All right. Good afternoon, everyone. Sorry. Just give me a second here. All right, so good afternoon. I have a few things at the top, and then I'd be happy to take your questions. Last week, as you know, the Senate took a critical step in passing a bipartisan national security supplemental. If passed by the House and signed into law, this legislation would directly advance America's interests and values. The Senate passed National Security Supplemental Bill would allow the department to provide military aid to Ukraine, deliver security assistance to Israel, and bolster our support in the Indo-Pacific region. It is also an investment in our nation's defense industrial base. Every day, the Ukrainian people fight bravely and heroically against the Russian aggression. As the President said, quote, they've put so much on the line. So we are going to continue to urge Congress to pass this urgent supplemental request so that we can deliver Ukraine the air defenses, artillery, and ammunition they need to defend themselves. And as the Vice President said in Munich last weekend, the failure to not pass a supplemental would be a gift to Vladimir Putin. If the U.S. stands by while an aggressor invades its neighbor with impunity, the aggressor will keep going, and in the case of Vladimir Putin, that would mean all of Europe would be threatened. So this is a moment where our allies and our adversaries are watching. So we need the House to urgently pass an act and work to pass this bipartisan supplemental agreement that passed last week in the Senate. However, when the House returns from recess on February 28th, there will be only three legislative days until certain federal agencies run out of funding. On March 1st, funding for the Department's military construction activities will expire, and on March 8th, funding for the rest of the department will expire. The springmanship creates uncertainty, increased costs, and delays missions, and most importantly, it's a distraction for the force. We will continue to defend the nation and conduct ongoing military operations, but the impact of a government shutdown will be widespread and devastating to our service members, their families, and DOD civilians who work every day in support of our national security. And as you know, the department is still operating under our third extension of a continuing resolution, a stop-gap funding measure that prevents any new starts and limits our ability to implement a fully resourced national defense strategy. No amount of money can buy back the time we lose when we are forced to operate under continuing resolutions. If you add up the total time spent under a CR going back to 2011, we've spent nearly five years under CRs. That puts our national security at risk and prevents the department from modernizing as we continue to be constrained to existing funding levels and prevented from launching new programs. We must break this pattern of inaction. We can't out-compete the PRC with one hand tied behind our back, three, four, five, or even six months of every fiscal year. The best way that Congress can support the department is to pass appropriations bills into law as soon as possible. We need predictable, adequate, sustained, and timely funding, and with that, I'd be happy to take your questions. Tara, I didn't get the memo that I should wear red today. All the ladies are wearing red in this front row.  Yeah, next time, Thursday, when we'll wear something new. All right. Thanks, Sabrina. First on the Houthis, it's been a pretty active 24 hours. A number of drones and missiles were either intercepted or shot down. Has the U.S. been able to degrade the Houthis' ability to get more munitions, especially from any of these shipments headed toward Yemen? And if not, what is the U.S. doing about it? So we've had two successful interdictions earlier in January and earlier this month by the U.S. Coast Guard. And then, as you know, with our SEALs that were able to interdict the Dow. So we have been able to disrupt some delivery of capabilities to the Houthis. We've also continued to conduct coalition strikes and dynamic strikes in Houthi-controlled areas in Yemen. So we have been able to degrade the Houthis' capabilities. I can't say that we've been able to stop every single shipment that has been able to get to them by most likely Iran, but we have been able to considerably degrade their capabilities. But it seems like the number of munitions that are being either intercepted or actually being shot is actually on the rise now. So what is the Pentagon's assessment on where these weapons are coming from or did Yemen or the Houthis just have such a large cash already? So without getting into intelligence, I think it's fair to say that the Houthis did have and do have a large warehouse of capabilities. But every single time that we conduct a strike, whether it be with our coalition partners or whether it be unilateral and in these dynamic strikes that you've seen sent com take, we do degrade their abilities and their capabilities. We know that Iran supports the Houthis, continues to fund, continues to train IRGC-backed militias across the region. So we know Iran finds ways to get weapons and get capabilities to the Houthis, but I'll just have to leave it at that. Jen. Sabrina, where is the Iranian spy ship, the Bashad, right now? Has it left Djibouti? I don't have an assessment of where it is. We know it's in the region, though. It's my understanding that it has left Djibouti and that it is moving back toward the Red Sea, if not already in the Red Sea. Is it U.S. policy not to touch the Iranian spy ship to not interfere with it because it does seem that since it's back in those waters that the Houthis are targeting more directly and more accurately than when it was out of the region? Well, this is a ship that has been in the region long before this weekend and has been there prior when they were at the start, when the Houthis started launching missiles towards commercial ships back in November 19th. Iran did have a presence in the region. I don't know if it was the Bashad or another ship, but they always had some type of presence. That's not unusual. Again, I wouldn't get into necessarily our policy when it comes to the ship, but we're certainly aware of it. We track. We monitor. We did see more activity this weekend, but we again have been able to intercept some of the UAVs, the missiles that Houthis have launched, whether it be towards our own ships or ships in the region, and we're going to continue to do that. But that Iranian ship is helping the Houthis target U.S. ships and U.S. warships, correct? Again, I'm not going to give an intelligence assessment from here. Leon, Ukraine, how quickly can the U.S. and the Pentagon get the next tranche of weapons to Ukraine to the front lines if Congress were to pass this supplemental? So if you've seen with most of our PDAs, we've been able to surge systems and capabilities pretty rapidly within a few days. So as soon as Congress gives us that authority, we will be able to, I think, pretty quickly deliver a PDA to the Ukrainians. Carla, and then I'll come over here. Thank you. Can you confirm that a U.S. MQ-9 Reaper was shot down near Houdita? Was it shot down over land or over sea? Has the U.S. recovered this aircraft? What more can you give us about that? Sure. So I can confirm that on February 19th, a U.S. MQ-9 was downed or went down off the coast of Houthi-controlled areas in Yemen in the Red Sea. Initial indications are that it was shot down by a Houthi surface-to-air missile. In terms of recovery options, I know Centcom is looking into that, but I don't believe it has been recovered at this time. Great. That's what I've seen some of those reports, but I just can't confirm that at this time. Yes, over here. On Iraq, given Qatayb Hezbollah's prominence in the PMF and the PMF's role in the Iraqi government, is the U.S. government concerned that weapons and other security assistance we send to the Iraqi Ministry of Defense could wind up in the hands of PMF and Qatayb Hezbollah fighters? Well, we're confident in our end-use monitoring that we have in Iraq, and we work closely with the ISF, so I think we're pretty confident in our coordination when it comes to the Iraqi security forces. So, given the security environment in Iraq, does it make that end-use monitoring harder? The personnel that go out have to monitor? No, I mean, we're there. We have a presence still in the region. Again, and I'm sorry, I didn't address your first question about Qatayb Hezbollah. Cage is not part of the PMF. And so, again, the work that we do when it comes to our Iraqi partners is with the ISF. It's not with the PMF directly. Courtney. Just on the MQ9, was it armed when it was shot down? You do not know the answer to that. I can take that question. Yeah. I want to ask you, AFSOC put out a statement this morning about the Osprey crash investigation, the safety investigation, and said that at this time the material failure that occurred is known, but the cause of the failure has not been determined. And I'm just wondering, does the Pentagon think it's safe to put Ospreys back up in the air before you determine what caused the crash? Well, to my understanding, Ospreys are not going back in the air at this time. The case that you're referencing, the Air Force Special Operations Commander did determine that it was a material failure, but the cause of that failure is still under investigation. So I'm not going to get ahead of that investigation, but while it's being completed, I think we'll leave it to the services to determine when it's best for those Ospreys to be relieved of that stand down order, but right now they're still not flying at this time. So is it your understanding, though, that until they determine that root cause, Ospreys won't fly? I would just leave it to the services to determine best. They're the ones doing the investigation, so when it comes to when these Ospreys will be allowed back in the air, it's really up their call. A couple of weeks ago, General Ryder, I think, had given a general BDA of how many missile launchers and missiles had been destroyed or degraded by U.S. strikes since U.S. started striking in Yemen. Do you have an update on that? Let me see here if I have an update. I don't have an update from February 15th, which is, I think, what you are referencing on just some of the launchers and cruise missiles that we have destroyed, so I don't have a further BDA update. I can tell you that as of February 20th, the U.S. has taken 32 self-defense strikes, the most recent one being yesterday. And there was a Reuters report over the weekend saying that Iran's coup force leader had gone to Iraq and spoken with some of the militias at backs and said dial down the attacks from the U.S. and there hasn't been one since February 4th. So do you believe Iran is playing, in this case at least, a constructive role in reducing attacks against U.S. troops? Look, I mean, we know Iran continues to support whether it be IRGC-backed militias in Iraq and Syria, the Houthis, Hezbollah. Yes, we have not seen attacks in Iraq and Syria since February 4th, but we have seen certainly an uptick over the weekend in attacks from the Houthis on U.S. forces and commercial shipping. So if Iran does have a role to play, it's certainly not doing it when it comes to the Houthis. Brad, yeah. Can you tell us what other cities may be at risk of falling in Ukraine after Adivka? Because last week, depending on this thing, the situation here was pretty cool across the country. Well, Adivka, unfortunately, was a strategic withdrawal that Ukraine made in order to conserve their own artillery and ammunition. Look, if we don't get the supplemental, I outlined that at the very top, but if we don't get the funding needed from the House to pass the Senate supplemental, we will not be able to provide these critical PDA packages. And Ukraine will have to make choices and decisions on what cities, what towns they can hold with what they have and what partners can continue to supply them. I can't forecast that from here. It's really the Ukrainians' decision to speak to you. Obviously, they're in a critical fight for their lives, for their country. And that's why, you heard me say in very stark terms, that's why we need the supplemental immediately. And we've been saying that and sounding these alarm bells since October. And so we're going to continue to urge Congress to do its job. There's no other cities that are under threat right now? I mean, they're in a current war right now. Of course, they're under cities under fire, under threat. I would direct you to the Ukrainians. I know they're not going to give you their battle plans, but absolutely they're on the front lines fighting every single day to hold every single inch of territory. But I can't speak to each specific city. Laura. Thank you. Has Secretary Austin reviewed the findings of the 30-day review yet? And can you tell us whether there's going to be any action taken from that? Action in terms of, like, anything? There were recommendations laid out in the 30-day review. I know that's something that we're working towards in terms of being able to share. I just don't have more for you to be able to outline just yet on what those recommendations are. And I believe the review is with the Secretary. I don't know that he's been able to, I can't speak to if he's finished reviewing it, but it's something that as soon as he is done, we will, you know, provide you more information. Are you going to provide the review to the Hill? Has that already been done? It has not gone to the Hill. I believe some version or classified version or the classified review would be submitted to the Hill or to the relevant committees, but I just, that hasn't been submitted at this time. Yeah. Tony. A couple of Ukraine questions. Sure. How much of the Ukraine Security Assistance Initiative funding the dollars and the weapons have actually been delivered? I'm thinking in particular there was $1.7 billion per cent contract and August of 2022 for 155 shells. Do you have an update of how many of those shells have been delivered to Ukraine? So we wouldn't get into the specific numbers of how many have been delivered to Ukraine. We announced with every PDA and USAI package the dollar figure, but again, we don't announce when a PDA gets closed out or when a certain contract gets closed out. We let the Ukrainians speak to what systems get delivered in country. So I just don't have more specifics on, you know, I can't give you the totals of how many of something are in country. We'd let Ukraine speak to that. Can I ask you two on the whole PDA question? Sure. The Pentagon I think still has $4 billion of authority to draw down, but you don't have any replacement money. So why can't an $800 billion institution just risk drawing down $4 billion of inventory on the assumption at some point you're going to get it from Congress? Is that being discussed at all in the building? Well, you sort of answered how I would answer the question, because it's a risk. It's an absolute risk for us to incur. We don't have the replenishment funds needed to resupply our own stocks. So if we can't do that, then we're not able, or we don't feel comfortable enough to draw down or to give another PDA until we have those replenishment funds. So again, it's something that you've seen not just from here, from this podium, but across the interagency, continuing this urging of Congress to pass a supplemental. You managed risk here, but you were talking like one, five, five shells and a lot of weapons that wouldn't be used in a fight against China. Has there been discussion that why don't we just put out $4 billion of PDAs on the assumption we're going to get funding eventually, if not soon? Well, again, we can say that we're going to get funding eventually, but we've been ringing the alarm bell since October. And so we're already into February. The two-year anniversary of Russia's invasion of Ukraine is coming up at the end of the week. We don't know when we're going to get the funding, and we're going to continue the discussions that are having right now at the secretary's level across the interagency as we need Congress to give us a supplemental. That's what's being discussed. And as you know this, because you tracked this well, we don't even have a fiscal year 2024 budget approved. We're about to start conversations about FY25. So we are truly operating with one arm tied behind our back and not being able to provide Ukraine the assistance, the security assistance it needs in this crucial moment. And you're seeing the direct cost of that on the battlefield. Yeah. I'm going to go to the phones and I'll come back in the room. Chris Gordon. Thanks, Sabrina. With the U.S. losing another MQ-9 in every Yemen, does the DOD view these as expendable? Has there been a decision made to take greater risks with these assets for the greater good, so to speak? Why not use manned platforms that don't fly as low and slow and pose a risky getting shot in? Yeah. Thanks, Chris, for the question. Again, these are platforms that are available to the commander. He makes these decisions. There is a certain amount of risk that is incurred whenever we fly these to ensure that freedom of navigation is upheld, the rule of law is upheld. And of course, there's a certain amount of risk. And of course, we care about that risk. These are multi-billion-billion-dollar platforms. And we are the commanders using them to keep commercial mariners safe, to keep our U.S. service members that are safe in the Red Sea and the Gulf of Aden. So of course, there's a risk incurred, but it's something that we're going to continue to do to ensure that freedom of navigation can continue to be upheld, the rule of law can be upheld, and that commercial shipping can continue, whether it be in the Red Sea or the Gulf of Aden. All right. Thank you for your question, Jeff Schogel, Task and Purpose. Thank you. Given that the DOD is under a continuing resolution, does it have the funding and authorities it needs to replenish the weapons that it's using in the Red Sea to shoot down the Houthi missiles and drones? And is the fact that the Navy is firing so many SM-6s and other missiles causing a deficit for Indo-Paycom? No, thanks, Jeff, for the question. Again, this is why we need a budget passed. We need a supplemental passed, and we're about to head into the FY25 and we're operating under a continuing resolution. So we have what we need right now, but it's not an unlimited pit that we can continue to pull from. And so we absolutely need Congress to help us, whether it comes to defending our interests in the CENCOM AOR, keeping abreast with our pacing challenge, with the PRC, and of course providing Ukraine what it needs in its fight for its sovereign territory. Yes, come back, Heather. As you said, since February 4th, there hasn't been any new attacks on U.S. forces in Iraq and Syria, and there hasn't been any U.S. attacks on militia groups backed by Iran. So does that mean if these militia groups stop their attacks on U.S. forces, will you stop your attacks, too? Again, I will say that... I'm talking about in Iraq and Syria. We will always continue to hold those responsible that have been attacking U.S. forces. Just taking a step back, we have incurred over 170 attacks on U.S. forces in Iraq and Syria. It's pretty significant. So I'm not going to forecast or get ahead of any other decisions that the Secretary and the President make, but we will hold those responsible for the attacks on our service members who lost their lives in Jordan and if there are attacks, we will continue to hold those accountable. As Idris said, I RGC commanded back that met with Iraqi militia leaders and he demanded them to stop their attacks on U.S. forces. So do you think Iran is looking for the escalation of conflicts or they are afraid of retaliation forces by the United States? Our assessment is that Iran doesn't seek a wider regional conflict. But they do support these militia groups that attack our forces. They do support the Houthis that over this past weekend have launched multiple attacks on commercial ships, on U.S. forces in the region, and they support Hezbollah.  So if Iran doesn't want to see a regional conflict, they can continue to intervene and to tell these groups to stop. Rio. Thank you, Sabrina. Yesterday, the China inspected Taiwan's tourist ship near the Kimmen Island days after two Chinese fishermen died while being chased by Taiwan's coast guard. So how concerned is the Pentagon that the situation could escalate in the days ahead? Yeah, I've seen those reports, Rio. I'd refer you to both the PRC and Taiwan to speak to that. I don't have anything more to add on that. We don't want to see an escalation in the region at all, but I would refer you to them for more details. The Japanese government is seeking a leader's meeting with North Korea. Does the Pentagon support such Japanese diplomatic outreach? Is the Pentagon worried that that could undermine the trilateral defense cooperation among the three countries, including South Korea? We support diplomatic outreach to the DPRK. We have also said from here that we would seek diplomatic outreach should they want to engage. We want to see regional stability in the region. If those conversations lead to that, we certainly welcome that. Yeah. Hi. Sam Legrand, U.S.N.I. News. No, Sam. Over the weekend, we saw a release from the coast guard that they'd seized underwater drone components, believed to be from Iran to the Houthis, and then we had the first report from Sankom of a lethal attack drone interdicted by U.S. forces in the region. Is this a technical escalation of what we're seeing in there? Are these more sophisticated attacks and new weapons? Can you give us a sense on where these fit in the spectrum of capabilities that the Houthis are bringing to ships in the region? I think you're certainly seeing that they have sophisticated technology and capabilities that they're getting from Iran.  Yeah, of course. Their attacks are getting more sophisticated. That was the first time, as Sankom put out, I think it was on Saturday, that the first time that they used an underwater unmanned vehicle to try and launch an attack. So, absolutely, the attacks are sophisticated. Their weapons are sophisticated, and we know where they're coming from. We know that Iran is continuing to supply them with what they are continuing to launch at U.S. vessels and commercial mariners. Yeah, Idris, yeah. So, if they're getting more sophisticated, what impact are your strikes having? If they're actually improving after you're striking them, what are the benefits? They used a capability that was more sophisticated than we've seen before, but what are the impacts of our strikes is every single day that we initiate another dynamic strike, another service-to-air missile off the map for them. They can't necessarily say the same for us. We are using our capabilities to shoot down, whether it be missiles or UAVs, or in this case, the underwater unmanned vehicle. We are being able to stop them, but, again, sometimes the attacks do get through. And actually, since we're on this topic, I mean, one of the ships that they targeted was Karen Grain, bound for Yemen for their starving population. So they're saying that they're targeting ships that have a connection to Israel or ships that have a connection to the United States. I mean, look at exactly what you're doing. You're putting your own population at risk. And so, every single day, I think our dynamic strikes or our coalition strikes absolutely have an impact, but we at no point said that we're wiping all of their capabilities off the map. We know that they have a large inventory, a large warehouse, and they're going to continue to use it. Yeah, over here. Two related questions. China's activities inside the U.S. is concerned. How much do you think this building is concerned about China's activity against the United States and national security? Is there something specific that you're referencing? Or just broadly? In general, I mean, because China is now in the news because there are so many hacking going on. I see. We continue to monitor the PRC's activities. I don't have something specific to what you're asking, but just generally, we know that we don't see conflict with China, but we know we're in competition that doesn't need to escalate anymore. You've seen conversations happening at different levels of government. But of course, we're concerned of any activities and we continue to monitor that. And that's why we have the robust presence that we do in the Indo-Pacific. China, as far as Chinese expansion is going on in the South Asia region, many smaller nations are worried and also including Taiwan. And as many times questioned being there, that China is watching very much about Taiwan getting help from the Capitol Hill or in this package may be something for the Taiwan. Where are we standing as far as Chinese are really watching about this very well? Yeah, China is watching. A lot of countries around the world are watching right now this moment and that's why we need Congress to do its job. We need the supplemental. We need to be able to support our commitments in the Indo-Pacific while also supporting Ukraine while also supporting Israel and its fight against Hamas. But we can't do that if we don't have the funds to do it. I'm going to go on. Just last week it was claimed that in a U.S. airstrike two Cuban hostages were killed in Somalia. Do you have anything on that for us? Yeah, no, I've seen the reports on that. I just don't have anything for you at this time. Yeah, Mike. The European Union this week launched Operation ASPY this, I don't know how to pronounce it, to protect merchant ships in the Red Sea against Uthi attacks. The fact that this mission is going to run alongside or parallel to prosperity guardian is that an indication that some nations don't think the U.S.-led effort is doing the job, sufficient enough job to protect shipping? No, the EU is its own coalition of countries conducting this operation while running alongside parallel to Operation Prosperity Guardian only augments the goals of all of these countries, of all of these like-minded countries, which is to uphold the rule of law and to ensure the freedom of navigation is protected. So we certainly welcome this new coalition. Again, we're all working towards the same goals here, which is to ensure that innocent mariners, commercial shippers can get through the Red Sea, the BAM, the Gulf of Aden safely. As you well know, 10 to 15 percent of the world's commerce flows right through that straight. So we certainly welcome more partners as part of, if it's not Operation Prosperity Guardian, as being part of the effort to uphold the rule of law. Carla, do you have one more question? Then we'll wrap it up. Just to follow up on Idris's question, is the Secretary satisfied with the current strategy against the Houthis? Can you pull up that thread a little bit more for me? Yeah, sure, because you said it was having an impact. You told Idris that it was having an impact, but you've also said with Tara that it's not deterring the Houthis. So it may be having an impact, but it's not giving you the goal that you're desiring. So is the Secretary satisfied with this current almost whack-a-mole strategy that's going on? So the Secretary has full confidence in the central command commander and the operations that he is doing every single day to ensure that our mariners, our service members are safe. Look, and I said this earlier, we never said that we were taking every single capability that the Houthis have off the map, but every single day that we conduct a strike, we are degrading them further. And so I think the Secretary has confidence that the more we continue to do this, the Houthis are already seeing the effects. I mean, as General Ryder read out just last week, we do have battle damage assessment that we have been able to make an impact to some of the capabilities that they have. Again, it's not everything off the map, but it is steps, it is progress, and we're going to keep holding them accountable until they stop. Okay, Mike? Is that strategy sustainable? I mean, trading multimillion-dollar US missiles for a couple thousand-dollar Houthi weapons? Well, I don't have the cost for the Houthi weapons, but what I can tell you is if we don't have the support of Congress, if we don't have a budget, if we continue to operate under continuing resolution, if we don't get our supplemental passed, no, things are not going to be sustainable. We are going to have to look to make cuts to continue to fund our operations in the CENTCOM AOR to continue to support Ukraine. So that's why we continue to urge Congress to give us the funding, the support that we need so we can continue these operations and continue to protect not only our service members in the region, but ensure that commercial shipping can flow through that region safely. Thank you, everyone.


Thank you, so I'll be talking about efficient zero-knowledge proofs of algebraic and non-algebraic statements with applications to privacy-preserving credentials This is joint work with Melisa and Payment So zero-knowledge proofs allow a prover to convince a verifier that a statement is true without revealing any further information Zero-knowledge proofs are known to exist for all languages in NP But the challenge is designing proof systems that are efficient enough to be used in practice We have few techniques that give efficient proof systems and most of them fall into the class of Sigma protocols Which are three move interactive protocols for algebraic statements And then we have snacks that allow for short proofs and efficient verification, but have shortcomings in prover efficiency And there are gots a high proofs based on pairings, but they again apply to a restricted set of languages To prove general statements, we need expensive NP reductions or the prover needs to perform Publicly operations proportional to the size of the circuit representing the statement Efficient Sigma protocols mostly focused on proving algebraic statements like statements about discrete logarithms roots polynomial relationships and so on What if we want to prove a non-algebraic statement like knowledge of pre-image of a cryptographic hash function? We can of course express any NP relation as a combination of algebraic statements by expressing it as a circuit and each gate As an algebraic relation between the input and output wires But if we were to take this approach and use Sigma protocols to prove this it would be very expensive for large circuits requiring several public operations per gate Recently Javaric et al. proposed a garble circuit based method for proving statements that are phrased as garbles that are phrased as Boolean circuits This is a very efficient method requiring only few symmetric key operations per gate and Results in a proof for a yes or Shah circuit in a few milliseconds using state-of-the-art garble circuit implementations But expressing public key operations as a circuit is still expensive for example In-bit modular Exponentiation has a circuit size of roughly o of n cube and for cryptographic sized groups. This is prohibitively expensive So now we have two very different techniques for achieving zero knowledge proofs for algebraic and non-algebraic statements And the question we ask is what if we are interested in proving statements that combine the two? This come up in many applications for example if we want an efficient protocol for proving knowledge of an RSA signature Recall RSA signatures work by taking the message hashing it and raising it to the secret key mod n and Verification on message m and signature sigma proceeds by checking that H of m is sigma to the E mod n So verifying an RSA signature requires computing both the hash function and exponentiation Even though proving a combination of algebraic and non-algebraic statements come up in many applications for the purposes of the stock I'll use anonymous credentials as an example application Anonymous credentials was introduced by charm and it's in the following setting We have a credential issuer who is a certificate authority and issues credentials to a user and the user later Wants to prove to a verifier that he has been given appropriate credentials In more detail the user has a set of attributes and the credential is the signature of the organization on the attributes and The user wants to prove to a verifier that has attributes satisfy a certain policy Using the credentials issued by the organization and the system is anonymous if nothing more is revealed beyond the fact That is if the verifier learns nothing more than what Bob proves here Protocols are known to obtain and prove possession of credentials Examples include Microsoft's you prove and IBM's idemix Practical anonymous credential systems are usually built around sigma protocols And in general they follow a similar approach the issued credential is a signature of the organization on the user's attributes And to prove possession of credentials the prover proceeds by first committing to his attributes M and then proving knowledge of Signature on M in zero knowledge and then prove again in zero knowledge that M satisfies a certain policy Now this in turn means that the credential that was issued has to be a specially formed signature on the user's Attributes so that a sigma protocol can be used to prove knowledge of signature on a committed message What if we want to base our credentials on a standard signature? As motivation what if the entity that is signing the credentials uses off-the-shelf signatures like an RSA signature or What if the prover already has a standard signature on his attributes and wants to be able to use it in an anonymous way? So Here Bob has attributes M and a standard signature on his attributes sigma and wants to prove in zero knowledge Knowledge of sigma on M and later use a sigma protocol to prove that his attributes M satisfy a certain policy And we want to ensure that the M that he's proving properties about and the M that he proves knowledge of signature on is indeed the same M And I want to point out that the proof of knowledge of signature for M Here for a standard signature involves proving a combination of algebraic and non-algebraic statements One can of course think of combining two different protocols one for the algebraic component and one for the non-algebraic component But such a knife combination will not work because a cheating prover can use two different witnesses for the two proofs and Come up with a convincing proof for which there is no single valid witness So one of the challenges is to be able to bind the values that the prover commits to in the sigma protocol With the input that the prover uses in the garbled circuit for the non-algebraic proof And we want to be able to do this without expensive group operations inside the garbled circuit and Without having to prove large circuit statements using sigma protocols Again one way to achieve this would be to have the prover commit to a witness and make sure that he uses the same witness in The two proofs, but then again we have commitments that work well with garbled circuits And then we have algebraic commitments that work well with sigma protocols and we still need a way to tie the two together So here is a summary of our results we study combining proof systems for algebraic and non-algebraic statements And proposed protocols to prove that f of x equal to 1 for a committed value x where the commitment is an algebraic commitment And f is represented as a Boolean circuit We then show how to build on these protocols to obtain a proof that two commitments in different groups commit to the same value And finally show how to put these proofs together to obtain an efficient proof of knowledge of signature on committed message For standard signatures like RSA, DSA and ECDSA I'll begin by describing our protocol Before that I want to quickly recall what garbled circuits are a garbling scheme is a tuple of algorithms garbled encode eval and decode Garbled takes the description of a Boolean circuit and outputs a garbled circuit and encoding and decoding information Encode takes an input to fx and outputs a garbled input x eval takes the garbled circuit and a garbled input and Returns a garbled output Decode takes a garbled output and decoding information and returns decoded output For security we want privacy that is we want the property that the garbled circuit and a garbled input reveals nothing beyond f of x and Authenticity that is given the garbled circuit and a garbled input It is hard to find a garbled output that decodes to something other than f of x The starting point for our protocol is the protocol of Jaurik et al And they begin by the observation that zero knowledge is a special case of two-party computation Where only one party has the input the prover has the witness as his input and the verifier has no input and this means that one circuit suffices to achieve malicious security because the Circuit that is evaluated can also be later opened and checked for correctness since the verifier has no secret inputs And this is as opposed to requiring many circuits and cutten tubes in general to party computation Coming to our protocol so recall given a commitment to M We want to prove that f of M equal to 1 and throughout these commitments are algebraic commitments that allow Proving linear relationships among committed values efficiently like Peterson's commitment So the verifier Alice here begins by Augmenting the circuit in the following way she chooses uniformly random integers a and b and Constructs a circuit that computes f of M where M is the prover's input and a one-time Mac on M using a and B as the one-time Mac key She garbles the circuit and sends the garble circuit to Bob They now engage in a committing OT protocol or recall oblivious transfer is a protocol where a sender has two secrets The receiver has a choice bit and at the end of the OT protocol the receiver obtains his chosen secret Without learning anything about the other secret and the sender learns nothing about the choice bit Here we need a stronger OT property called the sender committing property where the sender is committed to both his inputs at the end of the OT protocol So Alice and Bob engage in a OT protocol where Alice's inputs to the OT are the wire keys of the garble circuit corresponding to the input and Bob's input are the input bits of his witness At the end of the OT protocol Bob receives the wire keys corresponding to his input Which allows him to evaluate the garble circuit and obtain garbled output Z and T He then commits to the garbled output Z by sending a commitment to Z Alice now reveals the decoding information corresponding to output T Bob can now decode and obtain the one-time Mac T here and then sends a commitment to the one-time Mac Now the verifier opens the garbled circuit by revealing all the randomness that was used to construct the garbled circuit And Bob can verify that she indeed constructed it correctly And he then opens the commitment to the garbled output Z Which allows Alice to decode and obtain F of M Bob now gives a Sigma protocol proof that T is AM plus B And notice here that T and M are committed values And A and B are public after the open phase and this is just proving a linear relationship among committed values Which we know how to do efficiently If F of M equal to 1 and if the Sigma protocol proof verifies Alice outputs except so in our protocol We used a one-time Mac to be able to bind the witness that the prover uses in the algebraic and the non-algebraic components of the proof This required us to do one multiplication inside the garbled circuit Where the multiplicand a needs to be only as big as the statistical security parameter One observation that helps us avoid this multiplication inside the garbled circuit is that the oblivious transfer keys already act as Mac on the input bits of the prover So again recall that oblivious transfer the prover receives one out of the two keys that corresponds to his input bit And it can be written algebraically like this We now use this observation to avoid one multiplication inside the garbled circuit in our second protocol So again given commitment to M. We want to prove that F of M equal to 1 Alice here takes the circuit that computes F of M garbles it and sends the garbled circuit to Bob So after committing to his input M Bob also commits to it bitwise by sending bitwise commitments and Then receives the garbled circuit and then they again run a committing OT protocol Where Alice's inputs are the wire keys corresponding to the garbled circuit and Bob's input are his Witness bits and now he receives the keys corresponding to his input and since these OT keys are acting as Mac on his input bits We now have Bob commit to his OT outputs, which is basically a one-time Mac on his input He can now also evaluate the garbled circuit and obtain the garbled output Z He now sends a commitment to Z and now the verifier opens the garbled circuit by revealing the randomness that was used in the construction And proves that it was indeed constructed correctly Now the prover opens his commitment to the garbled output and the verifier can decode it to obtain F of M Now Bob uses a Sigma protocol to prove that his OT outputs Was according to the input bits that he committed to earlier again notice here that k i prime is a committed value Mi is again a committed value And k i 1 and k i 0 are public after the open phase of the garbled circuit And this is proving a linear relationship among committed values and then Bob again uses a Sigma protocol to prove that his input bits that he committed to here when combined yield M Again M is a committed value and Mi's are committed values and this is a linear relationship So if f of M equal to 1 and if the Sigma protocol proves verify Alice outputs accept A word about efficiency So both our protocols have the desired properties that the garbled circuit based component is dominated by garbling F and not by Expensive group operations and the number of public key operations is independent of the size of the circuit F In our first protocol we required a constant number of Exponentiations and an additional number of symmetric key operations for the computation of the one-time Mac So if N is the length of the prover's input and s is the statistical security parameter We required an additional o of N as symmetric key operations For our second protocol we required o of N Exponentiations due to the bitwise commitment But this could be more efficient when bitwise commitments are already used as part of the application As it is in some of our examples We can think of further optimizations like using Karatsuba's multiplication instead of textbook multiplication for computation of one-time Mac in our first protocol and Privacy free garbling so Fredrickson et al in Eurocrypt 2015 Made the observation that in the zero-knowledge application of garbled circuits Privacy is not a required property and only authenticity suffices again This is because the garbled circuit that the prover evaluates is on an input that he knows entirely and the Verifier has no input So this applies to our second protocol because the verifier has no secret input in our first protocol We need a and b to be secret But we can still think of the bigger circuit as consisting of two smaller circuits one computing f of m and one computing a m Plus b and use the privacy free garbling for the first component and standard garbling for the second component and have them share the oblivious transfers This results in a significant reduction in the size of the garbled circuit I will quickly go over how we obtain proof of knowledge of signature on committed message for RSA signatures using an instantiation of our protocol We can think of the instantiation of the protocol I just described where f is the circuit that takes two messages and checks that one is a hash of the other If we are thinking of standardized signatures like RSA FTH and RSA PSS We can have F check additional padding and formatting of messages and so on This gives a proof that given commitment to M1 and commitment to M2 M2 is hash of M1 Caminich and Stadler proposed a protocol to prove knowledge of E through to a committed value We can use that protocol to prove E through to M2 where M2 is only committed to here and Putting these two proofs together we obtain a proof of knowledge of RSA signature on M1 given commitment to M1 So to summarize we combined proof systems for algebraic and non-algebraic statements In particular we gave two protocols to prove that f of x equal to 1 for a committed value x where the commitment was algebraic And f is a Boolean circuit We then showed how to prove knowledge of signature on a committed message for RSA signatures In the paper we show how to do this for other signatures like DSA and ECDSA Then I talked about how we can use our techniques to base anonymous credentials on standard signatures Other applications of our techniques include more general policies for anonymous credentials and Obtaining a proof of equality of committed values in different groups which would allow one to convert between commitment schemes And and to obtain a protocol for two-party computation with authenticated or signed input I'll stop here. Thank you


It's very nice to be here in Seattle. I was last year in 1999 on my honeymoon when I was 22. And the weather was beautiful the entire time. And then I came in yesterday and the weather was beautiful. And I began to think this whole rainy Seattle thing was like a myth that turns out it's not. I thought maybe Seattle and Seattle Lino's something. I don't know what you call it. I thought maybe you did what we do in Colorado, which is we tell everybody that the weather is terrible so they won't move there and make the place more crowded. But it seems it does rain here apparently some of the time. But nevertheless, I'm sad. I won't have more time to spend here. But I do hope to be back before too long because it is a very nice city. Now, I've been asked to speak about some other myths related to the campaign this year. And we could spend all kinds of time on various other myths. But we'll try and fit in as many as we can here for the next few minutes. And specifically, there's three areas that I want to focus on. Three categories of myths, I suppose, is what you could call them. Now, the first one is this idea that has been floating around the campaigns, especially with the Bernie Sanders campaign, and to a lesser extent with Hillary. And there's this idea that the United States spends very little money on social benefits. And this is something that a lot of people believe that the United States is kind of this highly capitalistic, social Darwinist country with virtually no safety net whatsoever. And that just this tiny amount of money goes to social benefits programs. That is not true. It turns out that the United States is actually very similar to European countries and to the other countries in the Anglo-sphere, like Canada, New Zealand, Australia, and so on. And by the way, all of this information that I'll be quoting has been covered in previous articles by me at Mises.org. And so when I do a text version of this on the site, I'll include links to all this information that you can look at in more detail. So yeah, there's much deeper information behind all of this. And I'll show you where you can get it later on the website. But let's just look at the US and compare its social policies to other countries. There's no way that we can make the case that the US does not spend a lot of money on social benefits. In fact, if we just look at the percentage of the GDP that is spent on social benefits from country to country, we find that it's more or less the same. For example, the United States spends about 18% governments in the United States. So we're talking about government spending, direct to government spending, is about 18% of GDP. And it's about 19% in Norway. And so what's the big difference there? It's about 19, 20% in New Zealand. Once you start to get closer to, say, France and a couple other big spending countries, they get up to maybe 22, 23% in terms of the GDP they spend on social benefits. And this isn't just government spending, mind you. This is things like retirements, health care, social security, and so on. So there's just not that big a spread there. It goes from about 22% down to about 17%. Down at the low end, you find Australia and Canada and Iceland, which are all below the United States in terms of social benefits spending. Of course, we've all been told on multiple occasions that Canada is this paradise of equality to the North. Maybe that is, but they managed to do it by spending less government money. And so the US just simply should not be viewed as this odd man out on these issues. Many other fallacies in terms of economic debate then proceed from this, that we need to spend more on this or that, the other thing, just so the US can start to be more humane like the other countries out there in Europe and in Australia, for example. And if it may be that there are other changes that could be made in order to address some of these issues that people on the left think need to be done, but I can tell you that the problem is not that there is not enough government spending that's going to these programs. We can look also at this in terms of just health care more specifically, if we look at health care spending, specifically government spending on health care, just people in general, not the private sector, we find that the US is number four in the world in terms of spending on health care. The only countries that spend more are Switzerland, Luxembourg, and Norway. And those tend to be very wealthy countries as well and the people there can attend to afford more in health care, but all the spending on health care, just it's again, a myth that the US isn't spending a lot on it in terms of government spending. Now interestingly, of course, the left will also use this as an example of why health care spending is bad in America. Look how much America spends on health care spending. If we would just adopt Bernie Sanders' health care plan, then the US would spend hundreds of billions of dollars less on health care. But of course we can't have it both ways, we can't have so much health care spending, we can't have health care spending in America be an example of both how America spends too little in terms of government benefits. And then at the same time have all of its high amounts of spending be simultaneously an example of how the US shouldn't have to spend that much. So which is it? In fact, if we look at the overall amounts of spending, we find that Denmark is right next to the United States. And so you will have people say that, oh, look how much America spends on health care spending in terms of government benefits. Clearly we need some major overhaul in the health care system. And then in the next breath, they'll tell us how Denmark does everything so wonderfully in terms of its health care welfare system. So which is it? If Denmark's spending about the same amount on health care as the United States in terms of government spending, how come that's okay, but it's not okay the way the US government spends on health care spending? So what we find when we start to look into this data is that there's just not that big a difference there. There's lots of government spending going on. In fact, if we look at how much the US spends when we look at tax policy, which is designed to help people with children designed to help people keep more of their money rather than pay it in in taxes. Once you take all that into account, when you start to incorporate American tax policy that's designed to help lower income people, what you find is the US is actually number two in the world in terms of policies designed to assist the poor in terms of helping them keep more of their income rather than direct spending. So we should just need to get over the idea that the US isn't spending a lot of money through its government programs on health care. If people want to debate over some different way to do things or some sort of change in the program, then that doesn't even really interest me that much, that's fine, maybe some of those ideas could, you could make a good case for them, but those changes can be made without a need for any additional tax revenue or any greater spending because the US is already spending more than quite a few countries on its social benefits. So any sort of program that any sort of idea where someone like Bernie comes out and says, well, we're gonna overhaul the program and it's gonna save us billions of dollars, but first we just need to spend another 50 billion more, another 100 billion more, another 500 billion more, and then we can come back and then we'll actually spend less later down the road. But we're gonna have to spend more upfront and then we'll spend more later. Well, obviously you shouldn't fall for that because you're never gonna get to that point where the spending goes down again. So if we just compare the US to other countries, there's no lack of spending on benefits and we should just proceed accordingly. Certainly it would be great to argue that those, that that overall spending should be cut, but certainly if we can make the comparisons there's absolutely no case that could be made for the claim that the US just simply isn't spending much. So no, the United States is not some kind of a capitalistic paradise where we're all keeping all of our money and the poor people are getting what they deserve or whatever the caricature is of capitalists. That's just simply not the case. And really the US should be looked at more at just like all of these other social democratic countries. A lot of spending going on, tons of government programs and we don't even have time to go into the realities of poverty in the United States in terms of air conditioning, in terms of cell phones, in terms of automobile ownership and all of those things that the poor have in the United States that they do not have in other places, especially in Southern Europe where a middle-class lifestyle would be living in a two-bedroom apartment without air conditioning and raising your family there. The reality here is much, much different. What you find has almost a religious tinge to it where you try to argue that the US is really just not something special. It's not this odd man out. It's not this extremely stingy, miserly country where nobody's paying out anything in government benefits. Once you start to challenge that, people become very upset and it's living on in the current election cycle. Now, so this of course relates to the poverty issue and this is where we see some of the most long-lived and die-hard myths coming about. The second group of myths are those related to the fact that we're told we need government to protect us from the cruelty of market economics and this can take many forms. We need government, of course, to give us retirement. We have government to thank for creating the weekend. This is an often repeated thing. If it weren't for government regulation of the workplace, we'd all be working 80 hours for essentially subsistence wages. But fortunately, we have progressive governments that force the government to pay us what we're worth and that force the government to give us weekends and vacations that force the government to give us time off to spend with our families, maybe a family leave, which is a big plank of Hillary right now that we're going to mandate more family leave for people and of course the Obama administration just came out with tighter regulations on the use of overtime pay, essentially making it so that more, fewer people who traditionally would be salaried are now going to have to be paid more in overtime. Of course, we all have been told a million times that if we didn't have government doing those things, we'd all be working long, long hours for next to nothing. Now, of course, that's not true at all. The reason that we're not working hours as much as our great grandparents were or even our grandparents is because of worker productivity being very high. Now, Walter didn't have time to get to this, but that's the flip side of the minimum wage. If we're going to talk about wages, how do we bring up wages? Well, you can't just set the wage. In order to make it feasible, you have to actually increase worker productivity. And the way you do that is by labor-saving machines, by making it possible for people to produce more value in less time. And that's the only way that you can actually make a society richer. Obviously, you can't just simply declare that everybody's going to be wealthier in the future.  And since the Industrial Revolution, we've been pretty good at that as a species using machinery, using devices to help us produce more. Now, a simple example would be in, I used to be a janitor for six years, so let's use a janitorial example. Now, in the olden days of janitoria, you had the little, the floor buffer that has the spinning brush on the bottom. Now, in the older days, those would only spin at like 80, 100 RPM. And that was very, very slow, very, very time-consuming. It took you forever to polish a floor. Now, in more recent decades, however, they've developed the high-speed burnisher which rotates at hundreds of RPM. That allows you to, say, polish an entire gym floor, if you will, in minutes compared to hours before. Now, just think about what this means, then, for your average janitor. As now, they can do two or three of these floors in the same time they would have taken to do one before. Now, the outcome of that, of course, is he now can make much higher wages. He can go from place to place, doing more and less time charging, not as much as he could before probably because now other people will have those burnishers as well, and there will be some competition to bid down the price. However, overall, the effect will be that janitors will be able to simply do more work in less time, they'll be able to do more of it, and the other upside of that will be that more people will have cleaner floors more of the time at a lower price. That's the only way that we can really actually increase the wages and the lifestyle of, in this case, janitors who use that equipment. We've introduced some capital, which, by the way, was made possible by the savings and capital accumulation of people in the past who were able to put money into an entrepreneur developing that equipment. Janitors use that equipment, they make more money, and they become wealthier. Simply declaring that we should all play janitors 20 bucks an hour would not accomplish that and would not make it possible and certainly not sustainable in any way. The only way to increase wages is by increasing worker productivity. And it's not just wages, of course. This allows us to just have a higher standard of living in general, it allows us to work fewer hours. Tom Woods and I did an episode of his show a little while back where we talked about how just having more jobs doesn't necessarily mean that we're getting richer anymore than also just working more hours in a week doesn't mean we're getting richer. Now, it can mean that, and so I think under current conditions, you can make the case that you do in fact need to add jobs in order to show some gains in the economy. However, over time, especially if we look at over, say, 30 years in the past or 50 years in the past or 80 years in the past, our ancestors worked longer hours in most cases and they certainly had a lower standard of living because of it. The reason that they were able to work few hours over time, the reason that we don't have to slave in the field like our farmer ancestors did or work long hours in a highly dangerous factory is due to the benefits of increases in worker productivity. And that creates extra money, creates this wiggle room, if you will, because now workers are so productive and creates more profit and creates higher standard of living for everyone that workers can work less. It also gives their employers more extra money in order to make the workplace safer and to do a lot of things that actually make work less onerous, less time consuming and better overall. So when people tell us that we should be thanking for the government for the weekends we should be thanking the fact that we can earn enough to live a nice lifestyle now in 40 hours a week whereas our ancestors could only do that in 60 or 70 hours a week in many cases. It wasn't simply because the government declared now that we're gonna work fewer hours. If in the 13th century a king had simply declared we're gonna work fewer hours now that would have just meant more people would have starved to death. The reason we can work fewer hours and not starve to death is because worker productivity is so high. So we need to stop of course seeding that whole premise to the activists who wanna come in and make the claim that work life will simply be better if we start regulating more. The reality of course is that what we really need to do is help entrepreneurship and help people produce more in less time. And then the final myth is this issue that markets make things more expensive and we need the government to make everything more affordable. And we see that now in a variety of areas. We see it in housing, healthcare and higher education is where most of the debate has been featuring lately in higher ed and healthcare especially. Now the problem is of course that virtually everything that the government does when it claims to be making things more affordable and more available is actually to increase the price of goods and services and to make them less accessible to people. And then what they do is they come back and they say well, we'll give you more money, we'll subsidize your income or we'll subsidize healthcare and that will then make you able to access it. Whereas of course it would be far more efficient to simply allow the market to work to bring down the cost of things because that's of course what naturally happens in the marketplaces. The price of goods and services come down. It's why we pay less now for many electronics of course which is relatively unregulated. But of course to build a car with the same amenities that a car had in 1960 would be far, far less expensive today. Now we added all kinds of stuff to cars that makes them more expensive now. But if we didn't add all that and didn't have all of these smog check requirements and all of that, you could purchase a car for next to nothing and certainly for a much tinier percentage of your income than your grandfather could. And so the goal should be always to lower the price of goods and services not to regulate them and not to subsidize them which only increases and brings up the price of healthcare. And we saw this a lot in a recent debate between policy makers over higher ed where Paul Campos, a law professor at the University of Colorado pointed out that it is absolutely not true and now Campos isn't exactly a free market guy but he was nevertheless honest enough to point out that higher ed is not more expensive because there's less government spending going into it. Now all the data shows quite clearly that there's more government spending now than ever on higher education. The reason it's more expensive is because it is so heavily subsidized that it creates more demand for the product and the price continues to go up. Now at some point then you need to start rationing in order to keep prices down. That's the only way to keep prices down. The market either rations it in terms of only providing certain services to people who can afford it or it actively rations it in terms of the government only allowing you so many services that you can use. Now the Germans have free education but they ration it heavily through the use of tests. You're only allowed to go to higher ed if you qualify through a regime of government tests and other countries do this as well. The U.S. of course lets you go to college regardless of who you are is very open with that and that tends to push prices up quite a bit but that is a direct result of the subsidy. The same is true in housing, both in for purchase and for rent housing where there's both through section eight where they subsidize the renter and that allows then renters to, or it allows the landlords then to demand more money because the rent is being subsidized, partially subsidized by the government and of course home ownership is constantly being subsidized by a wide array of government programs, Fannie, Freddie, FHA and so on that help drive up the price of home ownership as well. But all the while that all this is going on and all the price of these basic things that we need to buy every day, we're being told that somehow magically the market is making all of these things more expensive whereas this mechanism is never quite explained or if they do manage to come up with something in the market that shows why something's becoming more expensive there then they just leave out the fact that a huge portion of the market is being subsidized. The, and of course healthcare as we noted in the first part is heavily subsidized as well through all of its massive amounts of spending which of course makes the US the fourth in the world in terms of government spending. So through all of this, then we're just supposed to sit back and watch the debates as all of these myths are repeated again and again, the market is our enemy because it makes things more expensive or does nothing to help us afford things but fortunately the government will step in to do that. When then we're left of course with this idea that the US is somehow unique and more heartless than other places and none of that is true. And unfortunately it doesn't look like those myths are gonna go away anytime soon. They were around four years ago, eight years ago and even more so actually in periods in the past and they're coming back full time now and you're not even seeing any sort of substantial debate about it. I don't think we'll see any kind of real debate over social security or in any real cutbacks to health spending or anything like that. And so I suppose it's now helpful to know about these things and maybe at some future election cycle we might see a more rational treatment of these things. But until then thank you very much and thank you for being here.