Folks, we have now come to the actually closing tail end of our crypto talks, but we still have some other stuff to cover here. Before we start on that, I made an announcement on the mailing list. I'll remake this announcement. I send out a link. We still have about 20 spots available for the Symposium on Information Assurance Research and Education that we're hosting tomorrow. We have some really great presentations from all states early morning, which is a local company, and the person who does this is the manager of the penetration testing team, Joaquin Fuentes. We have Aaron Gibbs, who is a special agent at the FBI, and two people from State Farm to give talks on how they use security in their organization, what types of things they put before, what types of recent threats are they seeing. I talked to Aaron. She's going to have a really interesting talk about a recent case that she can actually talk about where they used some cybersecurity and some security elements. So it's a cool case of the one that I guys mess up, and this is what happens and how they get you. We'll also be having panels, poster sessions, food is provided, but there's only 20 spots left, so I can't have all of you come. I'd love to. So if you can attend most of the day, feel free to register while there's still tickets. There's still tickets available, so you can read more about it at the links that I sent. Any questions? It's not a recruiting event per se, but this could be a good way for you to see what local people and what industry folks are looking for in security, what kind of problems they face, and the lunchtime is going to give you a good opportunity to talk to them, which is how you get jobs. Questions? Maybe just don't register and you popped in. If I don't notice, it's fine. I mean, just as long as we're under the fire code, I guess that's the only thing I really care about. And it's an old name, so that's pretty sweet. It's a really nice term. Feels fancy. So is this more important, or is this a whole lot more important? Both of these are important. Good answer, all right. You're getting a ticket. I should have done that. Okay, so sign of two is going to be 100% crypto. Split into points wise into two halves, let's say, because I don't want to load up parts two weeks for this. I think it shouldn't be a problem, but the first parts are actually incredibly straightforward. There's cipher text. It's actually not here. You have to log in. You'll see your personal cipher text, so you can type different ones. You have code here, Python code, of how this cipher was done. So break it. It's actually not a lot I can say here. So the goal is to break, get the key, break that encryption, and recover the plain text. So what you need to submit is a readme file. You'll submit the key, and that's how we know you actually broke it. And I'd like you to submit all the code you used. If you wrote any code, helper functions, I mean, it doesn't have to be, sometimes when you're doing this, you're just writing kind of one-offs or something, but anything that you wrote that helps you do this, submit that as part of that because we like to see what kind of cool stuff you guys come up with. And then your readme should contain name, ID, the plain text to prove that you actually broke it, right? Just saying like, oh, the key is abcdfg. Maybe it's true, maybe it's not. Where the plain text came from, so doing a little digging to figure out where the stuff came from. Read description of the code you submitted about how to use it, what does the kind of parts do. So don't just throw like 20 Python files at us and expect us to figure out what all the different parts mean. So it's like common decency and documentation. And description of how you went and broke it. So this is, you know, found the key is probably not a good description, but, you know, talk about the different false starts that you did, how did you try approaching this, how did you try determining maybe key length or some of these other things. So there's two parts here, and then you'll submit a key. So you'll submit the key, and as you get into this, I don't want to spoil your fun too much, but it'll be a hexadecimal key. So that will be kind of the way we'll represent keys. I think it'll be a favorite start on campus. So there's two cyber texts, one for part one and one for part two. They read the same, and the third part I'm going to wait to talk about until we go forward. As I should say, as I rush to go to the slides, as soon as we're done with these slides, I will post them. But remind me if I know, which is a possibility. Yes, we only have like a few, I think we only have a few more slides to get through today. So that's a good question. Yeah. Not yet. I'm giving you guys a sneak peek. Also no key submission yet, so I figured you can start breaking stuff now. Is there anything else? Oh, yeah, yeah, the important thing. So obviously we've seen crypto, right? These are, I mean, a lot of what we're doing here is based on trust, right? The trust that you're doing these things. I trust that you're doing them correctly. And especially these type of things, because this is essentially a puzzle, right? You're trying to solve a puzzle.  This is like the entire point of doing this. This is kind of what I like to think of is like, it's easy to think you understand how to break and approach a cryptography problem from learning about the slides and learning about a class and going through a canned example that has the exact names you should look for. But now when you have something more real world, it actually becomes a lot more difficult. And so you should see this as kind of a personal challenge to make sure you actually understand these concepts of how to do crypt analysis. And as such, there are very much puzzles, right? So once you get it, you get it. And so you're sharing that information about this, how you approach this really robs your fellow students of the joy of learning and discovering. Yeah. Is there any incentive to finishing it first? No. Not on these parts. There's other incentives on the next half that I'll talk about after we get through the material. I think that'll be more fun, more fun incentives. Any other questions? Sweets. Talk about HRAX. So what is, so we talked about some of the problems with the cryptosystems that we've been studying. One main problem is that they all essentially are relaxed. So they don't offer any integrity protection, right? So we looked at hash functions. We looked at how hash functions actually add some integrity protection. So that way somebody receiving a message can know whether the message has been tampered with or moved out of order or we're doing anything like that. So hash functions are great for that. But so let's think back. So what was the problem that public key cryptosystems tried to solve from symmetric key cryptosystems? Right, the key. So what was this weakness? What was the problem there when we missed there? Right. So the idea is you need, in symmetric, you need a confidential channel in order to transmit keys, right? So in a public key cryptosystem, you don't need a confidential channel. But what do you actually need? Two keys. You definitely need two keys. So let's say two of you in this class kind of use that review. Say, any two people in this class want to securely transmit information using public key cryptos. How do they actually go about that and be sure that the other person is the one who that they're talking to? So let's think of one scheme. So let's think of one scheme. We'll use kind of the box analogy that we used before. I'm going to get rid of the box and all the box. So let's say there's just a, because we said the keys, anybody can inspect the keys, right? So we're not assuming that there's a confidential channel. So let's assume that there's a basket or something in this room. Two people here want to communicate. So I should have asked at the beginning if anybody was named Alice and anybody was named Bob. But let's say Alice is a student in the class. She wants to talk to Bob. So she puts her public key in the box, right? So I, as an adversary, Eve, I can inspect that public key and I can't, I can't derive her private key. And then Bob comes along, sees the box, takes her public key out, puts his public key back in, and then Alice comes to a later point. So again, I can read the key, but I still can't derive anything about the private key. And then Alice goes and sees that key. So then what could I do as an attacker in this scenario? So think about, think about a different point. When Bob goes to that box, what does, for the first time, what does he know at that point? Put a key in the box. Somebody put a key in the box. Does he know who put the key in the box? No. Is it guaranteed that it's Alice? Could the key say that it's from Alice? Yeah, it can say whatever it wants, right? We get very familiar with this. It can say whoever wants. It can, we, and so the problem there is Bob doesn't know that it's actually Alice's key, right? All he knows is there's some key in the box. So then what can our adversary do in that case? Put a different key in the box. I can put a different key in the box, right? I can generate a fake Alice public private key, a fake Bob public private key. When Alice puts her key in the box, I can look at it, and I take it out and put my Alice public key in the box. And then Bob goes, takes that and says, oh great, this is Alice's public key, puts his public key back in the box. And now Alice, before she gets that public key, I put the new fake key there. And now what do I have to do as an attacker every time they want to transmit a message? Intercept it, right? So we've got to think Alice is going to encrypt her message to the public key she thinks is for Bob, but is actually mine. And so she will send that message out. I need to get that message intercepted, decrypted with my secret key, and then use Bob's public key to encrypt it back and send it to Bob. So Bob sees this, sees that he gets a message from Alice and thinks everything is fine, right? Or, I mean, I intercept it so I can completely change the message, right? Once it's unencrypted, I can do whatever I want, or I can just read their communication. So what's the fundamental problem here? Yeah, there's no, so the really, we're not just two entities that want to talk. I mean we have, we have identities, right? But the problem is how do you bind some identities to some public key? So this is the entire point about a public key is you want the public key to be, you want everyone to know that this is your public key. And so it really boils down to how do you trust that public key, right? And so I think this is an incredibly important concept because, A, it informs a lot of real-world crypto systems that use public key crypto, but it's kind of important to realize that, hey, you don't just get, you know, public key crypto doesn't just solve all the problems, it actually brings a host of new problems of how do you verify that this is Alice's public key, right? So just like we talked about with our box example, Eve can replace all the public keys with their own public key. So when Alice wants to send a message one out to Bob, Alice will encrypt this with the public key of Eve, which Eve can then steal, use the secret key to decrypt, get some message, and then change that message to some message M2 and then encrypt that with Bob's public key to get Cyber Text 2, then Bob can take that Cyber Text 2, decrypt it, and say, aha, somebody sent me a secret message. And nobody else has ever read or tampered with this message in between, right? Which is, is that true or false? It's true. Yeah, the message came from Eve, right? Nobody tampered with this message from this point, right? Once Eve encrypt that message with Bob's public key, nobody else can mess with that message, right? That message is confidential, and nobody but Eve and Bob now know what that means, what that message is. Sorry, I can't see that part of the room. So how do we trust public keys? It seems like a much better solution than cementing encryption, so we'd like to use it, but how can we actually trust public keys? A signature form in one sense, but how do I know that that all relies on a public key, right? So one thing you can do in which they do is you can hack your public key, right? Sharing my public key with everyone, maybe a bit too burdensome, but I can share the hash of my public key with everyone, right? I can put it on my website, I can buy a billboard and put that, put my fingerprint up there, I can buy a space in the newspaper so that everyone knows this is the, the hash of my public key, that could be one way, but you still have to tell everyone, so it's a similar, similar problem to be telling everyone your private key. How about this way? How do I know that any of you are an ASU student right now? If I wanted to ask you, how could you try to prove to me that you are? You can show me what kind of ID, any? A school ID? A school ID, an ASU school ID, right? So who am I trusting in that case? Now I'm trusting ASU to have, like, properly identified you before they issued you this ID card. Yeah, so maybe you're referring to the Chipotle problem, although you guys probably haven't thought about this. I believe it's probably still the case you made a free small soda at Chipotle with the student ID? Yeah, some people are not, I think they definitely know this. Do you think Chipotle employees are checking what your expiration date of your student ID or anything? No, so all you do is show them some ID and then you get the student discount, right? They're not actually verifying that you're currently a student, right? So, so there's part of maybe some expiration issues there about when does this thing expire, is that kind of what I'm trying to pull that box. How else could we do it? So we get through, yeah. Will require further information from that person to verify that they're actually keeping you in or that they're actually the person they say they are? Right, so similar to how we trust ASU to only issue ID cards to active employees, and that's even trickier because employees also get ID cards, so I can't necessarily prove that you're a student, but I can take that number that's on your card, match it with the roster of people who are in this course, and then say, okay, you're likely an actual student in this course. I can take that further to passports, right? So you get a passport, you need to provide documentation, so I can ask for a passport that matches with the ID card. So you can also, oh, I have this really weird situation when I moved to Seattle. I lost my driver's license, so the only thing I had was an expired driver's license, a paper certificate from California that said I was a valid legal driver there, and I couldn't find my passport either at that time, so I was freaking out, trying to get a Washington state ID, and I needed to get a new California one, I had to go back to California and go get one, but I already moved to Washington at that point, so I had this, they had this crazy system there at the time where you can choose like from three different categories of information. One category was my expired license, the other one was, I think I had a credit card with my picture on it, and the third one, the only thing I had in there was a yearbook with my name and picture, literally my high school yearbook, so I went to the Washington DMV with this information, and somehow got a driver's license, like it was everything.  So one type of way that we can talk about that we'll definitely talk about is some type of either, we can completely centralize this concept and say, okay, we're just going to trust a single entity to issue public keys correctly. So basically you can say, so, and that's the public key infrastructure which we'll talk about. The other way is we can do it completely decentralized, so how can we do that? And you know what movies are good to go see? Ask people that have seen it, or ask people who know people who've seen it, or trust reviews of people who write reviews about movies, who you trust that they actually like movies or whatever, you know, product, but the point is you can use kind of word of mouth or use your network, right? So you can trust people that you, so you basically can create this, what do we call, what they call a web of trust, so you can say, okay, I trust these people, so you can sign people's keys, and actually we'll look at that in a second. You can use this to essentially create a web where you have certain keys that you publicly said that you trust and that you have verified that the person who owns this key is this identity, right? And then they do that with other people, and so based on how you think about propagating this trust, that actually allows you to trust other people who you have no direct contact with, but people that you trust have verified each other, so you can kind of, you can think of it as essentially decentralizing this concept of trust. So the public key infrastructure is one of the largest kind of things that have dealt with this problem. The central idea is you have a certificate authority, so you have somebody who is responsible for verifying identity, so how does this actually work? So I have a public private key, what does the certificate authority have? List of keys that are, that one? So they could keep a list of keys, that would be if we're talking about we want everyone on earth to have a public private key, right? That would probably be an unwieldy two store. What do we really want? So let's say we have some certificate authority, you give me your public key, how do I know that this is actually your public key? What are some ways to do that? Even just going back, let's take it back without thinking about this, let's go back to our box scenario, right? Alice puts her public key in the box, there's some, we'll say the professor verifies identities of people, when Bob then goes into that box to inspect that public key, how can Bob verify that that public key actually belongs to Alice? What are some ways to do that? Bob could just directly ask the professor, hey, is this Alice's public key? I have this public key, does it belong to this person or are you defined person? You could think of email addresses, I think that's a good way to think about it. Does this email address own this key according to the professor? What's the problem there when we talk about professor goodbye? So we are fundamentally trusting this certificate authority, so we're delegating all authority to this certificate authority, but let's assume that even they're trustworthy at this point. No, it's not wrong, they're perfect for right now, stick with that model part. You still need all of that, you may have some database full of it. Yeah, think about every email you guys wanted to exchange with each other, you had to ask me if this other person was the correct key. Think about how many, that's a lot of combination because each of you needs to know about every other person's private public key if they wanted to, if it's the valid public key. Of course you can catch that information, so you could say, yes, okay, now I know Alice's public key is this and I trust this because the certificate authority told me that it's correct. But now I have to do this for everyone, Shane's insane. I would go crazy trying to keep up with this. So what do you actually want to know? So think about what Bob wants to know. What does he want to know? Going back to the example that Eve hasn't actually done anything to it because it's coming in as the original. Correct. Bob wants to prove that this public key that he's found is Alice's, right? The key itself says that it's Alice's, right? So Alice can then come to me and say, hey, I'm Alice. Here's my public key. Here's my ID card. Here's my passport. I can verify that, yes, this is Alice. She's in our system. Great. Then what do I do with her public, I mean, what can I do with her public key? I can store it. I don't want to store all your public keys. You have a limited number of people. I don't have a billion people. Yes. So one thing I could do is I could take that public key, encrypt it with my secret key, right? And then Alice can put that in the box and everyone else, Bob can then take that and know when he decrypts it with the certificate authority's public key that, wow, this definitely is legitimate. This is Alice's key. This has been verified by the certificate authority. Does Bob ever need to contact the certificate authority at that point? No. The problem is everyone needs to know what this public key is, right? And that literally, like, you, everyone needs to know exactly what the certificate authority's public key is because if I trick you to accept somebody else's certificate authority, right, another key is the certificate authority's public key. I can just issue these certificates for anything. And what we actually use rather than just encrypting the whole public key, we use that signature thing that we talked about. So we basically take the hash of the key and then we encrypt that hash with the secret key of the, of the certificate authority so that that way everything is attached with that and so we're all good. So that actually solves a lot of good scalability problems, right? This means even if the certificate authority goes down, you can still communicate and verify keys, right? If I'm sleeping, you can still actually talk to each other because you don't have to ask me to verify public keys. So still we have, okay, we have one entity responsible for everything, which is a lot. And we probably not want this if you think even just, for technical reasons, right, we may not want one single entity to have, to be the end all be all authority. You also run into political considerations in the real world where what is this company, who is it, who is the certificate authority, are they be molded into American interests or Chinese interests or Russian interests, right? And those countries may decide, hey, for us, we actually don't trust that certificate authority. We want our own certificate authority, maybe for good reasons because they don't trust how you're going to verify identities, maybe for bad reasons, whatever the case may be. And so essentially the system that we've come up with is there are a series, there are, you can have any number of essentially root certificate authorities. So this is somebody who says I will verify people's identities and those can actually delegate their authority to other certificate authorities. So if you want to set up shop as another certificate authority, so let's say the TA version. Let's say FISA wanted to become a certificate authority or I wanted to delegate some of that responsibility, I'd train her how to verify identities and make sure that she followed the same procedures. And then how would you know that she was a certificate authority that I trusted? You do the same process, but so the same process we did in the last step, you verify, you get the private key, you have the, you haven't signed with the private key, the hash of the intermediate certificate authority. Right, so I would take FISA's public key, I would hash that, and then I would sign that hash and give that to her. And then if she wants to sign any of your other keys, she could then sign that with her public key, but include in that message, hey, I'm trusted by the certificate authority, here's the message that I have that's actually encrypted by the ultimate certificate authority. So if you want to look that up, you would use her public key to decrypt it, and then you would use my public key to decrypt that. And so you actually verify this chain that I trusted FISA's public key, and that as long as you trust that chain, then you are, are, believe that this person has this public key that you're interested in. And you can do this kind of as arbitrarily deep as you want, you can have all types of certificate authorities here. So we need to issue certificates, I think that's the clear, the clear case here, but what is this fundamentally, so what are some real world problems that can come up here? Anybody lose their wallet or cell phone or keys or anything? No, they're all perfect people. Yeah, have a call of time, right? You like lose it, leave it somewhere, whatever. It gets stolen, that is another good analogy, right? So once a, let's say, if we just think about the individual level, let's say I verify that this public key is owned by Alice. If Alice loses her private key, now anyone can create messages and claim that they are from Alice, right? So we have this whole problem of, and this is a whole area of revocation, where how do we actually, so what are some ways we can think about maybe doing this? What's the simplest way? Yeah, let's say Alice loses her key, how do I deal with this situation? Right, what does the authority do? It's made the signature for that public key. That signature is out there that says that this public key belongs to Alice. So can we revert back essentially to our original model? What was our original model? What would Bob do when he looks at Alice's public key? Our original system, we have the box, Alice put her key in there, Bob sees the key. In our very first iteration of this, what did Bob, how did Bob verify that Alice owned this key? He used his secret key. He used his public key. Our very first iteration. So how did, how did Bob ask, I mean, how did Bob find out that the certificate authority trusts that this private key is Alice? Ask the certificate authority. So now, I mean, you could actually think of a revocation scheme where every time you see a public key, you ask the certificate authority and said, is this the public key? He said, is this key revoked? And you would say yes or no. So now the certificate authority has to be tracked with what? Revoked keys. Should that be smaller or larger than a set of keys? Should be smaller, although I don't know if that's actually true in practice. So this is one way you can do this. What's kind of the problem with, let's think about the homework one, the house. Let's say somebody loses one of those keys to the house, or any kind of house, but homework one I think has these concepts in it. You lose the key to your house. Should you be worried? Why? You can't get in. So what would you do? Change the locks. Right? So what if you change the locks every day? Would it be annoying? Yes, would you worry about a key from two weeks ago that maybe somebody cloned or that you lost? Would you worry about that? No, because if they didn't enter your house, you're fine. The idea is time limiting the keys. So you can actually, so a lot of the keys and you'll notice when you create your own public private key. So one way to deal with this is to time limit how long keys, either keys themselves are valid or you can limit how long the certificate authority's signature is valid. So I don't think anybody's had this problem. This problem on time when we came to which country we're in. We're in a different country and, oh that's right, somebody's, somebody couldn't access like Google and we thought like all the hotel Wi-Fi is blocking and trying to intercept our traffic or something and it turns out that the system clock was just messed up and was set to like three years prior or not three years ahead in the future so that that way it thought that Google's certificate was expired. And so the certificate authority can maybe put a time stamp and say I created the certificate at this time and it's only valid for 24 hours. And so now Alice can use this this public key and everyone will trust that the certificate authority has signed that until the, until after that timeline in which case that Alice needs to re-get a key from, re-get a new signature from the certificate authority. So this is, this also helps with this issue because then if somebody comes to me and says hey I'd like to revoke my key I can just say well it's already, it's already expired so we don't actually have to worry about that because nobody's ever going to trust that key. That's one aspect. Another aspect is, so if you think about the, we talked about our initial model as kind of a pull-based model or when you wanted to check a key you would pull it from me. I could push my replication list to everyone in the room, right? Let's say I'm the Windows operating system. I can keep a list of revoked keys and include that in an operating system update so that everyone gets the new list of revoked keys so they know not to use them. So modern systems have to deal with this issue and it really complicates things because it's a very practical consideration, right? Keys get stolen, keys get lost. How do you actually deal with that? So as we actually talked about the modern internet, so HTTPS, so for those that aren't aware HTTPS is basically HTTP over TLS, which TLS used to be called SSL. So that's what the, I guess the S and HTTPS comes from, Secure. And the, what do you actually want to trust on the web? What does HTTPS actually give you? You would want to trust that the site you're visiting is a site you're expecting to visit and not some kind of, potentially something that someone else put up there to kind of steal information. Yeah, so you'd want to have some way that you can say that yes, this is google.com. So I think we'll see it when we talk about web security, but most of the web security is based off of the domain name. So when you go to google.com, if you are accessing it over HTTPS and you get a green lock, you can be confident that A, that you're talking to google.com, what else could you be confident of? Communication is secure in the sense of confidential, right? So you know that nobody else has listened to that traffic and nobody else has modified the traffic from google server to you. Yes. Yeah, they know where it's going, and I know where it's coming from, but they don't know what you're sending specifically. Yes, this is actually a good point specifically that TLS provides. So it's just, so it's a layer on top of sockets, so you still are, you are an IP address on a certain program running on a port, you're communicating with a remote system on a remote port, so anybody who sees that connection knows that your IP address is making a connection to another IP address. So people can know that you're going to google.com, but they won't know specifically what page you won't, they won't know if Google sends you back. There's things that they won't know. And so the way this works is there are root certificate authorities, and these are essentially you can think of they are burned into operating systems and hardware and software. So into the operating systems each browser has different certificate authorities, root CAs that it trusts. I believe there have been cases of some root certificate authorities who were found were very lax and who they were issuing certificates to or who they were delegating to other certificate authorities, so the browsers actually revoked them and removed them from the trusted list of certificate authorities. And they actually went a little bit further here, and there's different levels of validation. So the very basic level domain validation, a DV, a domain validation certificate, all you have to prove is that you own this domain. So how would you prove that? Your IP is the same as the domain IP. How do you prove, yeah, how do you prove that it's your IP? But yeah, or you could, there's a couple of ways. You can basically, if you can prove that you own the domain name, so if you can alter the DNS entries for that domain, usually they'll say, hey, create a fake subdomain, that's this random value that has this IP address, you go and create that, they'll test that and say, okay, you can literally change the DNS records to this domain. So you either must actually control it in an ODAP or it really doesn't matter because you can do whatever you want with it anyway. So SSL certificate doesn't help you. The other level are organization validation certificates. So these are certificates. And you have to remember the unfortunate circumstances that these certificate authorities are for-profit companies. So this is maybe why a lot of you don't have SSL certificates, because even at the basic DV level, for most modern CAs, it's like $7 a year, it's actually, it costs money to do that. And then you can get bitten by there are some ones that will offer it for free, but then if you want to revoke it, it'll cost like $25, which I believe was the case when they had the Heartbleed Dug and a lot of SSL keys were leaked. That company got a very lot of fire because all the free customers just realized like, oh, if we want those keys to not be used again, we have to pay massive amounts of money, so comparatively, too free.  And then one level above this is EV or extended validation certificates. This, you have to actually prove to the company that you are the legal entity that owns this domain name and that domain name has a tie to your legal entity. And why this is important and why I like talking about this is because there are visual indicators. I should add this here, but there actually is, if you're running a website, there's no excuse not to use HTTPS, which I just recently proved to myself last year by switching my website over to HTTPS, because you can get free domain validation certificates with free revocation and everything just from running like one or two commands on your server. So it's a, and it's not a company, which is the super cool thing, is I believe it's part of the EFF, the Electronic Freedom Frontier, that's what I was thinking, it's thinking foundation of a frontier. So the EFF has an organization called Let's Encrypt. And the goal of that organization is to encrypt all of the web traffic everywhere. So one of the best ways to do that is to make it super cheap and easy and literally free and easy to do this domain validated certificate. So all you do is install some software, you run the software and then it automatically figures out, I think it uses the fact that either you own the IP or that it can change something in the web server. So you prove to Let's Encrypt that you own this domain and then it automatically gives you a certificate, puts it on and configures your Apache or Nginx or whatever you're using to use that. So it's actually dead simple to do and it will automatically renew it. So you can have the certificate last for like a month or two and then have it automatically renew based on that. So super cool. I highly recommend it for any website to check that out. It's so easy, even I can do it. And what this gives you is nice. So part of this, and this is actually why I put this in here, is this is a whole line of research and study about how to surface to the average user that so they can understand that they're these security properties, that they can understand that their communication is not only encrypted, but also authenticated.  So this is Safari. My website, which just has a DV certificate. And this is apple.com, which has the EV, the extended validation certificate. So you can see they actually visually indicate that there's an additional level of validation that's done here. And it's kind of nice as they put the company name there, like Apple Inc. next to it. This is Firefox. So Firefox does something similar. So this is the original DV domain validation. And this is the extended validation. And then this then is Safari. So each of them be something special for that DV level. Just a little curiosity, is there something for the organizational level or not? No. I believe there used to be, but there's not anymore. Because I was actually very surprised I wanted to use my website in Google. Actually, Google just used an organizational validation certificate. Part of that, so, okay, I want to make sure we have time to go over everything else. But part of that is, because now you have this public key infrastructure, so you have this root certificate authority, which deligates authority to intermediate certificate authorities, which can delegate to other authorities, right? If you wanted to get a Google valid certificate so that you can manage the middle Google traffic, right, which actually would be a very valuable thing because you could spy on Gmail and all this very expensive stuff. If you want to get a valid public private key for Google, you have the very wide attack surface where you just need to break into any of those certificate authorities or convince anyone who has a valid certificate authority that you are google.com. So actually what Google does, what part of what the web created was, they call it certificate pinning, or the web term, HSTS, High Security Transport. I don't want to say security, but I feel like that's not right. The idea is the header, you send a header that says, basically the first time you access this website, always trust that public key. If the public key ever changes, or even if it's a valid certificate that's been validated by a certificate authority, raise an alarm because that, and don't let them actually access that page. So it would be similar to basically Bob writing down and storing the very first time he sees Eve's Alice's certificate and believes that it's her, but writing down that certificate, like Alice includes a message, a no-intermessage, hey, store this key and never trust any other key. So that way even if one of you broke into my, into the certificate authority and issued your own key for Alice, Bob would still not trust that key. So they've actually built this in the browsers. It's super cool. I mean this is a whole other area of how you do security on top of this. There's also SSL stripping attacks, which basically the idea is if you go to HTTPS first and somebody intercepts your traffic, usually what you do is if you go to HTTPS, it tells you to redirect you to HTTPS.  You can just give them the default Google content. And then for every HTTPS link, you strip out the secure and only have them have HTTP links. So that way they go to www.google.com. It's unencrypted, it's HTTP. And then the man in the middle has intercepted that request to redirect you to a secure connection. And every link that you click in that session is always an unencrypted link, so they have a necessary command in the middle of you. So there's another header, maybe that's a GSTS that says, I'll only ever contact this domain under HTTPS. So anyways, so it's super complicated, but that is super interesting and I literally use it every day. So study how this works. So the Web of Trust is a completely different model of thinking about how to trust public keys and how to tie identities to public keys. And the idea is you now, rather than delegating to some other authority or some other corporation, you let the end users decide who to trust, how to verify identity, and to actually verify identity. And you can build this up into a nice graph that lets you propagate trust so that if I fully trust you, then whoever you have verified, I trust them just as much as you've trusted them. And different systems have different kind of levels and just trust degrade over time, right? You have all these kind of issues of how you propagate and think about trust. Let's do the second half of our homework assignment. Okay, I'm super excited about it. Okay, I just want to make sure this is recorded. Okay, so before we get into it, the goals of this assignment are you at a high level, you're going to create a public GPG, public private key pair. Do I need it? So I remember, I think one person used it for Git. Does anybody else have a GPG key? One, two, three, four. Cool. Okay. So the idea is we are going to be creating essentially our own Web of Trust. So you'll be creating a GPG public private key pair. You will then register that key with the website so that the website verifies that it's actually your key. Then you will get your key signed by 20 of your other classmates. So you actually have to talk to people and meet people in this class. I know it's terrible, but it'll be fun, I promise. Because so you have to get your key signed by 20 people in the class. You have to sign other people's keys, right? You have to sign 20 other, at least 20 other people's keys. But you will be given an adversarial key, which is not your name. And if you get other people to, if you get other people to sign that key, then you'll get extra credit and they'll get negative points. It's going to be fun. This is the fun part. So this is why you have to actually verify it. So this is basically trying to simulate an adversarial environment where people are trying to impersonate each other. So the kind of mechanics here, yeah. So basically you want to avoid signing any fake keys, right? So this, the idea is to force you to verify the identity that that key that you see is actually this person's key. So you'll generate a GBG key. The important thing here, so we'll look at GBG keys. They include both a name field and an email field. Your email can be whatever you want. It would probably be nice if that's something that actually directs to you. So you can actually use this later on. But your name has to exactly match the name that's an ASU system, right?  So I will actually check this. So I won't sign any keys that are not from you what your name is in the system. If your name is somehow completely different, you'll see on the website, it'll tell you who the things you are. If your name is somehow completely different, let me know and we can work something out. But if it's roughly the similar, just create a key like this because I don't want to deal with it. So your name on that key will be your name. So and we have to think like, okay, so how do I verify that you're actually signing the correct key, right? Because you could just make 10 fake keys that all have your name, right? Yeah, people sign those and be like, look, I tricked them to sign all these other keys. And it's like, well, it's not really tricking them because it's your name. Like, those are your keys. So the idea is, let's see, I think this has my, I think my name is Fubar. Oh, no, I still have my public key here. Okay. But you'll go to that link and it'll tell you what your name is. I don't actually think I've done that far yet. So you don't have a name yet. So it says none don't do anything. And the idea is, so you'll upload your public key to the submission server, so the submission server. So you upload your key. So the idea is you should only sign people's keys that have been signed by the public submission server because that locks in that you are owning this key, right? So rather than being able to create 10 keys, you're going to decide one key that has your name, you're going to give it to the server and the server is going to lock that in and say, great, this is your key, here's the signed version of it. You should use that to prove to everyone else that this is your correct key. That makes sense. So this separates branding keys that you generate from the key that you actually be created with, right? So any key that you want to sign should be signed by the course's key pair. And you, this is a public address. This is public. You should download this, import this into your key ring. This is the, I even put the, I believe I even put the, yeah. So this is the fingerprint. So you'll be learning and part of this assignment is you're learning what all these things mean and how to look these up, right? So this will be a lot of Googling and learning. The server will also generate you an adversarial key pair. So it's going to generate for you the public key and private key with the same email you gave it, but a random name, first name and last name. So I'm just going to use like a list of common U.S. baby names from like 97 and common last names in the U.S. Just so that we're clear that's where that name comes from. It's just completely random, but I want it to be something realistic-ish so you can try to convince other people to sign that key for you. So now at this point, you now have two keys that are signed by these, by the website. You have one that is actually yours, right? Which has your name that is verified in ASU system. And you have one that is not yours, not your name, but you have the public and private key at the back. So now the goal is you need to have that, your actual public key signed by at least 20 of your fellow students. So you'll see there's lots of, apparently this link didn't work, but there's a lot of links on how to do this. If you find good resources, feel free to share that out. If there's somehow slightly messed up to trick your fellow classmates, that's going to be funny. Five round rules in a second. So you should be trusting people, but also very much not trusting people. So that's why this is a fun site. And so these are guides on how to actually go through the process of signing keys and what you need to send back. And there's a lot of things that has to happen. What you should verify, so it's not just 20 random keys, right? You could just generate 20 keys and then sign your key with all of those, right? They actually have to be, so how will you actually know that the key was signed from a student in this class? It has the official class signature. Yes, you should demand their private, their, sorry, you can try to demand their private key. You should never send anyone your private key. You should demand that they send you their public key, which will include the signature from this fingerprint. If you don't see that, then it's not the correct key, right? So that's how you'll be able to verify that yes, 20 students in the class actually signed your valid public key. For people who sign your key, you don't really care if it's adversarial or not. That doesn't matter because you're not trying to determine that. Yeah, you don't need to determine that when they're signing your key. That doesn't really matter. So it doesn't really, I mean, I don't know, maybe you guys can think of better ways of how this would achieve your nefarious goals, but signing somebody else's key with your adversarial key doesn't do much, and you actually don't get credit for it, so it doesn't go under the fourth part. So you need to sign at least 20 of your fellow students' public keys with your actual key. So you'll sign, but this is where it gets fun. If you sign an invalid or adversarial key, you'll lose points. So maximum limit, I don't know exactly how much, it kind of depends on how this goes, but you'll only lose a max 20% of this. So it's like 10% of the overall homework score, but I think it's fair enough to make it like fun. It's like you won't be devastated if you end up signing just keys every day, but that's not a good thing, right? So you shouldn't like, you know, that's about a B level on this section, and the person who tricked you will earn extra credit. So how do I, how do, how does the submission server, how will I know that you actually did this? So you will, at the end of all of this, so before the submission deadline, you will submit your public key, you have to submit it again, because your public key, in GPG, every time you get a new signature, when you export your key, that key contains all of those signatures. So when you keep getting signatures, every time you export it, it will have all of the signatures in your public key. So at the end, you will be able to do GPG list key or show key to show your key. You'll see that you have all the signatures, you'll export it, and you will upload it to the server, which will prove that you got through that first part. You had your key signed by at least 20 fellow students. You will also, if you tricked anybody, you will export your public adversarial key, which contains signatures from students in the class, and then you will upload that to prove that you actually tricked them into signing your key. Right? Cool. So these are the only two things you need to submit. Well, you need to first even start to play, you need to submit your public key to get a signed public key and an adversarial key. You then need to will, by the deadline, submit your final public key and your adversarial public key. That should be good.  So think about how awesome it was to use this. And if you tricked anybody, I want to see what cool techniques, like, how did you, like, this doesn't have to be not looking for an essay in this, but I want to know how you did this, right, like, for things. Ah, yes, yes, yes, yes. So once you upload your key, your public key, so this is the other thing is, well, for now, let's go with this. So the idea is you have one public private key frame that is yours and should never be lost or stolen or leaked. So there's no revocation in our scenario. So once you generate a public private key pair, and when you have that uploaded to the server, that server now will now, until two weeks from now, know that that is your key. So what should you do with your public and private key? You should guard them so you don't lose it. So somebody else can sign their adversarial keys a bit. What else? Sometimes if you lose your private key, yeah, bad news. So back up your private key and your public key, look that up. I'll put additional notes in here. Your public and private key. Do not lose it. It'd be like losing your code assignment right before deadline. Like, that sucks, but that's on you, right? So don't do that. You all have free ASU Dropbox, right? Yeah, boom. No excuses. Ah, we've not done too much. But you should not send out your public key on mailing lists. That's not a good backup solution. You could, if you were really daring, you could try to encrypt your private key with like a very super secret password and passphrase and send that out on a mailing list. Or you could tell people that you did that, but actually output random gibberish and see if anybody spends any time doing that. So thoughts on that? Questions? Yes? Do all 20 signatures need to be on your actual key, or what do you get from the signatures on your adversary? Yes, you also need them on your real key. So you get a good amount of extra credit points. I want to determine that later, exactly how much when I see how much that actually happens. Yes, so you need 20 signatures on your good key. Anything else you get on the adversarial key will be very good for you. There's 131 students still in this course, so it should be very easy to find 20 of you, and you have a mailing list to talk to each other. Cool. Okay, so ground rules. So what do you think are our valid ground rules we should have in here? If I don't want to get too busy, this is my priority, so you guys go overboard. Okay, I think ground rule number one, you have to follow the ASU acceptable computer use policy that you all read in the last homework assignment, right? That's a good ground rule, I think beyond that, it's kind of, I guess, no stealing anybody's physically stealing devices, I think that's pretty lame. I think beyond that, I think most of the things are applied, like you have an idea? I think beyond that, I think, you know, most things are fine. You want to try to create some personas or Twitter accounts or whatever you want to do with this new name that you have, that would be super cool. I mean, I guess I won't give you too many ideas, but yeah, whatever you want to do that's within those two things, so nothing, nothing physical, nothing that goes against the ASU acceptable computer use policy, so that would include no, like, don't buy like a $10,000 zero-day exploit to run against people or anything like that, so that would be not good. Okay, let's go back and finish up. Cryptography is a huge field. We barely stretch the surface of all the different areas, so most of the other areas, the idea is to give you kind of pointers to other things to go, to some of the other big problems, and I kind of think of crypto research as many different areas, so one is kind of as we saw breaking crypto, so how can you actually break real-world crypto systems? As we talk about this actually has two components, so one is the theoretical component, right? So if you were able to find an attack on AES that decreases the brute force drives from 2 to the 256 to 2 to the 254, that's actually a super impressive theoretical attack against that crypto system. Whether that actually makes it practical yet is usually an answer no, but over time attacks always get better and better. Implementation, so breaking the implementation of AES, there's all types of different, I mean this is a huge sub area between some of the things we talked about, side channel attacks of any types of way you can try to break or extract keys. Now that I realize this, I think this may be redundant, securing crypto, but the idea is okay, how can we make better crypto systems based on what we learned from breaking crypto, right? Can we create new theories? So one of the big worries with RSA is that well the problem is that there are quantum algorithms that can break, I believe can factor integers or do one of the things, I actually don't remember which one, I'm not a crypto person or a quantum computer scientist. So they've actually developed already new crypto systems that public and private key crypto systems that are immune to quantum algorithms. So they can prove that actually these will be secured even if we create a quantum computer, it still can't compute this faster. So this is electric curve, crypto falls under here. You create new implementation so you can think about how can we create easily create an implementation that doesn't have any side channels that has constant time operations. Super interesting things here about how to do this automatically, how to ensure that these things are done correctly. There are completely new areas of crypto that we haven't even talked about. So some of these things are homomorphic encryption. So the idea is you want to store your emails on Gmail but you don't trust Google, right? You don't trust Google to act with the plain text of your email but you still want let's say to search through your email. So they actually have schemes where you can encrypt your email messages, store them on the server and then the server can do different data processing over those entries. So one of the things you can do I think some is incredibly easy. So let's say I want to give you a bunch of numbers and I want to ask you what's the sum of all these numbers. You can actually do that without telling me what any of the numbers are, which is crazy. The other interesting thing that is really big now is secure multi-party computations. The idea here is let's say there are two or more of us, three of us in this room who let's say we are healthcare providers and we want to compute what's the average cancer rate in all three of our data sets. But for privacy reasons we can't actually share our data sets with each other to compute that. Secure multi-party computation is a way that we can actually do this and we each run some algorithm and the results of that combine together to give us the result of the average across all the data sets without revealing any other information. The problem is it's insanely slow. That's the key problem here. So there's been like I mean literally like so slow that they made 100x breakthroughs which like revolutionized things but still are super impractical but got computation down from like I don't know 10 years to like I don't know it's it's coming down a lot more so and other types of areas that I'm not familiar with that are still new and interesting so all kinds of cool ways of thinking about how to use secure information but also do interesting things with it. And there's another kind of area that makes worth mentioning is applied crypto. So knowing about all of these things is cool like building AES, building RSA is cool but how do you actually use that in things right? How does any use WhatsApp right? WhatsApp now has end-to-end encryption right? That's standard crypto stuff but actually doing this in practice is super impressive so being able to do and this means that assuming you trust their implementation I think I'm not sure how many ways you have to verify this but if you trust their implementation WhatsApp has no idea what messages you're sending so your messages are 100% encrypted when they go across their servers only the endpoints the other people with those phones actually can read your messages. So it's a really interesting area for research and how this is going so applied crypto is also another super interesting area so with that thanks


So my name is Mark Hardwick. I'm an instructor here at Niagara College. I teach into integrated rich media projects. And that's part of the new media web design program. So the way that the experiential learning process works in my class is in a couple different stages. The first stage is that we actually look for the clients. So real world clients as opposed to a made up kind of project that we do in previous terms. And so we work through the client list with Niagara Research and Innovation to find mostly non-for-profits. Sometimes we use small businesses but mostly non-for-profits because I found the students tend to like the non-for-profits more than a business per se. So the process is that we send out an email to partners across the region and into the GTA asking if there's any interest for non-for-profits to basically get a free website. So that's the first stage and we do the interviews. We have them fill out an application form and we find clients that are suitable for both our program and for the students. So there's two wins here in this. And this is when I have my conversations with the prospective clients. And I let them know that there's two wins here. One is for them because they're getting a free website and the other is for the students. But I really stress to them that it's more about the students getting that experience with a real world client than them getting a free website. It's just a more of a bonus for them. So once we sift through the interviews and we pick depending on the amount of students we have anywhere from usually five to seven clients per term, we send out more information to the clients so we can collect some information. And then I compile a lot of information and make a brief for the groups. So that's kind of the first part of it. The second part of it is the actual students getting into it. So at the beginning of the term the students get their brief, get their client. The first meeting is already been set up for them. The client is aware of that. And then the client meets with the students face to face in their first meeting and actually goes over everything they've talked with me about to give the students the full scope of what they're looking for in the project. That way the students are able to kind of decide what the best course of action is and how they're going to do it. So as the process unrolls, the students are able to go all the way from the preliminary interview with their client all the way through to designing a fully functional website that has a content management system attached to it. And we usually use WordPress because it is the industry standard. Now there's about 30% of the world on WordPress. So we usually tend to go with custom WordPress models. So the process starts, they have their interview and then we go into concept development. They have another meeting with their client to approve the kind of concept. We're usually pretty good with that along with my input that goes out after approval. And from there they actually build it out in HTML, CSS. So the HTML, CSS part of it is pretty simple. The more difficult part for them is actually doing the research into their client and figuring out what's the client's brand. Do they have a brand? Are we developing a brand for them before we start? What are they about? What's their ultimate mission and what's their vision and what are their goals for this website? Because everybody can launch a website but if you don't have a vision for your website, it's just a pretty picture on the internet. So we have them go through all that process to dig through and figure out the proper solutions for them. And then they meet with their client again and they get a fully static website that doesn't have a content management system on it and they go over the functionality with the client and then the final meeting is where it's put into the WordPress CMS and they actually train the client on how to use it so the client is free to go off and the student is done.


Hi, I'm Zor. Welcome to Unizor Education. This lecture is a beginning of the whole course of solid geometry, geometry in three-dimensional space, basically. So this is an introductory lecture and there will be other introductory lectures, which will introduce certain concepts of solid geometry certain figures, properties, etc., and after I will finish all these introductory comments, only then I will start talking about each individual figure which is occurring in solid geometry, about its properties. I will prove some theorems. We will solve problems, etc. So solid geometry is dealing with different three-dimensional objects. Now, among these three-dimensional objects, obviously there are those which we already know from regular two-dimensional geometry on the plane, which are points, lines, straight lines, certain curves, like circle, for instance, certain geometrical figures in two-dimensional plane, like triangles, polygons, etc. So I assume that we know all these, all the flat geometry, the plane geometry, the geometry on the plane, we already know. And what's new in the solid geometry, obviously, is the third dimension. Okay. So all these elements of geometry, geometry in two-dimensional or three-dimensional space, all these different figures, objects, concepts, they're all abstractions, as we have already spoken about many times. So there is no such thing as a point in the real life, point is a mathematical abstraction. Same is the straight line and same is the plane. Now, these are very elementary objects, which means it's not easy to define them, but what is a point, what is a plane? You cleaved a couple of thousand years ago, actually put the foundation of geometry and it was a brilliant achievement. At the same time, he was trying to do something which probably he should not, and primarily I'm talking about his attempt to define certain things. Well, I will actually present you his definitions of certain things. I just wanted to warn you that this is not really the definitions. These are more of explanations, but not the definitions in the rigorous sense of this word. Okay, so what's Euclid's definition of point? Point is what has no parts. Well, I mean intuitively, we probably agree with this. Mathematically, we should not consider it as a definition, but as an explanation. Now, line is the length without the breads. So line has the lengths, but it does not have the breads. Now, what's next? The straight line. The straight line is even relative to the points on it, so it doesn't really deviate as far as its position relative to any points. It's exactly the same relative to this point as relative to that point. Again, it's an explanation. Don't criticize it for not being very precise. Next is a surface. Now, a surface, and now I'm having the furthest difficulty because the surface is a three-dimensional thing, and I'm using the two-dimensional boards to draw it, but I will try something like this. I don't know. If it looks like a surface, if I will add these lines, maybe it looks better. So what is the surface according to Euclid? It's something which has the breads and the lengths, but does not have the thickness, if you wish. Now, the plane surface, the plane surface, which I can probably draw something like this, it's supposed to be plain, looking from here. Now, the plane surface, or just simply a plane, is something which is, well, similar to this definition, which is even to any straight line on its surface. So these are definitions of Euclid, and as I was saying, you should not really consider them as definitions, just an explanation. Now, what's interesting is that these concepts, a point, a line, a straight line, a plane, these are primary concepts, and the wise thing to do is just don't define them at all, because to define them, you have to define it using some other concepts. Like, for instance, Euclid was using the concepts of the lengths, of the breads, concept of a part, like point does not have any parts, etc. Now, what are lengths, breads, breads at parts? Obviously, it's not defined. Otherwise, you would probably ask them to define it further using something else. So the best thing to do is do not define the primary concepts in geometry. But however, what you do know about these things, they do have certain properties. So for instance, like if you have a line, for instance, the line has at least one point. It's kind of a property, right? So these properties we really should pay attention to. And then we can just say, whatever objects satisfy these properties, we can call them correspondingly a point, a line, a plane, etc. Now, what's important is that it was necessary to to delineate all the properties, which these concepts, a point, a plane, a line, etc. satisfy. It was important to delineate all these properties, to be able to build the whole building of geometry on the top of it. So we can use these properties as axioms and build all the theorems and prove the properties, etc., etc. Now, David Hilbert in the beginning of the 20th century attempted to do this successfully, by the way. So he came up with 20-something axioms which I present in the notes for this lecture on unizor.com. Now, I'm not going through all these axioms. However, what's important is I would like to present certain axioms which are related to our solid geometry, related to three-dimensional space. I have three different axioms and these will be used in addition to whatever we know about the geometry on the plane, the two-dimensional geometry, to prove all the different theorems. So let me just talk about these three important properties, which we would like to accept as axioms. Axiom number one. Now, before I start, let me just say that I will try as much as possible to use capital letters for points, lowercase for lines and greek for planes alphabet. So, using this principle I will say the following. The axiom number one, if two points a and b belong, I'm using this symbol as the symbol of belongingness, belong to a straight line to belong to a plane alpha. Two points belong to a plane alpha. Therefore, the whole line which passes through these points also belongs to the same plane alpha. Well, imagine this board is my plane, so what it says is if two points a and b belong to this plane, they are on the board, then the entire line which connects them, which passes through them belongs to the same plane. It's kind of obvious, but we have to state it as an axiom. That's number one. Number two, if two planes have a common point, the point a belongs to both planes alpha and beta, then intersection of these two planes is a line, a straight line, which contains the point a. Now here it's a little bit more difficult for me to to draw, but let's do it this way. For instance, one plane, let's say alpha is this board. Another plane is this is another plane. So, let's say this plane intersects with that plane and there is a point of intersection. Well, what this particular axiom says that these two planes, the board itself and this plane intersect across the line, and this will be the line actually, line of intersection, which passes through this point a. Again, it's kind of an obvious, but we have to assume it as as an axiom. It will be necessary to have something like this in the theorems. And the third one, kind of obvious, again, if you have three points a, b, and c in space, which do not, not on one line, straight line. When I'm saying line, I assume straight line. Otherwise I would say curve. Okay, so a, b, c do not belong to the same line, like this. Then there is always a plane and one only plane, which passes through them. In this particular case, this is the plane of this white board. So this is the third axiom. Now, using these axioms, I would like to, as a demonstration, prove a couple of very, very simple theorems, which again are as obvious as these axioms, but I can prove them, really, logically, prove based on these three axioms. And then the whole solid geometry gradually will be built using these three axioms and additional theorems, which I'm supposed to prove based on them. Now, obviously, I'm also based on everything which we know about the two-dimensional geometry. Okay, the theorem number one. If you have a line, straight line, obviously, and a point outside it, there is one and only one plane, which passes through the entire line and this point. How can it be proven? Well, there are actually two statements here. One is existence of this plane that plane does exist, which goes through this line and end the point. And another is that there is only one. There are no two different planes which have this property. Okay, now let's consider, I take two points on the line A. Now, these three points, A, B, and C, do not lie in the same line. Therefore, using the third axiom, the third axiom was through three points, not lying in the same line. We can always put the plane and only one. So, there is a plane which actually goes through these points. Now, the first axiom was saying that if two points belong to a plane, then the entire line belongs to the plane, the line which passes through these points. So, that was the first axiom. And using this axiom, now I can see that the plane which I have built based on these three points actually contains an entire line. It's a logical proof. So, I have proven that the plane does exist which goes through the line and the point. Now, is it the only plane? We have to prove the uniqueness. Well, let's consider we have another point. So, maybe we took some other points and draw another plane which also goes through this line and this point. Well, then A, B, and C would be three points which belong to two different planes and that's impossible according to the third axiom, which says only one and only one plane can pass through three points not lying in the same plane. So, we have proven the existence of the plane and uniqueness. That's it. Very easy theory. Number two. Number two. If you have two lines which are intersecting, there is one and only one plane which passes through these both lines. Again, proof is really trivial. Let's take the point of intersection and a couple of points one on one line and one on another line which are not an intersection. Now, we have three points and we can actually draw the plane and only one plane. So, now we can use the first axiom since these two points A and B belong to this plane, then the entire line belongs. Since A and C belong to this plane, the entire line belongs. So, this plane actually contains both lines. Is it unique? Obviously, yes, because if there are two different planes, then I would have three points which have more than one plane passing through them, which is impossible according to the third axiom. Next. Third theory. If you have two parallel lines in three-dimensional space, then there is one and only one plane which contains them. Well, here I am using the term parallel. What is parallel in three-dimensional space? Well, the parallel lines in three-dimensional space by definition are two planes which are number one, lying in the same plane and number two, do not intersect. So, if I'm saying that there are two parallel lines, I'm assuming already that the plane does exist just because of the definition of the parallel lines. That's the plane where they belong to. Is it unique? That's a completely different statement and it does have to be proven. Well, obviously it is unique because if I can draw two different planes through these two parallel lines, then obviously I will have, let's say, these three points and I will have two planes, different planes, which pass through these three points, not lying in the same line, which is impossible according to the third theory, third axiom. And the fourth one is if you have a line in three-dimensional space, there are infinite number of planes which are passing through this line. Now, I would like actually to draw it. Here is how I will draw it. Let's say this is my line. Now, if this is the plane, then I can choose and basically draw the plane which passes through this point and this line. Now, what if I have a line outside of this plane? Let's say somewhere here. Well, again, I can use this point and this line and draw another plane which might actually look something like this. So, it's like a book, open book. This is one plane and this is another plane. And then I can choose any other point all around this line in three-dimensional space and for each position of the point I can have a plane. So, I will have infinite number of planes. You can actually consider these planes as a rotation of one plane around this particular line as around the axis. Well, basically these are very primitive concepts which are in the foundation of the solid geometry. So, all I wanted to present you is just these concepts and show how very, very simple theorems can be proven based on certain very, very fundamental properties which we can assume as axioms. So, this is an introduction which basically introduces the planes, the lines, straight lines and points and a little bit about their properties. And then I will continue introducing other figures which are used in solid geometry. That's it for today. Thank you very much and good luck.


Hello, and welcome to the STM32L4 training session. This session is organized to provide you with the most important information to ensure that you can develop your application as easily as possible. You will find a technical description of all the STM32L4 modules, including peripherals and development tools organized into specific sessions. System, memory, security, analog, peripherals, watchdog and timers, and ecosystem. You can browse each section separately and learn about each module in the order of your choice and at your convenience. This session also allows you to search directly for a keyword and you will have a direct access to the sections covering this information. Now let's take a closer look at the STM32L4 series of Ultra Low Power Microcontrollers. These are the four major points that characterize the STM32L4 series. It's the leader in Ultra Low Power Microcontrollers and in boosting performance. ST has built a new architecture to reach best-in-class Ultra Low Power figures thanks to its high flexibility. Moreover, the STM32L4's performance shatters the competition in the Ultra Low Power world. It delivers 100 DMIPS based on its ARM Cortex-M4 core with a floating point unit and ST's adaptive real-time memory accelerator at 80 MHz. Innovation Leadership To address a large market range, several innovations on its architecture are implemented and smart peripherals are embedded. Integration and Safety Features One megabyte of flash memory and 128 kilobytes of SRAM along with safety and security features, smart and numerous peripherals, advanced and low-power analog circuits in packages as small as 3.8 by 4.4 mm. Long-term and advantageous investment This new series of STM32 microcontrollers benefits from the pin-to-pin compatibility of the STM32 family and its ecosystem. The STM32L4 series completes the Ultra Low Power family of microcontrollers developed by ST Micro Electronics. It is the result of a major effort based on our previous work for STM32L0 and L1 Ultra Low Power microcontrollers. The STM32 is based on a new platform optimized to reduce power consumption and increase flexibility typically with its IO level kept in low power modes, the backup SRAM in standby mode, the flexibility of wake-up sources in stop mode, the Ultra Low Power consumption in shutdown mode, the separated VDD supply, the VBAT domain with charging capability, and the multi-speed internal RC oscillator programmable from 100 kHz to 48 MHz. This block diagram of the STM32L4 highlights the main sections of the microcontroller covered in this training session and their modules. The STM32L4 proposes a wide variety of features that are required to develop flexible and complex applications such as industrial control, motor control, consumer, appliance, metering, medical, gaming, printers, audio, and digital camera applications. The STM32L4 is also adapted to a wide panel of use cases. The STM32L4 microcontroller includes many safety features and embeds specialized hardware for developing secure applications. The STM32L4 series benefits from ST's long experience in developing STM32 microcontrollers as well as its pin compatibility and rich ecosystem based on its hardware and software tools already used throughout the STM32MCU family. Now let's get started with the training. Do not hesitate to follow the events and news about this product on our website at www.st.com. Enjoy!


As-salamu alaykum wa rahmatullah. Alhamdulillah wa shukr to Allah. It's an honor to be a part of this beautiful endeavor, in this beautiful month, in this beautiful time, and I was asked to share a few reflections on the 13th Juz of the Qur'an, which begins towards the end of Surah Yusuf and then Surah Ar-Ra'ad and Surah Ibrahim. So, we wanted to, of course, the chapter on the great Prophet Joseph, peace and blessings be upon him, the Karim Ibn Al-Karim, Ibn Al-Karim, Ibn Al-Karim.  It's a sublime story and we just wanted to highlight two verses towards the end of the Surah in the context of his triumph in the end. Of course, his life was a life of tremendous challenge, yet Allah Ta'ala delivered him from those challenges and the first verse that we wanted to reflect on together in the context of his triumph at the end is verse 92 that when his brethren were gathered and he had the opportunity to respond to their treachery earlier in his life, Allah Ta'ala highlights his statement, peace and blessing be upon him, Audhu Billah min al shaytan al rajim, he said, there is no tathrib, there is no blame upon you on this day. May God forgive you all. And he is the most merciful of those who show mercy. Tathrib is an interesting word in Arabic. It is related to the root word from which the city, Yathrib was named. In other words, Yathrib, the place of migration of the Prophet Sallallahu Alaihi Wasallam, which would transform into Medina Munawwara, the great illuminated city. The prior name Yathrib is related to the root, which is blame, censure, rebuke. And so, you know, just like the presence of prophets, Ani Musalaam, it turns something, a place that's blameworthy or a situation that's blameworthy into a situation that's praiseworthy and beautiful. Our Prophet Sallallahu Alaihi Wasallam by his mere presence in Medina Munawwara transformed it from Yathrib to its new name forever, Medina Munawwara, or also called Taba and Taiba, the pure, the holy illuminated city, the true place of civilization, Medina, so that the basis of the prophetic way is not exacting revenge. And of course, there are circumstances, the sacred law allows for retribution, but often the higher road is overlooking and pardoning. And we see this manifested in the great example of Prophet Joseph, peace be upon him, that in this time his entire, you know, from a material perspective, his entire young youth, late youth in young adulthood and maturity was robbed from him, from his time with his family, his time in his home, his time with his blessed father, the great Prophet Yaqub, peace be upon him, that from a material lens, but from a spiritual lens, of course, Allah swt was favoring him with great, great honors and distinctions that were to be manifest in different stages. And everything that happens to a believer is good for the believer. Our Prophet said, Sallallahu Alaihi Wasallam, as Imam Ahmad relates in the Musnad, How wondrous is the believer, Allah decrees nothing for him, except that it's good for him. And of course, the greatest of believers are the prophets, peace be upon them all. And so in this triumph, when he was delivered, and now he is positioned in Egypt with honor and dignity from even a material perspective, he always was a master of honor and dignity spiritually, but now it's manifested in his worldly place in society. And he has the opportunity to take vengeance against his brothers. What does he say?  Allah will forgive you. May Allah forgive you. And he is the most merciful of those who show mercy. According to a narration is reported to have said, Sallallahu Alaihi Wasallam, which is one of the foundations of our ethical principles in Islam, is adorn yourselves with qualities that mirror the divine attributes. So Allah is the most merciful of those who show mercy. He is the most forgiving. He is the one who forgives. He is the most forgiving. He is the most forgiving. He is the most merciful. He is the most merciful. All of these beautiful names of mercy and forgiveness. One of the ways, the Sunnah of the nights of Ramadan, Allahumma Inna Ka'afuun. The great Prophet Yusuf, peace be upon him, in this maqam, he manifests. He mirrors in his own human capacity qualities that reflect the divine attributes. And so he says, And we know in the Seerah of the blessed Prophet, Sayyidina Muhammad, Sallallahu Alaihi Wasallam, that he too manifested this at Fatimaqah. And again, at Fatimaqah in the opening of Makkah, he had the opportunity after being again treated unjustly and treacherously by his people of the Quraish who fought him for years and caused so much difficulty for him and his blessed companions, Sallallahu Alaihi Wasallam. And he had the opportunity to have just retribution against them. It's reported that he said something similar. There's no blame upon you on this day. There's no blame upon you on this day. And so the true triumph of those that Allah loves, those that Allah SWT loves, is the triumph of the soul, the triumph of character. It's the triumph of overwhelming mercy. The first Hadith that's in many settings classically is taught to students of Hadith is people of mercy. Allah will show mercy to them. Have mercy on those on earth and Allah will have mercy. The one in the heavens will have mercy on you. The one whose majesty is in the heavens will have mercy on you. So again, reflecting the divine attributes in our own human capacities, those people who are merciful, the all-merciful will have mercy on them. And what and that great triumph is the way to win hearts. And so just as our Prophet Wasallam forgave the Quraysh at Fatimaqah and ultimately they became Muslim, some of them at that time, some a little bit later, but their hearts were won over. And so to the brethren of Yusuf, they were reunited, a reuniting a family. Amazingly, the spiritual triumph is conjoined with a reunion to family. So the Prophet, the blessed Prophet, Joseph Yusuf, his forgiveness is for his brothers. And then he is reunited in love with his siblings and his family. And the Quraysh were the family of the Prophet Sallallahu Alaihi Wasallam extended. It was one tribe. And our Prophet Sallallahu Alaihi Wasallam, they were his Qaum. Although in terms of his message, his Qaum is all of humanity. He is the universal Prophet Sallallahu Alaihi Wasallam. But immediately he had Sillat Al Rahim, he had Rahim, he was a relative of Quraysh. And so the pardoning of them at Fatimaqah was reuniting with family. And so there's so many profound lessons in this that really, you know, so one of the things we can do in this blessed time of Ramadan is to make Toba repentance for all of the times we were unable to forgive any grudges we had in our heart, to ask Allah to forgive us for holding on to any ranker, and to make sure we let go of all grudges on this day, tonight, and in the second half of the blessed month that's approaching now, to let go of grudges and to have a free and open heart. Salamat al-Sadr. One of the great heirs of the Prophet Sallallahu Alaihi Wasallam, Rahimullah, he says, There are three salient virtues of the awliya, the saints that Allah SWT loves. Salamat al-Sadr. He says, a heart that is free of ranker and malice and grudges. And Salamat al-Sadr. Generosity of soul. Generosity of hand is to give something of our wealth for good causes to help those people in need. Generosity of soul is to go above and beyond that, to not only give something of our money, but to give something of our overwhelming concern from the heart, from the soul, whether it's time, whether it's energy, whether it's sitting and consoling someone in difficulty, that whatever it might be, generosity of soul. And the third virtue of the saints is to assume the best intentions of fellow man, to assume the best of intentions with the servants of Allah, fellow man, our brothers and sisters, to not assume bad intentions. And so that's the first verse we wanted to highlight. The second one, again related to the great triumph of this great Prophet, peace be upon him, Prophet Yusuf al-Salam, was when he's reunited with his family, and this is verse 101, and Allah Ta'ala says, that he raised his two parents upon upon the throne, and they went down prostrating for his sake. And this was the dream, so he says, and he says, this is the explanation, the interpretation of my dream, my vision from before hand. And my Lord made it true and real, and my and and he, referring to Allah, and he was so good to me, and he was so good to me, when he took me out of prison, and when he brought you all from the desert afterwards, after the shaitan had interfered between me and my brethren, after the devil had sown, dissension, this is amazing. Barely my Lord is Latif, is subtle in his kindness and gentle, and whomever he wills, is omniscient, and of infinite wisdom, that look at his hal, peace be upon him, look at his vision, his vista, his vantage, his perspective. From a worldly material lens, it was tribulation after tribulation after tribulation, he was squeezed and squeezed and squeezed, as a young boy thrown in a well, abandoned by his brothers, lost, taken away from his family, enslaved unjustly, sold to a government minister, whose wife then tries to seduce him, and then he is falsely accused, and then he is imprisoned unjustly, and then he tarries in prison for so many years, and after all of that trauma, he says, what's his reaction, what's his vantage? Allah was so good to me, Allah was so excellent to me, like that all he can see is beauty, peace be upon him, he was ironically, he was given half of beauty in his very person, in his demeanor and appearance, peace be upon him, he was granted half of beauty, but his beauty was not just of form, it was of content, it was not just of khalq, it was of khuluq, it was not just of his appearance, it was his heart, his precious heart, such that he could only see the beauty of Allah, with all of that jalal, with all of that rigor, the Divine Majesty manifesting in tribulation, and Qabd, squeezing him, peace be upon him, he sees the beauty. Imam Qusheri relates in his chapter on Rajah, on hope, that one of the early masters said, hope is to recognize the Divine beauty in the very midst of the Divine rigor, in the very midst of the tribulations that are a reflection of the Divine rigor and Majesty, and he had hope the entire time, and so his optimism overflows, such that the only thing he can see afterwards is the good, wa qad ahsanabi, and so what did he say? Allah was so good to me. If Akhira Jineem in a prison, he didn't say, you know, Allah tested me by putting me in prison, no, he ascribes only the good to Allah, Allah Ta'ala is the Governor of all affairs of the world, he is the Decreer and Master of every atom in the universe, of every circumstance that occurs, but out of etiquette, we attribute just the good to him, the evil, the difficult, we attribute to our own shortcomings or the work of the devil, and he does that because when it comes to the treachery of his brothers, he doesn't say that, you know, he doesn't ascribe that to Allah, and out of etiquette, he doesn't even ascribe it to his brothers, what does he say?  After the devil, after shaytan caused dissension between me and my brothers, so he doesn't even see the harm and the injustice from his brothers as from them, he attributes it to the shaytan, and so, you know, the two dimensions here, the first dimension of his adab, his etiquette, peace be upon him, is that he attributes only the good and the beautiful to Allah because all he sees from, in terms of his vision of his Lord is the good and the beautiful, peace be upon him, and the second dimension we wanted to highlight is that, so he lists the blessings that Allah took me out of the prison, and Allah reunited me with my family, he brought you all back, and then the second dimension we wanted to highlight is even when it comes to his brothers, he does not attribute the wrongdoing to them, he attributes it to the devil, the shaytan came between me and them, la ilaha illallah, this is salam at the southern, these are the greatest hearts, the hearts of the prophets, peace be upon them all, it was the shaytan that caused dissension between me and them, you see because the Allah, when we're in difficulty, when the circumstances of our lives are bearing down on us, Allah's luth is still there, this is what our teachers teach us, this is what the great imams of our tradition taught and bequeathed to us, is that Allah's luth is never absent from the tribulations that afflict us, Allah's luth is never absent, Allah swt his luth is omnipresent, and so we may not be able to detect it, but we trust in Allah that it's there, that Allah's subtle grace is always in the background as it were, and the more we open our hearts to it, the more it will insha'Allah manifest in the forefront because it's there, Allah swt is laqif, and again the great imam ibn atailah he says man danna infikaka luthfihi an qadrihi fa dalika min qusuri nathrihi you know whoever, whoever thinks that Allah's subtle grace is separate and discovered from his, the decrees that cause, that are tribulations, then that's because he is short-sighted, short-sighted in the heart, short-sighted in the heart, and so the great prophet Yusuf says Allah ta'ala quotes him as saying he says he says you know my nurturing, my caring Lord, because his entire life was devotion to Allah, whatever, wherever he was in public or in private, in good times or bad times, he was oriented to Allah swt and so he says Rabbi, verily my Lord, the one that was nurturing me the whole time, you know he was essentially orphaned effectively in terms of the way he experienced his later youth and his then young adulthood, yet he recognized the divine luthf in providing his nurturing and the care and concern of Allah, look at our prophet sallallahu alayhi sallam, he was actually orphaned and he never was distant from Allah, he was never, he was never unmindful or heedless of his Lord, our prophet sallallahu alayhi sallam was always cognizant of Allah swt, these are the prophets are the greatest of examples, peace be upon them all and then he concludes in Allah swt concludes the verse Allah is all knowing and Allah is all wise, whatever we're facing it's not outside of Allah's knowledge and it's not severed from his wisdom, there is a great wisdom, a surpassing astonishing wisdom if we but patiently persevere, we ask Allah to make his people of beautiful opinion of him as a means of recognizing his hidden grace and he has stated in the hadith qudsi on the tongue of our prophet sallallahu alayhi sallam in the words of in the expression of our prophet sallallahu alayhi sallam, I am in the opinion of my servant of me and I am with him when he makes remembrance of me and this is also the state of all the prophets anima sallam and certainly prophet yusuf alayhi sallam, how was it that the people in the prison recognized to even ask him about interpretation of dreams because he was so realized in his remembrance of Allah and the light that emanates from that that the people could see there's something unique about this person and so Allah is with us if we make remembrance of him and then our hearts can have more light to think well of him and when we think well of Allah sallallahu alayhi sallam Allah manifests that hidden lutf what what we see is hidden what's actually there it becomes more concrete for us inshallah that's the promise of our prophet sallallahu alayhi sallam in that sublime hadith and Abu Sulaiman ad-Darani one of the great imams of our tradition said man has sanna danna hubillah faqat fatah allahu alayhi babur rahma whoever beautifies his opinion of Allah then Allah has opened for him the gates of his mercy we ask Allah to make us the people of ahlul quran aladinuhum ahlukaw khasatu ki ar-Rahmeen we ask Allah to make us true heirs of the prophets anima sallam true heirs and inheritors of our prophet sallallahu alayhi sallam we ask Allah to make us people who recognize Allah's wisdom and Allah's subtle grace in our most difficult of times and that in our good times we are full of even more optimism and gratitude al-afu minkum pardon me was was sallallahu alayhi sallam