Okay, so today is a great pleasure to have Daniel Stern from University of Chicago at the PD seminar, and this is also joined with the informal geometric analysis seminar that we'll talk about we talked to us how to produce minimal theory. Okay, thank you Daniel, the floor is yours, take it away. Okay, so thanks a lot to Antonio for the invitation, it's great to be virtually in Maryland. So, yeah, so the basic objects when we starting with today are minimal submanifolds. Okay, so let's say we're in some closed oriented Riemannian and manifold. Although a lot of the results we're talking about will be interesting even in local settings just for like domains in our end, but we'll start out here. And just recall that if we have a closed k dimensional submanifold inside of M, it said to be minimal if it's a critical point for the k dimensional volume functional, e.g. when we push it around by isotopes. Right. And equivalently this is telling us that the mean curvature record. Okay, so a basic question which goes back in some forms to the 1700s is, which and manifolds contain closed minimal submanifolds mentioned K. So the 19th century for the manifold formulation, but right question about existence of minimal surfaces goes back very far. All right. And so, okay, so we're talking about geodesics. Some of the interesting case was first raised by Poincare where he asks which metrics on the two sphere for instance containing closed geodesics. All right, so if we're trying to answer this question in generality. Then we want some techniques for producing minimal submanifolds of a given dimension K inside an ambient manifold basically want some general machinery. So ultimately where I'm going today is for a new machinery in co dimension to producing manifolds that are minimal submanifolds two dimensions lower than the ambient manifold. But of course the oldest machinery are at least the most robust one introduced in the 20th century is a geometric measure theory. So if we're trying to produce critical points of some K dimensional volume functional, then the natural thing to do is to try to do some kind of variational theory for the volume functional directly. Right and the toolkit for doing this is geometric measure. Okay, so this won't be a GMT talk but it's sort of lying under the skin of everything we do so let's just recall a few basics. So if we're talking about existence results for geodesics or minimal surfaces, then the existence results go back to the beginning of the 20th century, but a general existence theory for area minimizing K surfaces and manifolds. It doesn't really come up until the 1950s with the work of Federer and Fleming. So if we're trying to solve some kind of volume minimization problems so for instance if we're trying to minimize volume among K surfaces of some fixed K minus one dimensional boundary, or in some fixed homology class. So we're going to try direct methods and what we want to do is be able to take a sequence of minimizing sequence of these guys for the volume, right and extract a limit. Okay, but it's easy to see that we can't extract a limit if we're, you know, imposing some strong topology like C1 or C0. So we need to begin with an appropriate week notion of some manifold. Okay, so the first step here in Federer and Fleming's work is to observe that we can view K dimensional sub manifolds as what are called K currents, right so they're linear functionals on the space of K forms via integration. Okay, so this is just saying we can at least put them inside some giant space of distribution type objects. Okay. Okay and in this space of distributions we have a notion of boundary of these generalized of manifolds right basically just by duality with Stokes theorem. And more over the K area extends to a lower semi continuous functional under weak convergence, called the mass. Okay, so we have a notion of mass and boundary. So we can begin to make sense of these problems in this this weaker setting. These currents without any additional constraints are very, you know, while distributional objects we want to refine our notion a little more. Okay, so one of the key insights of Federer and Fleming was that smooth sub manifolds and integer combinations thereof, lie inside a distinguished subclass of currents with nice compactness properties for solving mass minimization problems by direct methods. And these are the internal currents. So let's say a current T and M is integral. If it's given by integration against some K rectifiable set with some integer multiplicity. Okay so just to remind you of K rectifiable said is something which looks like a patchwork of K dimensional C one or lip shits of manifolds, right such that this K dimensional tangent space is well defined almost everywhere. So these really do look like singular K dimensional some manifolds equipped with some extra multiplicity function. And for them to be integral we also ask that their mass and the mass of their boundary are finite. So the observation that Federer and Fleming is that we have you know if we have uniform bounds on the mass and the mass of the boundary. In fact, these are going to be weekly compact. So if we take a limit will end up with a limit that's also itself an integral K. And so using this you can show for instance, that every non trivial integer homology class can be represented by a mass minimizing integral cycle. So in particular if we have non trivial K dimensional homology and a manifold, at least we know we can produce some kind of singular closed K dimensional minimums of manifold by minimization. All right but our priorities can be quite singular. So we can ask how regularly my feet. All right, so if K is m minus one so for one dimension lower than the ambient manifold. Here's a classic series of results by the Georgie Federer and Simons, which tells us that in fact these are pretty regular. So the mass minimizing m minus one current is going to be given by a smooth hyper surface so in particular smooth classically minimal hyper surface with constant multiplicity away from some singular set of dimension at most and minus it. Okay, so that's pretty nice in particular dimension seven and below. They'll be smooth. All right, if on the other hand case between two and minus two, then we get a little weaker regularity. So the mass minimizing K current in this case in higher co dimension is given by a smooth some manifold of constant multiplicity away from a singular set of dimension at most K minus two. So the singular set now can be up to two dimensions lower than the minimal some manifold we're looking at. Okay. And it's important to note that that's sharp. So this is a classic observation of Federer, which tells us that any for instance holomorphic sub varieties any complex sub variety inside a killer manifold is going to minimize mass in its homology class satisfies a special condition called being calibrated. So in particular algebraic sub varieties inside CPN for instance, can have co dimension to singular sense. And is a useful example for two reasons. First of all because it shows us this regularity result is sharp and provides the basis for a lot of the examples we look at when we're studying singularities. Because it shows us that even when the minimal some manifold we produce are singular, they can still be classically interesting objects like singular algebraic varieties. So we don't somehow throw them away just because they encounter singularities. Okay. All right, but now what if we're trying to produce closed minimal case of manifolds when we have no homology so we can't do these minimization problems. So can we still find some close minimal some manifold of dimension. So for K equals one if we're producing geodesics, then positive answers go back to Birkoff who's next neural one and Morse in the first half of the 20th century, where the idea is we can exploit some non trivial topology in the space of loops, and then do some kind of Morse theory or min max theory for an appropriate energy or link functional. All right. So natural thing to try to do the same thing for the general K dimension of volume functional in these geometric measure theory settings introduced by better and Fleming. Okay, so to do this we first need to know that some appropriate space of cycles has non trivial topology. All right, so Federer assigned this problem to a promising PhD student of his Fred Omgren. And fortunately, I was able to show that indeed the space of pay dimensional integral cycles inside an n dimensional manifold has homotopy groups, which correspond to the homology of the manifold. And really the important point here is that if m is oriented. Well, then we know that the top dimensional homology is going to be non vanishing right we have a fundamental class. And so in particular the n minus kth homotopy group of k dimensional cycles is non vanishing. Right so we always have some n minus k parameter family of case cycles, which are somehow you know we can glue these together to sweep out the fundamental class. So we have some non trivial topology. However, if we're trying to do a classical Morse or min max methods. The mass functional is only going to be a lower semi continuous functional on this very non smooth space of case integral case cycles. Okay, so in particular it's not really well suited to classical min max techniques, where we'd want at least something like a C one functional on some kind of bonnaker fence or manifold. Right. But Omgren was able to make something work. So I'm going to was able to develop some kind of discretized min max theory in the space of integral case cycles and get the following existed result. So he was able to show that in the early 60s, that every closed Riemannian manifold supports a non trivial stationary interval k variable where k is between one and dimension of the manifold. So, what are these objects. The first example is likely these interval currents we were seeing before except we're forgetting orientation. Okay, so it's just we can think of this some measure, given by integration over some k rectifiable set equipped with some now positive inter multiplicity function. And then we call such a thing stationary. If it satisfies the obvious analog in the setting of being a critical point for the k volume functional. So it's a critical point for this weighted k volume functional or integrating this multiplicity function over over our case surface. When we push it around by different morphisms. Okay. So we have some kind of of close, weak minimal k dimensional sub manifold inside any ambient guy. But what it is actually looked like. We're going to look closely in particular to being smooth close minimal sub manifold. So by some partial regularity results of Allard in the 70s. We know that any stationary interval variable one of these guys coincides with the smooth minimal sub manifold on at least a dense open subset of its support. So if we choose some kind of bear generic point, then we know that in a neighborhood we're going to look like a classical smooth minimal case of manifold. However, whether for a general variable to this type, the regular set as has even full k dimensional measure. So it's possible that we choose a bear generic point and get something regular, but we could choose a point which is you know generic in the measure sense, and get something something irregular some singular point. So, a priori we don't know that much about the regularity of these guys, but at least they're a natural starting point for an ocean of a week closed minimal case of manner. On the other hand, if we're okay super in general co dimension. That's basically the best we can say about these min max guys as well. However, in co dimension one, we can say a bit more. Following work of pits and Shane Simon in the late 70s and early 80s. So combining the work of pits and Shane and Simon and you know contributions my own grand as well. We know that if the case and minus one, at least two. Right, so we're in the three man up older higher and they're looking at hyper surfaces. Then the stationary hyper surfaces given by all men max construction are going to be smoothly embedded minimal hyper surfaces so classical objects away from a singular set of dimension at most and minus eight. Right to the same kind of condition we were seeing for the minimizers before. And in particular other smooth and dimension at most. Okay. So in low dimensions, we get existence of classical smooth minimal hyper surfaces and higher dimensions they satisfy sort of the best regularity we can hope for, knowing that we have examples with co dimension seven singular sense. Okay. So in the next five or 10 years, Marcus and nevus have been building on this min max three for hyper surfaces quite a bit. And together with work by k eerie if you look at Movich and one song Shin Joe and a pile of other people. They've been able to refine these ongoing pits results to show that not only do min max hyper surfaces exist in every ambient manifold, but in fact piles of them exist so for instance for a generic metric. The union of their supports forms a dense subset of your ambient manifold not only do they exist but they're incredibly a bunch right and there's been this whole series of series of breakthroughs in the last decade or so. Okay. So at the same time, a different program was initiated by Marco Goraco and his thesis with various contributions like a drug as far for its he smire. We're exploiting connections between minimal hyper surfaces and semi linear scalar elliptic equations to get a powerful regularization of the ompren pitts theory. So these are the results about these semi linear scalar equations, which they're using for their regularization. Okay, so what's the story there. All right. So these are the Alan con equations. So a real valued function on our manifold solves this Alan con equation with small parameter epsilon. This guy here, if and only if it's a critical point of the so called Alan con energy. So e epsilon of you is this epsilon over two times Dirichlet term, plus this potential. This is the way to the over epsilon, where the potential is so called double well, right so a canonical example of something like w of t is one minus t squared squared. So something with a minimum absolute minimum minus one plus one, and then giving us this w interpolating between them. Right.  But for a general map where when we feed it through this, our potential term is going to try to force us to take values close to minus one and plus one, almost everywhere, right where the so more and more harshly as epsilon goes to zero. But that this Dirichlet term gives us some regularization and told us we can't just sort of interpolate between minus one and plus one in arbitrary way there's some control over how we pass between those regions. So in the 70s, following some observations of the Georgie, Modika and Mortola observed that there's an intriguing relationship between the variational theory of these energies, and that are the n minus one area functional, equivalently the perimeter functional for catch up with sense. Okay. So what they showed is that for any sequence of w one to matter functions with a uniform bound of these Alan con energies epsilon goes to zero. So by reparameterizing these functions in a natural way. These reparameterized guides are going to converge subsequently to some limit function of bounded variation taking values and plus or minus one. Who's one normally gradient or rather it's, you know, it's great into rate on measure so the mass of that rate on measure is going to be bounded above by the limit of those Alan con energies. So in particular, this BB function taking values and plus or minus one. That's just going to be the function of the form Chi Omega, minus the characteristic function of the complement of Omega, right for some domain Omega finite perimeter. And this is just telling us that the boundary area of that domain is bounded above by these Alan con energies and the limit. Right. So for any set Omega finite perimeter can be approximated in this way with a quality holding in this limit. This is telling us the Alan con energies, so called gamma converge, the perimeter functional and minus one boundaries. So this gamma convergence I'm not going to get into what that means but it just is telling us that the minimization problems with epsilon energies converge in a natural week way to the minimization of n minus one area on these Okay, so in the decades since this interplay between the on con equations and minimal hyper surfaces has been the subject of a lot of research. There are lots and lots of both I won't talk about but some of the highlights that are relevant for us. So in the beginning of this century Hutchinson and tonic Gawa showed that for any sequence of solutions and now not arbitrary functions with solutions of these Alan con equations with a uniform energy bound. And the other measures are going to converge subsequently to some limit measure mu, which is given exactly by the measure of a stationary integral and minus one variable. Okay. So in particular, and not only do the minimization problems converge, but any family of critical points for these this nice semi linear elliptic equation they're going to converge in some sense to the critical points of the n minus one area functional. So we're going to find this and show that if we assume more over that these functions are stable critical points. So they're minimizing to second order. Right then in fact that limit Sigma that limit variable is going to be a smooth minimal hyper surface away from a set of dimension at most and minus eight so they have that same regularity that we saw for minimizers and for the men max guys before. Okay. So building on this Morocco was able to show the sequence of solutions of these Alan con equations arising from natural men max constructions. Well now they won't be stable but they'll have some bounds on their Morse index is epsilon goes to zero. And so again they're going to converge is epsilon goes to zero the minimal hyper surfaces of this optimal regularity so singular set at most co dimension seven. So building on this you show that you can get an alternative to the ongoing pitch construction of the max minimal hyper surfaces, just via these nice semi linear scalar equations. Right. And the idea is we can replace this awkward GM team and max of Omron, which again does not fit into sort of a classical men max framework. And now do this a really nice classical Morse theoretic methods for these smooth functionals on just this Hilbert space of soval of maps into our right. And so in particular shifts all the technical work of the GM team in max construction on to just be asymptotic analysis of these solutions of these equations as epsilon goes to zero. So shifts all the sort of awkward GMT work into just this nice sort of clean, albeit still non trivial PDE problem. All right, now there have now been many successes this approach. So one of the biggest ones has been this proof by trodash and Montelitis of the so called multiplicity one conjecture and dimension three. So it's telling us that for a generic free manifold, the minimal surface is produced by the min max for Alan Khan will come with multiplicity ones that multiplicity function will just be the constant one. All right this turns out to be really useful for interested in these problems about counting how many minimal surfaces are contained in a given manifold. And on this slide that I should also mention there's a great deal of work going back to Elman and which tells us that in fact the parabolic version of these equations is also a useful regularization of the codemention one mean curvature flow. So in particular if you're interested in producing the curvature flows it gives us a nice way of producing long time week solutions that is difficult to do by direct methods. Okay. All right so given all these applications. One question we can ask is whether there's any similar phenomenon in higher codemention. So in particular there are similar dictionary between some natural family of geometric PDEs and minimal submanifold of some codemention and bigger than one. Right and let me emphasize that this natural here, because somehow we're not just looking for some nasty modification of the area functional, we're really interested in finding one via some natural family of geometric PDEs. So we're also getting some interesting dictionary where we're getting, you know, a two sided story where we get these guys, you know, these PDEs regularizing the story for the area functional, but also then using our knowledge of minimal submanifolds to get new information about these PDEs that we have some independent interest in. Right so if so then we can hope this to improve our understanding is the next minimal submanifolds, but also then, but at the same time get interesting information about the solution space of these PDEs. So codemention two, the work I'm talking about today gives a positive answer at least the start of a positive answer. So there is a well studied family of functionals arising in gauge theory, whose critical points and it turns out the variational theory limit to those of the mass functional on the space of codemention to integral cycles and particularly the area functional of codemention to. Okay. So, before we get to the the one that works. Let's look at sort of another attempt people have made including myself in codemention to that falls slightly short. So an early candidate that we could think about it be the non gauged Ginsburg Landau functions. So one family of functionals, which comes close to providing a positive answer, are the so called complex Ginsburg Landau energies. So formally these look like the Alan con energies, but now we're thinking about complex valued maps you. Okay and we're feeding in this energy which assigns the Dirichlet energy, plus this one over four epsilon squared, one minus the norm of u squared squared. Okay, so, notice that if you was an s one valued map, so it's taking values in the unit circle and see, and this potential vanishes, and we're just recovering the Dirichlet energy. So for restricting to the space of s one valued maps, and doing minimization problems, for instance, and we end up just looking for harmonic maps to s one. Okay. So if it's taking values away from s one, this potential term is going to penalize it, and it's going to penalize it with increasing severity of epsilon goes to zero. Okay. And sure enough, we're in the bounded energy regime. So if we're looking at, you know, where these f epsilon are founded as epsilon goes to zero, then the variational theory for these f epsilon is really just going to approximate the variational theory of the Dirichlet energy for s one valued maps. And for instance, critical points of uniform energy bounds are just going to converge to harmonic s one value maps, which locally lift harmonic functions. So if we look at the oh a blog epsilon energy regime, which is where a lot of our, we end up and we do natural variational problems, other critical points can have nontrivial zero sets. And those zero sets it turns out are going to converge as epsilon goes to zero to some kind of generalized minimal varieties of code mentioned to. Okay. So there are a couple of decades of results making that precise. Most of it's sort of building on some early observations of linen Riviera in the 90s, and Bethwell Brazil and Orlando in the early 2000s. But the punchline is that given the family of these critical points with energy growing like log epsilon is epsilon goes to zero. Then these normalized energy measures, this Dirichlet term over log epsilon are going to converge subsequently to some limit measure of the form mu B plus norm H squared. This is a continuous term, right? It's absolutely continuous term where H is a harmonic one form. So we get the energy density of some harmonic one form. And this music v is going to be a stationary rectifiable and minus two variable supported on the limit of the zero sets. Okay. Let's clarify a few things. So we're comparing with this analogous results for Alan Khan, right we see two clear drawbacks right away. This energy can have this non-trivial diffuse part, given by the square norm of this harmonic one form. And that's related to the fact that, again, this energy is in some ways just trying to give us harmonic S1 valued maps. And it's possible these critical points have some component which just looked like harmonic maps that are of an energy growing like log epsilon for sort of arbitrary topological reasons. Okay. So the biggest drawback at the local level is that these this n minus two dimensional part this generalized minimal sub manifold is only a stationary rectifiable variable, not an integral variable. So if we think back to our definition that's just telling us that this density function theta along our n minus two rectifiable set can operate or you take any positive real value it doesn't have to be restricted to some quantized set. So it's actually a technical point, but it actually has implications for the regularity theory, and also just for the size of the space of objects we're considering. So for instance in it, and it's three so these are just producing some kind of geodesic networks, the space of real geodesic network geodesic networks of real coefficients is much larger in a geometric sense, then Antonio question. So, on these two bullet points so the first bullet point can happen, while the second bullet point is expected not to happen right so. Yes, although I'm not sure how strong with expectation is. Yeah, no no what I mean is that it's just to be sure so for the first one. This thing can really happen so it's the second bullet points, it may be that. So it's, yeah, people have conjecture that it should be integral. But as we'll see that lack of integrality is related to some deeper problems, so I'll be get to that in a minute and explain a bit more. Okay. Okay, but anyway, so at least a priori, these guys could not necessarily be integral variables. I mean it could be part of a much larger space with a different regularity theory. So what's going wrong and the difference between this and this these co dimension one things in the Alan con setting. So the cartoon picture for Alan con is the following I apologize for the quality of the cartoon, but right the idea is that okay so as we're concentrating. So we're in this scalar valued case right and our energy is concentrating along some minimal submaniple, quote mentioned one. Then as epsilon goes to zero we expect the following picture. So we have our limiting hyper surface which is just going to look like the zero set of our of our function. So both all of the energy is concentrated in epsilon neighborhood or an O of epsilon neighborhood of that zero said, and vanishing rapidly outside can outside our functions are going to look like, you know, taking values plus one on one side and taking values minus one of the other. So the whole party is happening in this O of epsilon neighborhood. And okay when we rescale the epsilon size to unit size, we're just getting model solutions in our end of the equation with parameter epsilon equals one. And this is happening on the epsilon scale. When we blow up to unit size, we're getting model solutions, and somehow the reason we can characterize as well as if we blow up sort of a generic point along that zero set, we're getting not just an arbitrary model solution, but model solutions which are going to look really just one dimension. Okay, and that's somehow the basis for this Alan conflict. So we're looking at the complex Gensburg Landau picture. So let's say we're concentrating on this co dimension to set, and we're looking now at some two dimensional slice perpendicular to it. Okay. So, what's happening. So what, let's say we have some zeros and z one through zk and that two dimensional slice. So away from an epsilon neighborhood of those zeros. Now instead of being some trivial object like a constant function to plus or minus one, we're going to look like a harmonic s one valued math. We're going to be looking like, you know, Z minus CJ the product of the Z minus CJ is to some degree. Right, so we have these zeros, and they're occurring with some integer degrees kappa one through capital. Okay. And it turns out that that log epsilon energy the dominant energy contribution is not coming from this epsilon neighborhood around the zero sets, or we can blow up and again see some kind of model solutions. It's coming from these any other regions outside. So all of that energy is coming from these regions where distance to the zero set is not like of epsilon, but looks like some small power of epsilon. Okay. And using this you can compute, they were choosing this two dimensional slice sort of generically. Then the density of that slice is going to look like the sum from one decay of those multiplicity squared. This is a Coulomb interaction term, where we sum over the stink pairs of zeros, the product of their of their degrees their winding numbers, right together with this logarithmic interaction term, this log of the distance between them over log epsilon. Okay, so I'm telling you to your question. The problem, the key to showing that these densities are indeed the integral comes in ruling out this kind of interaction term. Okay, so for minimizing solutions, you can do that because basically these zeros are going to be sufficiently far apart that this this logs the I minus CJ is going to be negligible compare the log epsilon. In two dimensions, there are some special work by Compton Muranescu, which tells you that you can somehow rule it out by some careful use of magical pojaya identities that break down completely. Once you go to higher dimension. So the problem with ruling out integrality and which establishing integral in higher dimension is trying to rule this out in the higher dimensional picture, which is a difficult interesting question. Notice though that even if we have integralities even if we can rule out these interaction terms. It's still the case that this isn't really giving us the co dimension to area functional. If it were the co dimension to area functional, then we would just see the sum of the multiplicities of these zeros, we would just see something like some of absolute value of capital J. Instead here we're getting the sum of their multiplicities squared. Okay, and that's that's a real phenomenon that's not just that's not something that's connected to be false easy to find examples or that's, that's true. Okay, so somehow, because we're not really getting the co dimension to area functional here, we're getting something that's really measuring the energy of the singular s one value harmonic maps. It has an interesting relationship with co dimension to generalize minimums of manifold, but it's not really a regularization of the co dimension to area functional in the same way that the Allen con is for co dimension one. Okay. So what does work. And for that we have to go to be the gauge theory role. Okay. So we're going to let L sitting over our manifold be some permission line bundle. Right, so there's just going to be a family of two planes over real two planes over M right equipped with some metric structure and some orientation. And in fact, for everything we're talking about today. It's fine just take L to be C cross M just the trivial bundle, the copy of C sitting over. So by the intersection of that bundle, just mean a smooth map into L, sending each point X and M to some one of the fiber sitting over X, right in particular for the case the trivial bundle this is just going to be some you have X of the form v of X, X, right for some complex value map B. So by a Hermitian connection on L for metric connection, we just mean some first order differential operator sending sections to one forms and sections, which is just giving an ocean of directional derivative. And that metric connection condition that Hermitian connection is telling us that we respect the inner product structure, in the sense that if we take D of the inner product with two sections, we can write that as novel you oppose it w plus you inner product novel W. Okay, just this, it satisfies the liveness rule with respect to the metric. All right, so more over if we're looking again at just this trivial bundle, and every Hermitian connection turns out to be given by something of the form D for D is just the usual derivative on complex value maps. Minus I alpha, where alpha is just some one form. Okay, depending upon linearly on novel. In general, if we're looking with some more complicated on the right this would be a one form of values and subspace. Okay, so the failure of a connection to commute with itself is measured by this curvature. Right so two form of values and the endomorphism to that bundle. So nobler graph with nobler. And in the setting of Hermitian line bundles, the curvature turns out to be a really simple object. Right, so in particular for writing nobler is D minus I alpha for some one form alpha in the curvature F nobler can be identified with the two form D alpha, just the usual exterior derivative. Okay, so because we're working in the setting of you have one bundles, the curvature is just a linear operator on our connection. All right, so given a section of the bundle ends in Hermitian connection on the public and some parameter epsilon greater than zero, we have these self dual you have one gang those things energies, which are looking now like. So we're feeding you have nobler, and we get the Dirichlet energy of you with respect to that connection that we're choosing. So we have this Yang-Mills term epsilon squared times the norm of that curvature two form squared. Plus this potential we are seeing before this one over four epsilon squared, one minus one of you squared squared, we're penalizing you for failing to be a unit section for failing to have a normal one everywhere. Okay, and up to rescaling the metric this corresponds to taking the epsilon equals one energy and rescaling metric by some fact. Daniel, can I ask a quick question just for my curiosity. So the potential here is so it's it's related it's strictly related to the structure or you are allowed to as in null and can some flexibility on the potential. You know, on a link and you can, you are not required this function this specific function but I think that in this case, which also the strength of your of the of the structure you're using right so the W here is really specific. Right, for this specific. So that's that's a good point which I was going to bring up later right so for the Allen con as Antonio is noticing on a lot of the features like the relationship with minimal hyper surfaces. It's not important that you be the specific double well potential but anything with a similar structure, right so having two minima, you know, two strict minimum and then some kind of w outside of it. For these guys, the precise form of the potential is going to be very important in a little while later we're going to see sort of why that is. Okay, thank you. So in particular, if you just made that you know, half, you know, if you change that one quarter to a half or something already that would break some of the symmetry that are going to be important for us later. Okay, okay. Okay. So we have these these gauge theoretic functions. And it turns out these have been studied for a long time in the gauge theory literature and we'll talk about some of the results there. But the first let's look at just a few basic properties. The absolute minimizer. So for the Allen con or absolute minimizers were just constant functions of plus or minus one for the Ginsburg land now they were constant functions, taking us to some unit vector in the plane. Right. Now, if we have a zero energy solution. It's going to tell us that the section you is going to be constant with respect to that connection. So with respect to the chosen connection. So the unit vector of that connection is constant or a zero rather with flat and our section has to be a unit section. Right, so a zero energy pair is going to be something consisting of a unit section. A connection which views that section is parallel. And in fact, it's the exercise is the first two conditions of climate. All right, so in particular, suppose we have one pair satisfying the above. So for instance, we can just take you have x to be the given by the constant section sending us to the constant map to one in the complex plane, and then take knowledge to be the usual derivative on complex value maps. And for any S one valued map, which we can view as a family of rotations of our bundle, right, but we can take you till that to just be a multiplier given section by B, right. It gives us a new unit section. So the change of connection now until there is nobler minus I comes to gradient one form of that S one valued map. And it's easy to see that this pair now until the utility also vanishes. Okay, so, and in particular, the curvature also vanishes. So this gives us another zero energy pair. All right. So, the point is well for the Ginsburg land our functionals. So what we're running into or one of the main problems we're running into, we're trying to make it an approximation to the code mentioned to area functional is that it really wanted to be about the Dirichlet energy of S one valued maps. For these functionals, there is no such thing as S one valued maps, because all S one valued maps look the same up to a change of gauge up to choosing our connection well. Okay, so that's an important moral point in the difference. All right, so what we're noting here is just the gauge invariance these functionals right so in particular right these point wise these terms novel use squared F novel and you square their gauge invariant. In the sense that if we make this change you till the speed times you and now the till is nobler minus I times the gradient one form for any S one valued math. These are going to be that that change won't be seen by the energy function. Okay, we're just somehow rotating everything in the bundle. So if we denote now by Omega that's the real value to form associate with our curvature. Then we have these oil and grunge equations characterizing the critical points these functions. Okay. And in two dimensions, these have been studied for a while. And in particular for bundles over a remand service. This was done by Bogle money several decades ago that minimizes these functionals on non trivial bundles satisfy our first order system called the vortex equations. Right so similar to how you know in four dimensions, certain angles problems reduced to these one dimensional equations instantan equations. These, these guys have this interesting reduction in 2D, where the minimizers are going to look like. Okay, so you is going to satisfy some kind of holomorphicity condition or anti holomorphicity condition with respect to novel and the curvature to form, well of course a to form and on a surface we can identify the function, and that function is going to be exactly plus or minus the square root of our potential term. Okay. And this epithet self dual refers to the symmetries of the functional which lead to this reduction. And those are going to rely on the precise structures that part of the answer to Antonio's question about how important the structure is. So having this first order reduction that's something that's special to these concepts. Okay. So in his doctoral work back in the 80s, cliff tabs show that all all finite energy critical points of these functionals for the trivial bundle over the plane. Basically in two dimensions now we're working over all of our to all critical points are in fact going to satisfy the vortex equations. They're going to be somehow minimizers with respect to some boundary data infinity. And they're determined up to gauge equivalence. So up to multiplication by one of these comps s one day by the zero set. So, there's going to be a unique solution, satisfying this first order reduction with respect to its zero set. Moreover, any possible zero set so any collection of points in the plane, equipped with some multiplicities can arise the zeros, and more over the the energy of the critical points associated with those zero sets is going to be exactly two pi times the multiplicity of those zeros. So here again we see an important difference with the cartoon I showed you for the complex games for land okays, we're in two dimensions. Our energy is just somehow measuring the multiplicity of the zero set without any weird interaction terms and without somehow waiting different multiplicities in different special ways. Okay. All right so in the 90s. So, we've got Hong, you know, some struva look to the asymptotic analysis is epsilon goes to zero. For solutions of these first order vortex equations over close Riemann surfaces. They showed the following. They show that is epsilon goes to zero these curvature two forms, again now just function since we're in three dimensions right. They're going to converge distributionally to a finite sum of direct masses, representing the first churning class of that bundle. So we're more than the limit of the zeros of these sections. And more outside of that limit of those zero sets. This you epsilon is going to approach a unit section. And now the epsilon becomes flat in the limit. So outside of our energy concentration set. We don't have somehow anything else going on we just seeing this unit section and a connection with use it as constant. So here again we see a nice parallel with the the on con setting. We're outside the energy concentration set. Everything looks trivial. And so in the first part of my work with Alexander Bugatti, we carry out the asymptotic analysis for general critical points, not just the special reduced equations right on the line bundles over an arbitrary base It's now we're looking into arbitrary dimension as well. And we get something which looks quite similar to what had just been found for the Alan con equation to the mentioned one. So if we have some critical points these energies on a Hermitian line bundle, which again we can just take to be trivial over a closed oriented manifold. And if we have a uniform energy bounds epsilon goes to zero. Then these energy measures are going to converge subsequently to a stationary now integral I minus two variable. So it's going to have integer densities supported on the housework limit of the zero sets. And more over to sort of mirror that result of how it's true but we know that the M minus two currents do well to the curvature two forms, right so any two forms we can identify with M minus two currents because we can wedge with an M minus two form and integrate. Those are going to converge with integral M minus two cycle, lying along that minimal some manifold that we're producing the energy concentration. Yeah. So here the mass of gamma is the same as the mass of the integral so of the integral variables. No, so that. So I guess the Britain here is the measure associated with gamma the mass measure is dominated by the mass measure that bearable. Okay yeah that was on and on Thursday. Okay, okay, okay. No no yeah it's pretend that okay so it's okay. So you can you expect to find situations where you have cancellation for that gamma guy but the as measure you have. Okay, okay so in principle you don't expect that that those two coincides so. So more morally it's like, you know, having a gap looking at the limit of family occurrence right so the. So we think about the curvature, the curvature two forms as tracking what's happening on the level of currents. Right but then the the energy measure that tracking what's happening on the level of her okay so yeah so the limit is not coinciding with the limit of current. That's a good question. All right so we're able to get this this a nice analog of the Hutchinson tonic our result in co dimension one. And so obviously as you can imagine the proof requires simple analysis. The point is a pretty simple one. So, for the Allen con equations. I'm kind of the key first ingredient was an observation of for analyzing general critical points is an observation of Modica back in the 80s, which tells us that we have a solution of some semi linear elliptic equation of the form of the Allen con. So we're going to some d u squared plus w of u, where w is any non negative potential. Then in fact you can get a point wise bound, in that case is the Dirichlet term by the potential term. Okay, and that ends up giving you this this incredibly useful result for the semi linear elliptic equations, where you can improve some kind of a priori energy growth so a priori, you can say that your energy should grow like our the n minus two over balls of radius and having this down allows you to improve that to an r to the n minus one. That's telling you that the energy growth of these solutions to these Allen con equations matches the energy growth of your minimal hyper surfaces. Okay, we find something analogous in our setting. So if we have critical points for these functionals the epsilon over a base manifold with the safe positive curvature operator, but without the curvature assumption the same thing will hold up to some small errors. So this is an equality between the gang mills part of the integrand, and this potential term. Okay, so very much analogous what we find for the motive is here. All right, and proving this is just an exercise in you know bachner bits and bach formulas and maximum principle. Once you know to look for that's not not a hard thing to find. But what does it do first it does the same kind of thing. So if we're looking at gdc balls radius r, then standard computations up to some errors from the curvature of our manifold that we ignore. Tell us that if we look at d dr of the energy of this critical point on the ball radius r, that's going to be bounded below by one of our times the integral of the ball.  Now a priori it's easy to conclude then that all of this is bounded below by n minus four times the energy over that divided by our right. And for critical points of a typical Yang Mills Higgs type functional or Yang Mills type functional. That's the best one can say so if you're looking at Yang Mills problems in general, what you expect is this co dimension for type energy growth. Okay, but for these guys. Because we have that nice point wise bound for a novel in terms of the potential, we can borrow this n minus four times the angles term, plus n times the potential term, we can borrow two from that potential term. And see this is all bounded below by n minus two times the sum of those terms. And so in particular this tells us the energy is growing, like are the minus two so we have co dimension to energy growth, matching will be expect for minimal some manifolds of co dimension to. And that's really the starting point for everything. So, we have that and then together with some exponential decay of energy away from an O of epsilon neighborhood of a zero set. So as in the Allen contract to and the whole party is happening in this epsilon neighborhood around the zero set. Then we can use towels as results about the two dimensional model solutions. To get this finally put all this together and see that we get converted to energy to the stationary integral and minus deeper. So, the statement about convergence of curvatures. So saying this and how tracks behavior at the level of currents comes from a pretty straightforward comparison of the curvature two forms. These two forms, J of you nobler acting on x and y that shouldn't be a defined their type of is the following so we just get this kind of Jacobian type term, modified by this one minus our view squared, and the curvature. Okay. And the point is then by a simple application of the coachy Schwartz, right easy to see that this J of you nobler, its norm is bounded point wise, by the Dirich the energy. Plus the, these two are going to be bounded by this epsilon squared gang little squared, plus one over four epsilon squared times potential square. In particular, but the norm is bounded point wise by our energy into grand independent of epsilon. And then we just observe that this two form differs from the curvature to form by D of something which is going to be vanishing weekly as epsilon goes to zero. Okay, and that gives us the convergence of those minus two parts. Okay. So, of course, this would only be fun if we had lots of examples to play with, but fortunately we do. In particular, we can show that on any Harrison line bundle over any manifold, there's going to exist a non trivial family of critical points with these uniform energy bounds. And in particular with uniform energy bounds from below as well, which are going to be converging to a non trivial stationary integral minus two variable. Okay. In particular, we apply this to the trivial bundle, which exists over any manifold. This gives us an alternative proof of this existence results on grin where we're again we were placed in kind of awkward GMT constructions with a nice kind of clean PD analysis. So the idea for non trivial bundles is as with non trivial homology classes in the GMT setting we can just minimize. Right, so we minimize energy in that case to get our solutions for the trivial bundle. So we apply a simple two parameter min max procedure. And morally the point here is that these functionals e epsilon are going to satisfy nice place now conditions, and are amenable to sort of classical min max techniques. And in particular, the somehow the modular space of pairs where the section is non zero, moded out by the action of this gauge group of s one valued maps has essentially the same topology at least at the level of the boundary as the space of M minus two cycles. So in fact we have a rich topology to play with to do more theoretic instructions. So more recently, with the be the Parisian us under begati, we've been filling in another piece of this dictionary between these functionals and the mass of M minus two cycles. We're kind of going back to the 70s for the Alan Khan world, and developing this gamma convergence theory in the spirit of what would have been more toilet it for Alan Khan. Critical points convert to critical points, but how the variational theory for these functionals actually converges to the variational theory of the co dimension to mass function. And, okay, so particularly show that for any family of section and connections, not necessarily solutions of any PDE satisfying a uniform bound of perspectives energies. So the connections, the sections are going to converge subsequently to some singular unit section, right, who singularity is going to be given by some co dimension to integral cycle, which is again given by the limit of these gauge and variance cobiens that we looked at for the, for this latter statement about convergence curvatures in the previous theorem. And moreover, we can show that any integral minus two cycle can be obtained in this way. So we can find the sequence of sections of connections which converge to it. And, in particular, we can use this to what first of all tells the minimization problems for these functions are going to converge to minimization problems for the minus two area. But moreover, we can use this to see that the, the min max vera folds, constructed by Ombrin are going to have mass bounded from above at least by the vera folds arising from these min max for the u of one takes functions. Okay, so we're getting some strong results telling us the variational theory converges the variational theory of the mass functionals. And I think that's all I want to say for now. Thanks again. Thank you very much, Daniel for the, for the beautiful talk. Are there any questions for the from the audience for Daniel. In the meanwhile, if you, in the meanwhile you think about it so I have some a question or two Daniel. So, the first thing is that so in this, in this family of the mimax you have so in this family of section you have for the mimax. Okay, I think that this is it's cool it's pretty sharp but in case let's say you even you beside the bound on the energy you knew some bound on the, on the mercy index let's say uniform bound on the mercy. So do you think it's so full to try one could refine a bit your the theorem. In terms of regularity or some more information or it's. Yeah, you would you would hope to try to say something more about the structure of the variable given this information on more index right. Yeah, so let's see short term I'm not super optimistic about that. The place to start is looking at classification of stable entire solutions these PDEs in say our three or four and so on. So if you show that you just sort of get the nice model solutions for stable guys in that case, then that's telling you what you're getting under blow ups, the general setting under uniform Morse index bounds. And then you can start to refine a little bit what you can say about the structure of a singular set. Now, certainly a priori I would still expect the same kind of branch point singularities you see. The GMT setting in co dimension to right. So, some others there's no getting around the fact you're going to have to deal with. You know singularities arising from things like is algebraic varieties and stuff. And let's see. Yeah, so I guess I'll leave it there the first thing to do is look at the stable model solutions, and if you can refine a little bit that that'll be useful. But you think that anyway there is some room to work on that so there is some room to hope that's. There's natural directions to play with. And the other question that I wanted to ask so with this approach he actually super cool so it's super nice the results so but could you could you apply it also to like, if you want to now approximate the bracket blow like a layman and as he was doing with Alan Khan so if you want to do the same with a well co dimension to flow or for instance if you want even like a network and having like I guess in this case you can get what three chambers so can you make approximation of the black bracket blow with your So the question is more like do you think that this monotonicity that you get can be also in transfer to a monotonicity of the whiskey type in the victim. So in particular that's actually an ingredient in the, the new paper with the VDN awesome bro is when we're doing is max comparisons. One of the things we want to do is you know starting from some arbitrary min max family for these functionals, we end up wanting to tame it by the gradient flow of these functionals to get some kind of uniform control on the energy density. And to do that we introduced precisely the Swiss can type monotonicity for photo mention to and the mechanism there looks a lot like these, you know that this modicum type estimate we had in a stationary case you just have a parabolic version of that. And from there you get to who's going on this type result. So yeah actually so that's, that's great so it seems that it's pretty optimistic for getting a good bracket flows going through this. That's nice, it's nice. So thank you very much for answering the question and in the meanwhile, are there other questions from the audience for Daniel. Okay, so if not, thanks again Daniel for the beautiful talk. And, yes, so for everyone else we meet at the next PD seminar. That is next Thursday. And yeah, so I stopped the recording now and then if you want we can chat a bit more before you leave just to let me close the recording.


Everybody forced here. I'm ripping four boxes for Josh D Josh's got pretty fun one here We're gonna hunt for a kaboom and a color blast. I look up her kabooms in crown Royale 21 22 and Obsidian 2021 for football So let's start with Crowd come on kaboom There we go base card Zion Williamson Jalen Suggs the rookie Shy Gildes Alexander and Koaile Leonard First hit is a Chris Hubs for Zinges Jersey wizards Jersey more nice Game worn with a Mavericks that jerseys nice rookie auto blue Chris Duarte 20 of the 75 Very nice Duarte color match and all crystal Christian wood New Maverick and snow globe Yana Santa the Coompo to 49 Solid box there. Let's see that kaboom now at least a nice silhouettes or something something a hoot and holler about Got base Donovan Mitchell Jeremiah Robinson Earl bones Highland and Tyrese Halliburton Rookie Jersey car. What the heck is that? I think you could pull that out. It's just like a loose paper I don't want to mess with it though. That may if that makes sense Josh. I Don't think that's damaged at all. I think that's just something that would come out Little sliver of paper, so I'm gonna leave that alone Ace warriors rookie auto blue Jonathan cominga to 75 Heck yeah, there you go Josh Love to see that we'll get that magged for you JK with the initials there got Zion crystal and nice good box for sure with a Snow globe Anthony Edwards to 75 Solid autos there Not the biggest boxes, but definitely good. I would say I said I'll get that Kaminga mag. Let's find a color blast for you No kaboom, so that means we've got to get your color blast here nice Mack Jones auto First up is a base Allen Robinson got a Contra coming up first got a rookie orange to 75 Tylen Wallace Contra Ravens rookie Rashad Bateman. I Don't remember these anymore. Nice Contra there good-looking card Ravens rookie Jersey card Rashad Bateman Ravens box so far to 100 there bears rookie auto Dazz Newsom to 75 Greg Rousseau rookie auto to 75 and Kyle Trask rookie Jersey auto to 99 one more Pretty decent boxes all the way around so far It's a let's finish strong here Let's see you Josh to see a big card Got rookie Sam Ellinger Rookie orange Zach Wilson there we go 75 on the Zach Wilson and Purple Bobby Wagner to 100 Galaxy gear Joe mix into 100. Here's a nice player Trey Lance to 75 Rookie patch card Rookie auto Kenneth Gainwell to 199 and 2-2 Atwell rookie dual Jersey auto to 150 On the back for you Josh Not the best finish, but still a solid break for you. We appreciate it. We'll get them right out to you


A construction worksite is a busy place. You're often working with other tradies and contractors. All it takes is a moment to stop and talk about health and safety issues that could affect everyone on the worksite. So this October, during Safe Work Month, take a moment and encourage workers to ask questions, share information, raise concerns and report problems. Check out the website and see how the construction industry can get involved.


Let's welcome these gentlemen to the stage. So thank you all for attending. Um, this is the token menace. My name is Alvaro Munoz. He is Alexander Miros. We are both security researchers with micro focus 45 team. And today we are going to, uh, present some of the vulnerabilities that we found in the net framework. Um, they are related with authentication tokens so we will introduce them and see how they work in the context of delegated authentication. And then we will present these two vulnerabilities. The first one is an injection vulnerability leading to arbitrary constructed invocation and we will see what we can do with, with that. It's a parameter less constructor. And the second one is what we call the up key confusion, uh, which is a way of bypassing XML signature in, not just in a, in some more session, in some more tokens, but, uh, we will apply it in for some more tokens. So we will review them in the context of the, of these Windows frameworks, uh, Microsoft, uh, framework, Windows Communication Foundation and Windows Identity Foundation. So, um, delegated authentication is nothing else that when you have a user accessing a resource, um, that is protected, but the service provider that is hosting this resource is not handling, uh, the authentication itself. It will basically redirect you to a third party entity or the identity provider, which will, uh, take care of the delegation. So the user will go there, present the, um, credentials and then, um, the service pro, the identity provider will issue an authentication token. It can be in the form of a SAML token. It can be in the form of, um, I don't know, JW token, uh, maybe, um, simple web token, but most of them have some attributes in common, right? Things like the, the issuer who issued the token. It's not the same thing if I give you a coin issued by myself that if you go to a bank, uh, the audience, if this is a token that is valid for service aid, I should not be accepted by service, uh, service fee, expiration date, things like the claims, right? So all the knowledge that the identity provider has about the user, um, that will dump into the authentication token and it will be used by the service provider in order to take, uh, both authentication and authorization, um, decisions. But the most important thing is the signature. If we don't sign the token, uh, anyone can change anything, can basically tamper with the token and just become anyone for the service provider. So, uh, we found that for us, the most interesting, um, a step in this process was when the service provider is accepting the authentication token. And the reason for that is that, uh, we thought about these two, uh, potential attack vectors, right? The first one is that there is a bunch of attributes in this token that, um, are going to be parsed and processed before the signature is, um, verified. Like for example, what is the, uh, signature algorithm, uh, that is going to be parsed before the signature is verified. So maybe we can, uh, have some injection vulnerabilities there. And the second, uh, the second vector is if we can go a step further, maybe we can go and, and get, um, the signature, the whole signature, uh, verification process bypassed. If we can do that, we can, uh, basically just become anyone for the service provider. So we will start with the token parsing one. This case can be good illustration for token parsing vulnerabilities. Uh, JSON web token or just GWT token, uh, is internet standard for creation, uh, JSON based access tokens. We can see example of such token on the screen. Uh, it contains three main parts, uh, payload, header, and signature. ILJ field from header defines what algorithm should be used for signature verification. So it will be used before signature verification itself. Uh, in .NET, there are couple of, uh, libraries that, uh, can parse GWT tokens. Uh, we find out the system indenting model token GWT library passes ILJ field to the crypto config create for name method. This method doesn't restrict type names. So we can call arbitrary, uh, no argument public constructor. By the way, GWT is not only one way to, to, to, to this method, uh, it can be reached during some token parsing as well. For example, algorithm attribute in signature method, uh, element from some token will go without any restriction to that method as well. But you can ask what we can do with this because we cannot control any data. But actually we can control some data. First of all, it's type name itself. And we will show a bit later how we can use it. Uh, also please look on the screen. It is example of, uh, no argument constructor from .NET framework. In .NET, uh, current HTTP context, it starts in static property and access to, uh, request parameters is done through it. If, uh, no argument constructor use this approach, it will be very interesting for, for an attacker. But all these ideas about abusing no argument methods may look not very realistic. So we took two servers from Microsoft, Sharia point and exchange server and tried to exploit this, uh, problem there. And here is our results. Sharia point returned us different, uh, response if, uh, object was created or not. Using this, we can get informational installed products and even their versions. Also, we could rise and had an exception that leads to, uh, Daniel of service. Exchange server gave us even more interesting results. Uh, as we already mentioned, we can control type name. And it, it can be not just simple type name, but assembly qualified name with name of assembly from which we would like to, uh, load this, uh, type. Uh, .NET allows, uh, developers to control assembly loading by implementing own, uh, custom assembly resolvers that may be vulnerable to different attacks. Uh, also, often this, uh, custom assembly resolvers are installed by static constructors. And usually it's not big problem to invoke them by instantiation of some specific type. But actually this problem allows us to do this, uh, so it's not problem. Uh, here we can see an example of such, uh, gadget from, uh, exchange server. On first, code snippet, we can see that how it is installed by static constructor. On the second snippet is assembly resolver itself. Assembly name, it doesn't have any validation and used as part of path for daily loading. We can use ..trick and can change, uh, current folder to any what we want. Uh, let's put all this together. As un-tatificated user, we can invoke, uh, no, no argument public constructor from any . . . file on the exchange server from arbitrary local folder. Of course, uh, attackers still need to find way how upload this malicious . . . file to the server. And for un-tatificated users, we think it can be very tough task. But if, uh, attacker has any account in target exchange server, it may be significantly easier. So for our demo, we have an assumption that attacker is already put this . . . file to the windows temp folder. This folder used for temporary files. For example, during, uh, un- zipping archives or others, uh, other such cases. Uh, so let's look how, how it will be in real exchange server. So first of all, it's our, uh, malicious library. Here is our gadget with two lines, uh, very helpful. We will take CMD query parameter and we'll use it as its value for starting new process. Uh, as we told you earlier, we already have this . . . file in windows temp folder. Now we can start crafting our payload. Uh, we will use, uh, some token. Here is our vulnerable attribute. Type name. And assembly name is . . trick that points to our library in windows temp folder. Uh, we will start calculator. And here is the same calculator. Uh, let's check in process explorer that there are no calculator yet. And we can send this request without any notification. And we can see calculator. We would like to stress here a couple things. First of all, it is pre un-tatificated attacks. Also, despite that this attack vary depends on available gadgets on the target system. This problem is not in product on application like exchange server or share point. This problem in .net framework, how it works with some attributes from un-tatificat- un-tatification tokens like SAML and GWT. Uh, let's switch to our holy grail and let's look how we can bypass the whole un-tatification. Security assertion markup language or just SAML is critical component for many delegated un-tatification and single sign on un-tat- un-tatification scenarios. It has XML based format and uses XML signature for integrity protection. By the way, this problem is not, is relevant not only in SAML but in any other places in .net where XML signatures use like, uh, sign it SOAP or WS security. Here we can see simplified SAML token. Along with un-tatification information, it has signature element that should, uh, protected from tampering. Uh, this element contain three main parts. Signature value, uh, this signature itself, uh, sign it in for with information how this value should be ver- verified and the most interesting element for our attack is key info. Represents key that should be used for this signature verification. Uh, let's review how .net will verify signature, signature for such tokens. First of all we need to obtain the key. Using key info we will extract, we may extract key from itself or using key reference and fetch key from some specific storage. On the second step, we will use this key for signature value verification. But please note that, uh, positive results after this step only means that, uh, this token was signed by this specific key and was not changed. In addition to this, we need to be sure that it was done by proper sign in party. So we are taking key info element again and try to identify who was signing this token. And of course the last step, we will check it as trusted sign in party or not. On the first glance it may looks like quite good implementation, but let's pay attention on these two steps. We are processing key info element twice. And we need different type of results on these steps. Security key and security token. So two different methods will be called. Result security key and result security token. Uh, on this diagram we can see general idea of our attack. We need to craft key info in such way that mentioned methods will produce different results. One will be used for signature verification and other for authentication of sign in party. In this case we will be able to use own key for signature calculation but server will still identify us as signed, um, trusted sign in party. Uh, in general, uh, this attack depends on implementation of a result security key and the result security token. But all cases what we checked we were able to achieve these results. Uh, some cases had additional requirements to the server or environment, uh, target server or environment. Uh, other were vulnerable by default. Uh, here are a couple examples of differences between these two methods that can be abused. Uh, first method may support some type of key identifier that is not supported by the second. Or both method can, uh, can process element in a different order. Or even they can use different subset of elements from key info. Uh, now let's review how this problem looks in real applications and frameworks. So, um, we will review now, uh, the main Microsoft frameworks that actually accept some of the tokens or treat some of the tokens in some way. So the, the first one is, uh, WCF, Windows Communication Foundation that is used to build web services. Uh, for example, Exchange Server, uh, or Exchange Web, uh, web services are built using WCF. And then the other one that is, uh, probably the, the two principal frameworks is Windows Identity Foundation, which is used by any application. Um, I mean, if you are a developer and you're writing an application that want to integrate with an identity provider, instead of, um, reinventing the wheel and, uh, write the whole code to process the authentication tokens and then extract claims and process the claims and so on, you will use, uh, Windows Identity Foundation to do that for you, right? So the third case is when you use, uh, WC, WIF with a custom, uh, configuration that is also normal in some, uh, development environment and we will, uh, use the SharePoint as an example. So we will start with, uh, Windows Communication Foundation that as, as I said, is a Microsoft framework to build, um, basically web services, right? So what matters to us, what is important to us is that, uh, WCF web services accept some of the tokens for authentication of the client. So if you're a client, you can present a some of the tokens instead of your user and password credentials, for example. So XML Signature is also used for other things or their purposes, such as proof tokens, but, uh, this is out of the scope of this talk. So, uh, this is the, uh, main code in the SAML assertion type that, uh, handles the, um, processes the SAML token, right? As you can see we have two methods. One is resolve security key and the other one is resolve security token. Both of them are taking the key identifier parameter, which is basically the whole text within the key info section in the XML Signature. The first one is returning a verification key, which will be used for signature verification. And the other one is returning a signing token that is basically representing the, um, signing party or the identity provider. So, the first one, uh, will first iterate through all the elements in the key info section. And for each of these elements, I will call the try resolve security key that will basically try a number of, uh, token resolvers. Like try resolve security key from the token resolver, then the, the parent class and then if everything fails, it will try to try create key from intrinsic key close. So, it's first iterating through all the key elements in the key info section and then for each, uh, key element is iterating through all the resolvers. That's what we call a depth first. So, when resolving the security or, or the signing token, um, the approach is slightly different. So, it will iterate first through all the resolvers and then for each resolver, it will, it will try all the different key elements or the keys identifiers. So, the difference is very small. Basically, the order in which all the possible combinations between keys and, and resolves, and resolvers are visited is different. But since we depend on one of them to be successful and return from these methods, uh, the order is critical. So, what we, uh, are going to do to attack or to bypass, um, SAML token, uh, uh, signature verification is that we are going to take an existing token or we can even create one token from scratch and then we are going to sign it. But in order to sign it, we are going to use our own private RSA key. So, we are going to generate, uh, an RSA keeper and we are going to use the private one to sign the token. Then, uh, we are going to send both the public key for this RSA keeper and also the, uh, identity provider certificate or key identifier. So, that's what you can see in the key info section. Now, remember the, uh, resolve security key will iterate first through all the keys in the key info section. So, it will take the attacker RSA key first and then it will try all the different resolvers. So, for the two first resolvers, it will fail. But the third one will succeed and will return the public RSA key. Since we signed the token with our private RSA key, the signature verification will bypass and it will be successful. Now, uh, for the resolution of the security token, it will start iterating through all the resolvers. So, it will take the first resolver and this resolver will try all the different keys. So, for the first one, it will fail because it does not know how to resolve at the attacker RSA key. But the second one is the expected identity provider certificate. So, that will succeed and then it will return the expected 509 certificate or whatever the identity provider is sending. So, with that we will bypass the authentication of the assigning party and then the whole verification process will be successful. So, this is how it looks in the XML section of the XML signature. The first element in yellow is the key that we injected and the key that we used to sign or resign the token. In this case, we are using an RSA key value with a, well the public one. Uh, but we can also use for example, symmetric key or even other asymmetric keys such as elliptic curve and so on. And then in green, we have whatever the identity provider is using. Normally it's a 509 certificate. This is a public certificate that we can grab from the, uh, federated, uh, metadata endpoint for example or from any existing token. So, let's see that in action. What we are going to do is we are going to, um, access exchange web services as any arbitrary user. So, we are going to impersonate any user. So, um, please bear in mind that the attacker doesn't need to intercept anything. He can craft the token from scratch because all the information he needs is public. Then he will send that token for authentication in the, um, exchange web services and then it can query the web services for retrieving emails, uh, sending emails or doing basically whatever anything you can do from, from outlook. But for this, uh, for this, um, demo, we are going to use, uh, valid, a real client. Well, we are developing our own client, but a real, um, token and then the attacker will be intercepting his own token so you can see the process of, uh, how the token looks like and, and what happens if we modify it. Okay, so, um, this is not what I'm looking for. So this is verb. We will be using verb to intercept the client request. And as a client we are using basically our own client that is sending or requesting the mail tips for the user one. So the attacker has this user one account and, uh, is trying to access its mail tips. Now if we send this request, um, we will intercept that with verb. Then we will send it to repeater to modify it more, more easily. And if we switch to the XML version, you will see that, well, we have first the, the sample token that identifies the user and then the, the body of the SOP request. So we are going to replace any, every instances of user one with administrator. In order to try to impersonate the administrator. Now if we send this, um, this request because the content has changed and the signature is no longer matching, uh, the server should reject this request. It's no longer valid because it's not signed and we are not supposed to have the private key for the identity provider. So we get an error and this is expected, right? You should, you should not be able to tamper any existing token. Now we can use our, uh, Jup key injector, uh, verb plugin, uh, that is going to resign the token using an RSA key. So as you can see here, uh, the original token has this, um, identity provider certificate. Now if we click on resign with RSA key, it will basically generate an RSA key pair, use the private one to resign the token and use the public one in the key info section. So in the key info section now we have the expected identity provider certificate, prepended by the key that we use to resign the token. Now if we send that, we will get a 200 successful response. In this case we are, uh, requesting the mail tips for the administrator but this is just an example. We can ask, uh, for any, uh, mail items, uh, sending, sending emails or whatever. Now let's, now let's review another, uh, .NET framework, Windows Identity Foundation or just, uh, WIF is software framework for building identity aware applications and it's very easy to add, uh, delegated identification for you, for your, uh, application and support identification token from, uh, different, uh, secret, uh, security token services like, uh, Active Directory Federation services, uh, Azure Active Directory or Windows, Azure, uh, access control services or others. WIF uses SAML security token handler for, uh, SAML token parsing and it, uh, uses a bit different, uh, way, uh, to work with key info section that we just saw in, in, in, in the previous section. Uh, during token parsing, when he tries to get security key for, uh, signature verification, it takes only the first element from key info. But for security token, it will process all elements, um, from this key info section. Also by default, uh, it uses issure token resolve that seems to be secure because, uh, code in both methods are very similar. But if they, this method cannot resolve some key in the defile, they, it will be passed to the next resolver. X509 certificate stored token resolver and this one has differences in, in, in these two methods. Result security key, uh, uh, can work with encrypted symmetric keys, but results, results security token doesn't support it. Uh, definitely this can be exploited, but there are couple problems with this scenario. Uh, server needs to decrypt our symmetric key. To do this, it should have, uh, certificate with private key in some specific, uh, certificate storage. By default configuration, it's a local machine trusted people. Also, um, attacker would need to use public key of this certificate for encryption. Um, but note, it just public key. In many cases, it's not problem. And if these two requirements are met, we are still able to, uh, perform our attack. We can use our symmetric key for, uh, signature calculation. After that, we will encrypt it by public key from server certificate and we'll put encrypted key in, on the first place. After that, we append expected certificate. So, on the server, result security key will return our symmetric key and we will pass signature verification. But result security token will skip this, uh, this element because it cannot work with it. And we'll take the second one that represents expected sign in party. So, we will be on, uh, on certificate uh, sign in party. Here we can see example of key info for such attack. Uh, our encrypted key in, uh, cipher data. Uh, internal key info in yellow section represents, uh, uh, server certificate which public key was used for encryption. And the similar as, uh, in previous, uh, uh, our example. In green section, we have, uh, certificate of trusted sign in party. Uh, we were reviewing default configuration of WIF. But it allows a lot of customization. So, let's look on one of example of customized, uh, WIF. So, one of the most interesting targets for us was SharePoint. And it's actually using, um, WIF, um, Windows Identity Foundation. But it's customizing this process, right? Um, so you can customize it in multiple ways. Like for example, changing the default certificate store as Alex mentioned before. Or a different way of customizing WIF is using a custom resolver. Um, so maybe you have some special needs and you have to, uh, process authentication tokens in a different way. So, that's exactly what SharePoint does. And it uses this SP user token resolver. And it's, uh, regular token resolver but the key resolution, uh, supports intrinsic keys such as symmetric or asymmetric keys. And token, token resolution does not support them. So we are back in the scenario of, uh, WCF where we don't need, we don't have any limitations about getting access to public keys and certificates from the server side. And we can just basically use our own symmetric key to resign the, um, the token and then include both the symmetric key and the expected identity provider certificate. Because of this difference in the resolution, uh, each method will return a different element. And the first one will be used for signature verification. The other one will be used for authentication of the signing party. So in this case, we are using a symmetric key. We can also use the RSA one that we saw before. But in this case, we're using binary secret that is, uh, basically the way of specifying a symmetric key in a token. As you can see here, there is no encryption. So there is no need to send the public key for, that was used for, uh, for encryption. And it's just sent in the room. Uh, in green section we have the expected identity provider, um, certificate. So we were like, wait, uh, we can bypass SharePoint authentication both on premises and on Office 365, which is pretty cool. But then when we tried to actually, uh, break into SharePoint, we realized that we were not able because the SharePoint authentication flow is a little bit special. So the user will get an authentication token from the identity provider. And we'll present this authentication token to SharePoint. SharePoint will validate this token by using the SharePoint user resolver that we just saw, which is vulnerable. So, so far so good. We can bypass the signature, uh, verification of this process. But then SharePoint doesn't know what to do with a SAML token. So it will exchange this SAML token, uh, in the SharePoint, uh, security token services that, which is an internal web service of SharePoint. And then it will try to get a session token in, in exchange. So this, uh, SharePoint, uh, security token service, it's using a different, it's a web service, uh, using WCF, but using WIF for processing the authentication token. So it's using the default, um, WIF token resolver, which, uh, depends on the attacker being able to get access to the, uh, this certificate. So this whole, whole process was getting a little bit complicated because also the attacker needs to craft the key info section in such way that it bypasses the signature verification for both, um, token, uh, validations. So it was kind of complex. So we found a different way of attacking SharePoint by abusing the step number six, which is where the session token gets into the cache. So, um, we are going to, what we are going to do is basically we are going to authenticate as, um, as the attacker as a, maybe a low privilege account. So this is a privileged escalation, maybe a remote execution vulnerability. So we get authenticated as the attacker account, uh, following the default, um, authentication flow. There is no attack here, no, no Jupyter confusion, nothing. But the attacker session token will get cached, right? Now, uh, what we are going to do is we are going to craft a special token. And it's special because it contains some special, um, claims and attributes in the SAML token. So first of all, the issuer will be SharePoint instead of the identity provider. Second, we will be using the victim or the user that we want to impersonate, uh, attributes as for example, the UPN, the user principal name claims. But we will still use the attacker identifier for the, uh, cache key, right? For the, the cache, um, reference. So SharePoint will receive our token, will validate using the SharePoint token resolver, which is vulnerable, we can bypass that. But since the token is issued by SharePoint, it will not try to exchange with the local, uh, security token services. It will just generate a session token from the data in our token. So it's going to create a session token for the victim, right? But it's, uh, going to try to, uh, cache the token and it's going to use the key for the cache that we send. So that's the attacker cache key. So with that, we will be able to poison the cache and replace the attacker session token with the victim session token. So now, now the attacker only has to login to, not login, but refresh the browser and then we are going to cut to, uh, retrieve the victim token from the cache, from the attacker cache. So let's see that in action, maybe it's more clear. So we are going to login into SharePoint. Uh, in this case we're using ADFS to, for, as the identity provider, but could be Azure Active Directory or any identity provider. And we are logging as the attacker. So maybe a low privilege account, uh, maybe we want to impersonate another user or maybe we want to become administrator to get remote code execution. So we are the attacker so far, so good, no attack yet. So now we are going to use, uh, we are going to visit this API URL that will get us a list of existing users in SharePoint. So, um, the purpose here is to collect information to craft this malicious token, right? So, we will search for the attacker internal ID in this XML. And this is, um, the attacker internal ID. We will need that to craft the, the malicious token. But this is public information, you can just query the, the write API. Now we will search for the victim internal ID. Very similar. And now we will use, um, some script basically to craft our malicious token. So for the malicious token we are going to use all the claims that represents the, the victim. So the victim internal ID, the victim email address, but for the application token cache key that is a special claim, we will be using the attacker one. So now if we generate the token, first of all we will have, uh, our key info section with the dupe key confusion. So first of all the RSA key that we use to sign the token and then whatever the key, the SharePoint identity provider or ADFS in this case was using. And then if we scroll up, we will see the, the claims in the SAML token. So for example we have, uh, the user ID that is pointing to the victim. So it's the internal victim ID. But this special application token cache key will be the attacker one. And this is the one that will be used to reference the cache entry that is going to be, um, poison or replaced. So we send that, uh, all we have to do now is go back to the browser, refresh the session and basically get authenticated as the victim. So remember if we impersonate administrator, this is basically remote code execution and SharePoint on premise and, and cloud versions. Thank you. So with that, and just to wrap up, uh, so first of all we are not saying that SAML or WS federation are insecure protocol. The, the devil is in the implementation in the details. In this case dot net was vulnerable because it's actually processing the same user control data with two different methods, uh, that has some small inconsistency. So if you are a code reviewer, you may always want to, um, review this kind of scenarios where you have two methods, two different parsers processing the same user control, uh, control data. Also we focus our research in dot net, um, we don't expect this very same flow to exist in other languages or, or libraries because it's very specific to dot net because of the way that they extract the key in one process in one step and then the token in a different step. But there may be similar vulnerabilities in other languages and libraries. Um, also, um, XML signature is not only used for SAML assertion. Uh, remember this is a vulnerability in XML signature. It's not a vulnerability in SAML. So we found different cases where dot net framework was using XML signature that we reported to Microsoft and are patched now. But there may be other cases where XML signature is used maybe in, in customer, in, um, people applications that are still vulnerable. And last but not least, patch as soon as possible because the cloud version have been passed but on premises like SharePoint Exchange or any WIF application are still vulnerable. And if, um, so, uh, go on to the, uh, Microsoft security bulletin because there are some specific instructions on how to upgrade for example on how to patch SharePoint, right? So it's not straightforward. And if you are a patching SharePoint, you have to update SharePoint version but also update some library version is not, not easy. So with that, uh, we are releasing a bird plugin, um, the one that I showed you in the first demo. Uh, it's basically a plugin that allows you to intercept SAML tokens, uh, SAML request and then resign them either using another key or using, uh, the public key from a certificate if you can get access to that for the WIF, um, scenario. So with that, if you have any questions or you can take them now or maybe later. Ah, we published a white paper with all the details. It's hosted in the Black Hat server. So just go and, and take it from there. So, no questions. Thank you.