Rodney Maxwell piloted the jeep, Khan kept talking to Clem Zareff outside. Then they were at the end of the tunnel and entering the room ahead. It was full of vehicles, like the one on the bottom level at 10th Army HQ. As soon as they were inside, Clem Zareff's voice in the radio stopped as though the set had been shot out. Clem, what's wrong? We aren't getting you, his father was saying. The snooper was drifting aimlessly about, avoiding the parked vehicles. Khan used the manual control to set it down and deactivate it. Then got out and went to examine it. Take the jeep over to the tunnel entrance, he told his father. Move out into the tunnel a few feet. Relay from me to Clem. The jeep moved over. A moment later his father cried. He's getting me. I'm getting him. What's the matter with the radio in here? The snooper's all right, isn't it? It was. Khan reactivated it and put it up above the tops of the vehicles. Sure, we just can't transmit out. But only a half mile of rock, that sets good for more than that. I'll transmit clear through Snagtooth. It won't transmit through Collapsium. His father swore disgustedly, repeating it to Zareff outside. Khan could hear the old soldier in the radio make a similar remark. They should have all expected that in the first place. If the Third Force High Command was expecting to sit out a nuclear bombardment in this place, they'd armor it against anything. Bring the gang in. It's safe as far as we've gotten, his father said. We'll just have to string wires out. Khan used his flashlight and found the power unit for the room lights. All the overhead lights were wired to one unit. If wired were the word for gold leaf circuits cemented to the walls and covered insulating paint. For the heavy stuff, like the ventilator fans, they'd have to find the central power plant. He looked around the big room poking into some of the closets that lined it. Radiation-proof clothing, tools, arms and ammunition, first aid kits, emergency rations. All the vehicles were plated in shimmering collapseium. The crowds started coming in. The work gangs selected for the first exploration work, most of them old hands of Rodney Maxwell's. The engineers they had recruited. Mohammed Matsui, he had a gang of his own, the same one he had been using in tearing down the converter at Tenth Army. The stockholders and officials, the press, and everybody else Tom Arangwen's police hadn't been able to keep out. The power plant was at the extreme bottom. Matsui began looking it over at once. Above it they found the service facilities, air and water plant. Pumps for the artesian well, sewage disposal. Then repair ships and a laboratory, and laundries and kitchens above that. Where do you suppose it is? Kurt Fawzy was asking. Up at the very top, I suppose. Let's go up and work down. I can't wait till we've found it. Like a kid on Christmas Eve, Khan thought, and there was no Santa Claus and Christmas had been abolished. The place was built in concentric circles, level above level. Combat equipment nearest the tunnel exit, and nearest the vertical shaft. And ambulances and decontamination units and equipment for relief and rebuilding next. Store rooms, mile on circular mile of them. Not the hasty pack rat cramming he'd seen at Tenth Army. Everything had been brought in in order. Carefully piled or racked, and then left. More stores for the next three levels up. Then living quarters. Enlisted men's and women's quarters, no sign of occupancy. Enlisted kitchens and mess halls, untouched. Most of the officers' quarters were similarly unused, but here and there some had been occupied. A sloppily made bed. A used cake of soap in the bathroom. An empty bottle in a closet. Officers' commissary stores had been used from and replaced. The officers' mess hall and kitchen had been in constant use, and the officers' club had a comfortably scuffed and lived in look. There had been a few people there all the time of the war. Men and women, all officers or civilians, Clemser have said, didn't even have enlisted men to cook for them. And we haven't found a scrap of paper with writing on it, or an inch of recorded sound tape or audio-visual film. Remember those big wire baskets down at the Mass Energy Converters? Before they left, they disintegrated every scrap of writing or recording. This is where Merlin is. They were the people who worked with it. And above, offices. General staff. War planning with an incredibly complex star map of the theater of war. Judge Advocate General, Inspector General, Service of Supply. They were full of computers, each one firing the hopes of people like Fawzi and Dolph Kelton and Judge Liddo. But they were only special purpose machines, the sort to be found in any big business office. The store and the stock exchange probably had bigger ones. Then they found big ones. Rank on rank of cabinets. Long consoles studded with lights and buttons. Programming machines. It's Merlin, Fawzi almost screamed. We found it! One of the reporters who had been following them snatched his radio handphone from his belt and jabbered, then realizing that the Collapsium shielding kept him from getting out with it, he replaced it and bolted away. Hold it! Khan yelled at the others who were also becoming hysterical. Wait till I take a look at this thing. They managed to calm themselves. After all, he should know what it was. Wasn't that why he'd gone to school on Tara? They followed him from machine to machine. First hopefully, and then fearfully. Finally he turned, shaking his head and feeling like the doctor in a film show, telling the family that there's no hope for grandpa. This is not Merlin. This is the personnel file machine. It's taped for the records and data of every man and woman in the third force for the whole war. It's like the student record machine at the university. Might have known it. This section in here is mark G1 all over everything. That's personnel. Wouldn't have Merlin in here, Clem Zareff was saying. Well, we'll just keep on hunting for it till we do find it, Kurt Fawzy said. It's here somewhere. It has to be. The next level up was much smaller. Here were the officers of the top echelons of the force command staff. They, unlike the ones below, had been used. From them to every scrap of writing or film or record tape had vanished. Finally, they entered the private office of force general Fox Travis. It had not only been used, it was in disorder. Ashtray's full, many of the forty-year-old cigarette ends lipstick tinted, chairs shoved around at random, three bottles on the desk, with Taren Burman labels, two empty and one with about an inch of whiskey left in it, but no glasses. That bothered Khan. Somehow he couldn't quite picture the commander and staff of the Third Fleet Army Force passing bottles around and drinking from the neck. Then he noticed the wall across the room was strangely scarred and scratched. Dropping his eye to the floor under it, he caught the twinkle of broken glass. They had gathered here and talked for a long time. Then they had risen for a final toast, and when it was drunk they had hurled their glasses against the wall and smashed them. Then they had gone out, leaving the broken glass and the empty bottles, knowing that they would never return. Chapter 8 When they never returned to the lower level into which the lateral tunnel entered, Matsui and his gang had the power plant going, the ventilator fans were humming softly, and whenever they pressed a starting button, the escalators began to move. They got the pumps going, and the oxygen generators, and the sewage disposal system. Until the communication center could be checked and the relay station found, they ran a cable out to the cause, landed in the canyon, and used her screen and radio equipment. Before the claims office and store sender closed, Rodney Maxwell had transmitted in recorded views of the interior, and enough of a final description for a final claim. They also received teleprint copies of the store sender papers. The first story, in an extra edition of The Herald Guardian, was headlined, Merlin Found! That would have been the reporter who bolted off prematurely when they first saw the personnel record machines. Khan wondered if he still had a job. A later edition corrected this, but was full of extravagant accounts of what had been discovered. Merlin, or no Merlin, Force Command Duplicate was the biggest abandoned property discovery since the Third Force left the tri-system. The camp they had set up on top of the mesa was used that night only by Clem Zareff's guards. Everybody else was inside, eating cold rations when hungry, and when they could keep awake no longer, bedding down on piles of blankets, or going up to the barracks rooms above. The next day they found the relay station which rebroadcast signals from the buried aerial, or, wouldn't one say, subterial, on top of the mesa. As Khan had expected, it was on top of a high butte three-and-a-half miles to the south. It had been so skillfully camouflaged that none of the outlaw bands who roamed the Badlands had found it. After that, Force Command Duplicate was in communication with the rest of Poitem. They moved into the staff headquarters at the top. Fox Travis's office, tidied up, became the headquarters for the company officials and chief supervisors. The workmen quartered themselves in the enlisted barracks, helping themselves liberally to anything they found. The crowds of sightseers kept swarming in, giving Tom Brangwen's police plenty to do. Tom himself turned the Marshal's office in Litchfield over to his chief deputy. Clem Zarath insisted on more men for his guard force. A dozen gunboats, eighty-foot craft, mounting one ninety-millimeter gun, several smaller autocannon and one missile launcher had been found. He took them over immediately, naming them for capital ships of the old System States Navy. It took some argument to dissuade him from repainting all of them black and green. He kept them all in the air, with a swarm of smaller airboats and combat cars circling the underground headquarters at a radius of a hundred miles. These patrols reported a general exodus from the region. At least a dozen outlaw bands, all with fast contra-gravity, had been camped inside the zone. Some fled at once. The rest needed only a few warning shots to send them away. Other bands, looking like legitimate prospecting parties, began to filter into the Badlands. Zarath came to Rodney Maxwell, instead of Kurt Fawzy, the titular head of the company, which was significant, to find out what policy regarding them would be. Well, we have no right to keep them out, as long as they stay outside our ten-mile radius, Khan's father said. And as we're the only thing that even looks like law around here, I'd say we have an obligation to give them protection. Have your boats investigate them. If they're legitimate, tell them they can count on us for help if they need it. Khan protested privately. There's a lot of stuff around here, in small caches, he said. Equipment for guerrilla companies, in event of invasion. When work slacks off here, we could pick that stuff up. Khan, there's an old stock market, Maxim. A bear can make money sometimes, and a bull can make money sometimes, but in the long run, a hog always loses. Let the other people find some of this. It'll all help the plan. Fact is, I've been thinking of leaking some information, if I can do it without Fawzy and that gang finding out. Do you know a good supply depot, or something like that, say over on a care, or on the west coast?  How about one of the hospitals? No, not a hospital. We might use them to talk Wade Lucas into joining us. A lot of medical stores would be good bait for him. I'm afraid he's going to make trouble if we don't do something about him. How about engineering and construction equipment? I know where there's a lot of that down to the southwest. That's farming country. That stuff will be useful down there. I'll do that. The next morning Rodney Maxwell scorched the stratosphere to store Cinda in his recon car. The day after he got back, there was a big discovery of engineering equipment to the southwest, and as he had anticipated a second rush of prospectors. They had the vertical shaft clear now, and the Lester Dawes was shuttling back and forth between force command duplicate and store Cinda. Other ships were coming in now, mostly privately owned freighting ships. They bought almost anything as fast as it came out. The stock market had been paralyzed for a couple of days after the discovery of force command. Nobody seemed to know what to sell and what to hold. Now it was going perfectly insane. Twenty or thirty new companies were being formed. Unlike Litchfield Exploration and Salvage, they were all offering their stock to the public. A week after the opening of force command, the stock exchange reported the first half million shared days since the war. A week after that, there were two million shared days in succession. Some of the L, E, and S stockholders who had come out on the first day began drifting back to Litchfield. Lester Dawes was the first to defect. There was nothing he could do at force command, and a great deal that needed his personal attention at the bank. Morgan Gatworth and Lorenzo Monardis and one or two others followed. Kurt Fawzi, however, refused to leave. Merlin was somewhere here at force command. He was sure of it, and he wasn't leaving till it was found. Neither were Franz Veltrin or Dolph Kelton or Judge Lidoux. Tom Brangwen resigned as town marshal. Clemseriff was too busy even to think of Merlin. He had almost as many men under his command, and twice as much contragravity as he had had when the System States Alliance Army had surrendered. Khan flew to Litchfield and found that the Public Works Project had come to a stop at noon of the day when force command was entered, and that nothing had been done on it since. The cold vitrifier was still standing in the middle of the mall, and topside Litchfield was littered in a dozen places with forsaken equipment and half-completed paving. There was no one in Kurt Fawzi's office in the Airlines building, and the employment office was jammed with migratory workers vainly seeking jobs. He hunted up Morgan Gatworth, the lawyer. Can't some of you get things started again, he wanted to know? This place is worse than it was before they started cleaning up. Yes, I know. Gatworth walked to an open window and looked down on the littered mall. But everybody just dropped everything as soon as you opened force command. Kurt Fawzi's not been back here since. Well, you're here. Lester Dawes and Lorenzo Menardis are here. Why don't you just take over? Kurt Fawzi couldn't care less what you do. He's forgotten he's mayor of Litchfield. He's forgotten there is a Litchfield. Well, I don't like to just move into the mayor's office and take over. From somewhere below a submachine gun hammered. There were yells, pistol shots, and the submachine gun hammered again, a couple of short bursts. Some of the farm-tramps who can't get jobs, trying to steal something to eat, I suppose, Conn commented. Gatworth was frowning thoughtfully. He'd only need one more very slight push. Why don't you talk to Wade Lucas? He's got brains, and he's honest. Nobody but an honest man would have made himself as unpopular as Lucas has. If you pretend to be disillusioned with this Merlin business, it might help convince him. He was blaming you and your father for what's been going on here in the last two weeks. Yes, he'd help get things straightened out. At home he found his mother simply dazed. She was happy to see him and solicitous about his and his father's health. It seemed at times, though, as if he were somebody she had never met before. Events had gotten so far beyond her that she wasn't even trying to catch up. Fora, returning from school, stopped short when she saw him. Well, I hope you like what you've done, she greeted him. For a start, yes. For a start, you know what you've done. Yes, I don't know what you think I've done, though, tell me. You've turned everything into a madhouse. You've set this whole world Merlin crazy. Look at the stock market. You look at it. All I can see is a pack of lunatics playing Russian roulette with five chambers loaded out of six. Some of this so-called stock that's being pedaled around isn't worth five millisols a share. Seekers for Merlin Limited closed today at a hundred and seventy. You notice there isn't any L.E.N.S. being traded. If you don't believe me, talk to Lester Dawes. He'll tell you what we think of this market. Well, it's your fault. In part it's my fault that any of these quarter-wits have any money to play the market with. They wouldn't have money enough to play a five-centisole slot machine if we hadn't gotten a little business started. There was just a little truth to that, too. A few woolen socks were coming out from under mattresses, and a few tin cans were being exhumed in sellers, since the new flood of federation equipment and supplies had gotten on the market. He'd seen a freshly-lettered sign on Lenya Noguchi's tailor-shop. Quarter price in federation currency. That night, however, he had one of the nightmares he used to have as a child. A dream of climbing up onto a huge machine and getting it started, and then clinging, helpless and terrified, unable to stop it as it went faster and faster toward destruction. Clem Zareff's patrols were encountering larger outlaw bands, the result of gang mergers. They were fighting with prospecting parties, and prospecting parties were fighting one another. Much of this was making the newscasts. One battle between two regularly-chartered prospecting companies lasted three days, with an impressive casualty list. Public demands were growing that the planetary government do something about the situation. The government was wondering what to do or how. There were indignant questions in Parliament.  And, of course, the market boom was still on. The newscasts were full of that, too. He had started worrying about if a bust came. Now he was worrying about what would happen when it did. Another good reason for wanting to get to Koshai and getting a hypership built. When the bust came, he and his father would want one very badly. In any case, it was time to begin getting an expedition ready for Barathrum spaceport. Quite a few of the new companies had large contra-gravity craft, and the nascent planetary air navy was approaching a state of being. He wanted to get out there before anybody else did. Maybe if they got the hypership built soon enough, it would start a second, sound boom, that would cushion the crash of the present speculative market when it came, as come it must. He talked to Clem Zareff about borrowing a couple of the 80-foot gun-boats. Zareff's attitude was automatically negative. We mustn't weaken our defense perimeter, we'd be inviting disaster. Why, this whole country in here is simply swarming with outlaws. They fired on one of our gun-boats, the were-wolf, yesterday. He'd heard about that. Somebody had launched a missile from the ground, and the were-wolf had detonated it with a counter-missile. It had probably been some legitimate prospecting company who'd taken the LENS craft for a pirate. And it was a battle down in the devil's pig-pen day before yesterday. That had been outlaws. They had been annihilated by something calling itself Seekers for Merlin Limited, whose stock was still skyrocketing on the exchange. He mentioned that. These other prospecting companies are doing a lot of our outlaw fighting for us, and as long as the country's full of small independent parties, the outlaws go after them and leave us alone. Yes, and I have my doubts about a lot of these prospecting companies, but a lot of the outlaws too, Zaref said. I think a lot of them are Federation agents. They're waiting till we find Merlin, and then they'll all jump us. Well... Khan adjusted his argument to the old rebel's obsession. I'll admit that as a possibility. If so, we'll need heavier weapons than we have. This spaceport on Barathrum might be just the place to get them. Yes, it might. Defense armament and the stored ship's weapons. Say, if we grab that place and move all the heavy guns and missiles here, we could stand off anybody. The thought of a fight with minions of the Terran Federation seemed to have shaved ten years off his age in a twinkling. You take the Lester Dawes and let's say three of these gunboats. Let me see. Goblin, Fred Karski, and Vampire, Charlie Gatworth, and Dragon, Stefan Jorison. They're all good men. Homeguard. Trained them myself. Aren't you coming, Colonel? Oh, I'd like to, Khan, but I can't. I don't want to be away from here. No telling what might happen. But you keep in constant screen contact. If you get into any trouble, I'll come with everything I can put in the air. End of chapter seven and eight.


Hello. I'm Nikos. I'm a cryptography researcher at FireBlocks. This is Zorin. He's a security researcher at FireBlocks. And we're here to talk about hacking crypto wallets. So what is a crypto wallet? So let's say you want to spend Bitcoin. You need a wallet. That wallet holds a key. That key allows you to sign transactions. Those transactions you can broadcast to the blockchain and send crypto to your favorite people. There's a problem with the setup because there is a single point of failure. The key is sitting in one place ready to be stolen. How can you minimize that risk? You can use multi-party computation, also known as MPC. So what is MPC? So at a very high level, the idea is that instead of having one key in one place, the key is split into shares. And those shares reside with different parties. Actually MPC promises much more than what the picture suggests because the key is never assembled in one place. The parties calculate their shares and the public key via an interactive protocol. And then every time they want to sign a transaction, they run a different interactive protocol for calculating the signature. So small aside, MPC is much bigger than the use case I just described, which is threshold signatures. It is the crown jewel of modern cryptography. Basically anything you can do with a trusted centralized party, you can do trustlessly with MPC. There are numerous examples. I'm not going to go into them. But what I will say is that commercial adoption has been a bit slow. MPC has been around since the 80s. And the most significant use case before blockchain was the famous Danish sugar beet auction of 2008. And since the advent of blockchain, MPC is now protecting billions of dollars in cryptocurrency wallets. But we're not here to talk about MPC in itself. We're here to hack crypto wallets that are based on MPC. So what would that look like? One thing that could happen is in the now of service, let's say I'm able to freeze your wallet so you can't spend your crypto. That's a problem. Something more severe would be signature forgery. Let's say Nikos and I, we have an MPC wallet. So every time we want to sign, we sign together. So I tell him, let's sign this $10 transaction to your favorite charity. He signs it. But because I took advantage of some flaw in the protocol, I actually made him sign a totally different transaction without him knowing. That's bad. But what's even worse would be private key exfiltration. Whereas by him signing that transaction, he leaked his key share to me and now I can sign whatever I want whenever I want without his consent. Today's talk will be focused on this. We're actually going to show you three different attacks that all end with private key exfiltration. When we'll be talking about attacking crypto wallets, MPC crypto wallets, I want you to have this threat model in mind.  So each time they want to sign, they need to collaborate. Now one of those participants, namely Alice, will be acting maliciously. Now either she woke up one day, decided to be evil, or maybe she was compromised by an attacker and now is using her identity to attack the other people. So whatever her motivation might be, she wakes up in the morning, her only goal would be to exfiltrate the other counterparty's key shares. And she will do that by signing normal looking transactions with them. So the research findings that brought us here today were as followed. We have discovered four novel attacks, including three zero days. These findings have affected over 16 different vendors and or open source libraries. We'll be releasing at the last slide four fully working proof of concept exploits for these attacks we'll be showing you. We actually use the very same proof of concept exploits against two vendor production environments and got the private keys. And the last thing I want to stress is most of our attacks are not implementation specific. We'll be attacking MPC at the protocol level. So the affected parties were numerous. Some of the biggest crypto wallets were affected and a number of crypto custodians were affected. The most popular consumer MPC wallet was affected as well as some of the most popular open source MPC libraries. The attacks will be covering today. We'll start with attacking the most popular two party signing protocol. It's called lindl 17. Carrying out the attack will be somewhat high interactivity required. Then we'll go to the second attack. We'll attack the most popular multi-party signing protocols, the GG18, GG20 family of protocols. And last but not least, we'll attack what we call a do-it-yourself protocol because it doesn't really closely adhere to any academic paper. Okay, so before we have a look at the exploits, we need a few items of background material. The first item in the background is the math. Thankfully, no math. I mean, no advanced math. The only thing, we're not going to be talking about elliptic curves or abstract groups. The only thing you need to know for today is the modulo operator. What is the modulo operator? Well, very simply, x modulo n is the remainder of x divided by n. For example, 5 modulo 5 is 0 because 5 is divisible by itself. And 6 modulo 5 is 1 because 6 is greater than 5 and there's overflow and yada, yada, yada. Great. Second item in the background is homomorphic encryption. This is a cool thing. So what is it? It is a special kind of encryption that allows computation on encrypted data. Without decrypting the ciphertext. That's very important to note. So, for example, let's say Alice sends an encryption of the number 42 to Bob. So here and throughout the talk, we will be using color coding. Red for values that Alice knows, blue for values that only Bob knows. So Bob receives this thing and he can operate on it. For example, he can multiply by the number 2 and he can add the number 100. He does this obliviously without knowing what's happening inside the ciphertext. Alice, after receiving the resulting ciphertext, can decrypt it and learn the result without ever knowing what Bob exactly did to the ciphertext. So there are many kinds of homomorphic encryption. I'm not going to dive into them today, but we will be looking at the most vanilla kind, which is parametrized by a public key n. This is a number and it's the product of two big primes. This detail will become relevant later in the talk. So the last item in the background is the ECDSA signature scheme. This is the most important signature scheme in the blockchain space. It is used by Bitcoin, it is used by Ethereum, among other blockchains. And the protocols will be looking at implement this scheme. So how do you generate an ECDSA signature? It goes something like this. First, you sample a random number K. This is a secret and it is chosen afresh with each signature. It is also called the ephemeral key. Then to calculate the signature, you simply compute a function of the message to be signed, the ephemeral key, the private key, as well as an ECDSA constant that everybody knows that we denote by L. So that's for one party. What about multi-party? What about two parties? Well, the idea that we've already alluded to at the beginning of the talk is that instead of having the secret material residing in one place, the secret material will be split between the parties. Okay, so having covered the background, now we can move on to our first exploit. We will show you how to compromise the LINDEL 17 protocol, implementations of the LINDEL 17 protocol. And in order to explain how to compromise it, I need to tell you what the protocol is. So it goes something like this. So first, there's a key generation phase where the parties choose random key shares, so that would be X1 for Alice and X2 for Bob. The next step in the key generation is for Bob to encrypt his share under a homomorphic scheme that he controls, and he sends that encryption to Alice. So he sends an encryption of X2 to Alice. I will remind you that only Bob can decrypt this thing, but Alice can operate on it. And this is going to be important for signing. So before we move on to signing, we need to address the elephant in the room. This is a cryptography talk, so there's going to be formulas involved, but nothing bad is going to happen, or it will take care of you. Okay, so let's have a look at signing. Signing goes something like this. So Alice uses the ciphertext she receives from Bob during the key generation to send an encrypted partial signature to Bob. The encrypted partial signature looks something like this, and the only reason I am displaying this formula is to show you that we have almost all of the ingredients for the ECDSA signature scheme. We have the X's, we have the message, we have K1, we have the ECDSA constant L. The only thing that's missing is K2. So how does Bob finalize this thing? So he simply decrypts this value, multiplies by his contribution to the ephemeral key, and reduces everything modulo L. At this point, he checks whether this thing is a valid signature. Why does he need to do that? Well, he does this because, you know, maybe Alice fell asleep while during the signing process, and she forgot to multiply by her K1. At this point, Bob will fail to verify that the signature is valid, and Alice will be notified of this, either because Bob tells her, or because the signature never made it to the blockchain. So what happens in this case? Well, to answer this question, we consult with the paper the protocol is based on. And the paper has a very interesting assumption, not assumption, instruction. It says any abort will result in, will imply no later execution, which means that if Bob detects an invalid signature, the wallet must be locked. Putting our adversarial hats on, we see this, and we think, well, maybe we can leverage this into a denial of service attack. Maybe we can act as Alice and send some garbage nonsense partial signature to Bob, and now the wallet is supposed to be locked, right? So we went on to code this. We found some open source implementation of the Limbendil 17, and we tried to do this. To our surprise, nothing happened. Basically, we tried again and again, and the wallet was never locked. So we're kind of devastated by our failure to mount some denial of service attack, and we went back to the drawing board. We're trying to understand, wait, if this assumption, this instruction is part of the paper, why is it there in the first place? So the paper is actually very clear about why it's important. It says the only problem is that Alice may send an incorrect partial signature to Bob, in which case the mere fact that Bob aborts or not can leak a single bit about Bob's private share of the key. Now, taking this intuition, and like taking it to its logical conclusion, we might think of an hypothetical attack that looks something like this. First, Alice would craft a malicious signature that would fail to verify depending on a single bit of Bob's key share, and then she will see if it verifies or not. Then she can do this again, and again, and again, every time by seeing if the signature verifies successfully or not, knowing if that specific bit is one or zero, 256 signatures later, bam, she has the entire key share of Bob, she can combine it with her own and sign away without his consent. So this is very easy, you know, to do in PowerPoint with pictures, but to actually get the math to do this, you need a cryptographer like Nicholas. So that's where we stopped relying on the paper and we had to think for ourselves. And what we did is we had a long hard look at the partial signature that Alice sends to Bob. And we tried to mess around with it. We tried to like, you know, tinker with the X, we tried to tinker with a message, nothing happened, we tried to tinker with the K, again, nothing happened. But then the crypto gods smiled on us, because we had the following breakthrough, we realized that if Alice switches the modulus, so instead of using the L parameter of ECDSA, she uses the n public key of the homomorphic encryption scheme, these two values are equal after Bob decrypts, if and only if X2 modulo K1 is equal to zero. So I will spare you the mathematical mumbo jumbo and I will give it to you in a picture. Basically, when Alice switches the modulus, the following thing happens. If the signature is valid, X2 is divisible by K1. And I will remind you that K1 is a value that Alice controls and she knows. If the signature is invalid, then X2 mod K1 is not equal to zero. And this is this is this is very good for the attacker, because this already gives a way to learn the least significant bit. Why? Because Alice can simply set K1 equals two. In this case, she mounts the attack, she switches the modulus, and she obtains leakage X2 modulo 2 equals zero or not. And this is exactly Bob's least significant bit. Okay, so that's one bit. But what about the rest of them? So for the next bit, you can use the next power of two, namely four. When you mount the attack, you obtain leakage whether four is whether X2 is divisible by four. So this is great leakage. If X2 is already divisible by two. Because if not, then the leakage that you actually want is X2 minus one is divisible by four. And to obtain this leakage, well, what you need to do is you need to do some math. You need to massage the algebra, you need to add an offset to the partial signature in order an offset that depends on whatever you already know of Bob's key.  So to summarize, in order to exfiltrate the ith bit, you set K to be the ith power of two, you offset the partial, Alice's partial signature by a value that depends on whatever you already know about Bob's key. And in the end, depending on whether the signature fails or not, you obtain leakage the ith bit of Bob's key share. We didn't leave it at this and we want to see if it would actually work. So we went out, we found the most popular open source implementation of the Lindel 17 protocol. It was published by Zango. And we tried to see if we could make it work. So this is how the POC looks when it's run. As you can see on the right hand side of the screen, every signature leaks us a single bit of Bob's private key share, depending whether the signature failed or not, we know whether it's one or zero. We only need to do this 256 times. Now it may sound a lot, but it only takes a couple of minutes. And bit by bit, we leak the entire key. Now we can combine it with our share of the key and we have the entire private share. We can print it in hexadecimal format, load it to MetaMask or your favorite crypto wallet and you're done. So we've disclosed this to all the affected vendors and they've since mitigated it. How did they do that? Well, they simply followed the paper's specification. So like after you see that there was a failed signature, just don't sign again. Now this works, right? It mitigates the attack. But there are also other ways that you could, you might want to do it where you don't get a possibility of a denial of service attack. And to explain a possible way of doing that, we'll need to introduce a new cryptographic primitive. It's called a zero knowledge proof. What is a zero knowledge proof? Basically, it's a proof that yields the validity of a statement and nothing else. So to illustrate with an example, let's say Alice encrypts some number x along with a zero knowledge proof that that number is within some range, for example, one to 42. Now Bob can receive this and verify the zero knowledge proof and be certain that what he has is indeed an encryption of a number between one and 42, but he knows nothing else, only what the zero knowledge proof wanted him to know. So taking the intuition of this thing, we could maybe add a zero knowledge proof to the protocol in order to make sure that Alice cannot deviate from calculating the partial signature in the way the protocol says she needs to do. Well, congratulations, you've learned how to compromise implementations of the most popular two-party signing protocol, also how to mitigate it. And we're on to our second attack of the day, which is attacking the most popular multi-party signing protocol, meaning it can be two parties, three parties, or a hundred even. So this has affected many vendors and open source projects. So when we talked about the Lindell 17 protocol, we actually explain how it works, like start to finish. But the Digi protocols, the thing with them is they're very complicated. They actually, to sign, they require between seven and nine rounds of communication. So we don't have to time to explain all that. And actually, we don't even need to because the entire thing happens during the very first round. The very first round implements was called a multiplication to addition. So let's dive into that. What is it? It's a way to transform two multiplicative shares, k and x, into two additive shares, alpha and beta, where this equation applies. So how does the paper say that you could do that? It says that Alice needs to encrypt her multiplicative share k, along with zero-knowledge proof for doing just that, and send it over to Bob. Bob now can operate on this homomorphically encrypted value. He doesn't know what it is, but he can multiply his multiplicative share, his x, his key share. And to make sure that Alice doesn't learn anything about his x, because that would be terrible, he adds a mask to mask it. Now Alice decrypts this, she gets alpha, Bob gets beta by being equal to minus mask. And as you can see, it so happens that k times x equals to alpha plus beta. There's one very important thing that we need to know about this. In the case of ECDSA where x and k are 256 bits, the mask needs to be sufficiently large, needs to be bigger than 512. Now, why is that? To give an intuition of how this masking works, we're going to use some visualization of small numbers. Let's say we didn't even use a mask. If Alice would encrypt and get this value, the x times k, she knows k, right? She could just divide it by the k she knows and get x in the clear. That's why we need that mask. Now, adding the mask actually works. It masks it. Although she knows k, she doesn't know the mask so she can't learn anything about Bob's x. But what happens if that's not the case? What happens, for example, if k is even larger than the mask itself? In this case, we can see that adding the mask actually hides nothing like the most significant bits, leak x in the clear. Now, this could be a really great attack, right? Like we could be Alice, we could choose a really big k that's larger than the mask, send it over, decrypt this, and get everyone's key share in one go. But remember that zero knowledge proof that I mentioned that she's sending over, it actually also includes what's called a range proof. What that is, it's a zero knowledge proof that ensures that the number k is no bigger than 256 bits, which kind of foils our entire plan of attack here. So we're going to get deeper into the math of the zero knowledge proof. Hold on tight. How does it look like? Basically it's a bunch of numbers. The number z is the one that we'll be focused on because that's the one that relates to the range proof part of the proof. Now, how is z calculated? It's equal to w, which is a small random number, plus k, which is the number Alice trying to prove is sufficiently small, times a hash that depends on w, everything what you're doing. Now when Bob receives this, he does a bunch of verifications over the other parts of the proof that we're not going to touch on, and he makes sure that z is small. Now, as you can see, if k will be too large, then z will not be small enough and will fail the range proof part of the proof. Now, I just want to stress that Alice has to follow this specific formula for calculating z, because if he doesn't, some of the other verifications would fail. So, how can we go about cheating in this zero knowledge range proof while adhering to this formula of calculating z? What we're going to do is we're going to focus on this part of the equation, and we're actually going to try and zero it out, right? If we somehow manage to zero it out, then it doesn't matter how big k is, z is only equals to w, which is a small number, and we can use whatever big k we want and pass the verification. So, how will we do that? We're going to use what's called the Chinese remainder theorem for this use case, because, as Nikos mentioned earlier, n is a product of two primes, p and q. If this value we're trying to zero out modulo p and modulo q, they both zero out, then it also implies that the value we're trying to zero out zeroes out. So, we're going to use this lens of looking at it, and we can try to zero out the left-hand equations one by one, and by doing so, we'll achieve our goal of zeroing out the right-hand equation. So, one by one, we start with the first one, it's actually surprisingly simple, because Alice is free to choose whatever k she wants. How about she chooses k to be equal to q, right? Then, by definition, q mod q zeroes out, and we're halfway there, the easy half now. So, how do we go about the second part? How do we zero out this value modulo p? What happens if this hash that depends on w, happens to organically land on a multiple of p? Well, that would be fantastic, right? So, is it likely to happen? No, but what if we brute force w, such as the hash that depends on it, happens to be a multiple of p? Is this feasible, you might ask yourself? The question is, no, it's not at all feasible, because the paper says that n needs to be 2,048 bits, which makes p and q over 1,000 bits. Now, that's impossible to brute force, and we might as well just brute force x, which is 256 bits. So, what can we do? How about during the key generation phase, which happens once per wallet, Alice, instead of choosing n to be comprised of two equally sized prime numbers, she would choose n to be comprised of two very asymmetrically sized prime numbers, whereas p can be as small as 16 bits, which is brute forceable in an instant, and we can have q to be sufficiently large to make up for the desired size of n. Now, some of you might be thinking, well, maybe the protocol says that there's zero knowledge proof to prevent us from choosing such an n. It turns out that there is no zero knowledge proof that prevents us from using such an n. There is no zkp for no small factors. The only thing that the parties check is whether n is square free, and I'm not going to get into the technical definition of square freeness, but it sounds like, you know, we have a way to, we have a hook, we have a way to get the goods. We can inject this n with a very small p, then we can choose k to be equal to q, then we can cheat in the range proof, and then when we receive the MTA response, we can get all the x's in the clear. So, are we done? Not so fast, because remember the MTA formula, so this is what Alice obtains during the MTA. Well, in reality, there is a pesky modulo n operation happening there implicitly, and it's unavoidable. I'm not going to get into why it's unavoidable, but it's unavoidable, and it's very annoying for the following reason. k is now almost as big as n, and what happens to the leakage when k is almost as big as n? So, let's have a look at k times x plus the mask. Here we see the beautiful x and the most significant bits in the clear. However, as soon as you apply the modular operator, the most significant bits of x, they disappear, they jump off a cliff, they go bye-bye.  How small? What Alice obtains using this attack is x mod p, and p is a 16-bit prime. If only there were a way to obtain x from such remainders. Worry not, Nikos. Once again, the Chinese remainder theorem comes to our rescue. Now, let's explain how it works a bit more in depth. Let's say we have this small number x, which is 23, right? We can encode it in a myriad of ways, like we can also see in the screen, we can encode it decimally, we can also encode it hexadecimally, we can actually also use crt to encode a number. Now, how would one go about doing that? You need to divide this number by a few small primes and save the remainder. Now, just using this information, the primes and the remainders, you can feed them into crt to reconstruct the original number fully. Now, it looks a bit like magic, but it also has some limitations. Namely, it would only work to encode a number that is smaller than the product of the primes. In this example, using the primes 3, 5 and 7, you could only encode a number as big as 105. We're trying to encode a number as big as 256 bits. So to do that, we'll need 16 small primes that are each 16 bits of size. So if we can get these 16 remainders by the leakage that we explained earlier and feed them all into crt, we have Bob's quisher, right? That could work. Anything stopping us? Yes. We only have 1n. Remember, while k is chosen afresh during every signature generation, n is chosen once per wallet during the key generation phase. So we only have 1p value, so we can only do this to achieve the very first leakage. So bear with me. What if, during the key generation phase, Alice, instead of choosing n to be this handsome looking value that is a product of two primes, she would choose n to be this monstrosity that is a product of 16 small primes, plus times a prime that is as big to make up for the desired size of n. Well, some of you might be wondering, well, isn't there some zero-knowledge proof in the protocol to make sure that you can choose this monstrosity? It turns out that there is no zero-knowledge proof before checking the bipramality, because the only thing that the parties check is whether n is square free. And I'm still not telling you what square free-ness is. So we're at the finish line. We can extract all of these moduli by injecting the n and then choosing the k and then cheating in the range proof and then obtaining the leakage. So how does it work? Well, when we had the normal looking n, we said k equals q and we obtained leakage x mod p. Now that we have the bizarro n, we said k equals n over p i and we obtain leakage x mod p i. And we need to do this in 16 different signature generations, 16 different signature sessions. In the first one, we're going to use the first k, it's going to give us x mod p 1. In the second one, we're going to use the second k, it's going to give us x mod p 2 and so on and so forth until we get the 16th leakage. We feed everything into the CRT algorithm and we obtain x in the clear. So once again, we went to see if this crazy idea would work. We found an open source implementation of the gg20 protocol and we gave it a try. So we start by choosing 16 small primes to make our bizarro n and then we start signing. Each time we choose k, we cheat in the range proof and we get the desired leakage. Now we need to do this, we need to sign 16 times each time getting one of those leakages and then we can feed all of this information into CRT. Once again, combine it with our own key share and we can print the full private key in a beautiful hexadecimal format, load it up, spend away, no need for consent of any of the other parties. Once again, we've notified all the affected vendors, have since mitigated this attack.  Well, you could add those zero knowledge proofs for making sure the well-formness of n so Alice can choose this bizarro n that is needed to carry out the attack. Well, congratulations, we're done with a second attack when you're on to the third and last. Great, so in the last few minutes we will show you how to compromise what we call a do-it-yourself protocol that we found in the wild. For this protocol, we will be exfiltrating the key in a single signature. Actually, we're going to do that in less than a signature. We're going to do it in the first round of the first signature generation. So what does the protocol look like? So it is also an MTA-based protocol. However, here there are no zero knowledge proofs accompanying the ciphertext that the party sent to each other. Furthermore, the mask now is chosen to be as big as n and this is important because now our previous attack is no longer relevant because it doesn't matter how big k is what's inside the encryption is always hiding the x. Okay, so what can we do about it? Well, we can do a lot about it because without the zero knowledge proof, Alice can send something that's not even a ciphertext. She can send, for example, the value 4. In doing so, and by choosing a carefully crafted n, specifically one that is not square free, Bob will inadvertently send back his x in the clear. Actually, it's not exactly in the clear.  Alright, so you could think about this attack as a condensed version of the previous one whereas instead of getting the 16 leakages in 16 signature, we get all of them in one signature, do the brute forcing offline and then use CRT to reconstruct the key. Now, this demo is going to go fast so do not blink. We start the signing, we do the MTA phase, we get the leakage, we do the brute forcing, we fit it all into CRT and voila, we have the private key. To conclude, we've shown you a bunch of different attacks on MPC protocol that all result in exfiltrating the private key which is bypassing the basic promise, security promise of the MPC protocols. I don't know, I hope that you might find this as interesting, as exciting as we do because this is a new space, the cryptography is really interesting and it could really use as many researchers, as many smart people's eyes looking over making sure everyone is implementing this stuff correctly. Here you can find all the proof of concept source codes that we've shown you today as well as a technical white paper explaining the math in more depth than you could have ever dreamed of and thank you very much for coming. Thank you.