Income tax 2023-2024, self-employment tax, otherwise known as SE tax. Get ready and some coffee, because tax season is when we test out our math skills. Question our life choices. Most of this information can be found in Publication 334, Tax Guide for Small Business for In- First, a word from our sponsor. Yeah, actually we're sponsoring ourselves on this one, because apparently the merchandisers, they don't want to be seen with us.  Like our, trust me, I'm an accountant product line.  Because apparently we're among the only ones equipped with the number crunching skills to answer society's current deep complex and nuanced questions. Looking at the individual income tax formula, remember in the first half of the income tax formula is basically a funny income statement. Most income statements having income minus expenses resulting in net income, here having income minus various deductions resulting in taxable income. The schedule C then rolling into line one of our income tax formula, which is a little confusing considering the schedule C itself is basically an income statement. Having business income minus business expenses, otherwise known as business deductions resulting in net business income from the schedule C that rolls into line one income of our individual income tax formula. This is the first page of the form 1040 where ultimately the schedule C income will roll into line eight additional income from schedule one. This is the schedule one additional income and adjustments the schedule C income rolling into the additional income part line three business income or loss from the schedule C. This is the schedule C profit or loss from business having mainly two main parts income minus expenses looking like an income statement. We're now concerned with the self employment tax otherwise known as SE tax noting that when we think about income when we think about taxes for the federal government, the primary way we fund the federal government to pay for things we need such as military and what not protecting us is through the income tax. But there are other taxes as well, which we often label under the term of payroll taxes, the social security and Medicare taxes. But if we're a sole proprietor, then we are going to have to be responsible not only for the federal income tax, but for what would be the payroll taxes, the social security and Medicare taxes. This is crucially important because many people overlook this when they move from a W to employee situation to a sole proprietorship situation in part, because although in a W to situation there's withholdings and payments of the social security and Medicare as well as the federal income taxes, and it is reported to us on pay stubs as employees and with the form of a W to reported to us and the government. When we do our form 1040 income tax return, those calculations for social security and Medicare don't usually have a big impact. So we're usually looking for a refund, hopefully, which is a focus on the federal income taxes. But when we're on a schedule C and have to calculate our own payments and our own taxes, then the self employment tax, which is kind of like the sole proprietor equivalent of payroll taxes, social security and Medicare is huge that we have to kind of keep in mind. Okay, so self employment tax is a social security and Medicare tax primary for individuals who work for themselves. Those that report say on a schedule C, for example, and you also have some complications in terms of other types of business entities to determine how self employment, social security and Medicare will be reported. For example, flow through entities like an S corporation partnership and an LLC, how are the payroll taxes, how are social security and Medicare going to be reported. We here focus mainly on a schedule C. It is similar to the social security and Medicare from taxes withheld from pay of most wage earners. Now, it's useful to kind of think of the comparison because lawmakers, the legislation when they're making the law often kind of forget about the sole proprietors as they focus on the large corporations. And then they have to kind of mirror the sole proprietors to what they decided for the corporations. Therefore, it's useful for us to think about the comparison of a C corporation, a separate legal entity, how they deal with social security and Medicare and how a sole proprietor does deal with social security and Medicare because that can help us to understand the rationale of what is going on. So note, with a C corporation, it's a separate legal entity, which means it's going to pay federal income taxes on the corporate level as a C corporation. It's owned by shareholders, everybody that works within the C corporation up to the highest executives, the CEOs and so on and so forth, are going to be employees. So they're going to be getting W2s, which will then have the payroll calculations withholding things like the payroll taxes, social security and Medicare and paying the employer part of payroll taxes on the corporation's side. So how does that match what happens on a schedule C? On a schedule C, we might not even have any employees. Imagine the simplest situation where you don't have employees, you could have employees for a schedule C, but let's imagine that we don't. Well, then we're going to have an income statement that is income minus expenses results in the net income and that's going to be reported on our form 1040. The IRS is going to say, hey, wait a second, we would like someone to be paying social security and Medicare in that situation. So then what are we going to do? What do you want me to do? Because I'm not a corporation. Do I have to actually pay myself wages? Because that's a pain to do. The IRS, in order to calculate payroll taxes, will know, typically the IRS is going to say, what I want to do is say that you are basically the employee of your sole proprietorship corporation and therefore we're just going to take the net income that you calculated on your schedule C and then calculate, in essence, payroll taxes on that net income. Not only that though, we're going to think of you as both the employee E and employer, so you're going to pay both, both halves of the tax on the net income that you earned. So that's going to be the general idea. You might say, hey, wait, there's net income in a corporation. What happens on the corporate side of things? Well, they do have net income. They have income minus the expenses. Part of those expenses are the wages and payroll taxes they pay even to their top executives and then the net income doesn't go to one person. It's part of the corporate earnings, which then will be distributed to the individuals and that distribution is called dividends. So then when the dividends happen, then you might have another income tax situation and that's why we get a double taxation with regards to income taxes because you get tax at the corporate level and then possibly on the distribution level, which is what is often trying to be avoided with some kind of flow through entities such as S corporations and LLCs. All right. That's the general outline. So caution, if you earned income as a statutory employee, you do not pay self employment tax on that income. Social security and Medicare taxes should have already been withheld from those earnings. So note that usually if you're an employee, you don't get to deduct things on the schedule C because the idea is that the employer is deducting those items and so on. But we saw that in some cases, for example, if you're a statutory employee, you might still have the schedule C and which case if you have the schedule C, you would think you would be calculating the self employment tax, but no, because you might still be having those paid through the employer in that special kind of situation. Social security coverage. Social security benefits are available to self employed persons just as they are to wage earners. Now, I just want to note the tone here that you're always going to hear whenever talking with the IRS. The IRS is going to take the standpoint of well, yeah, self employed people are paying into social security. That's a good thing. We're allowing them to pay into the social security. And why would they make that argument? Well, because by paying into social security, you're going to get the social security benefits at the point of retirement. Remembering that we in the United States have a question as to whether or not social security is like a federally funded like 401K plan, like a retirement plan that everybody should pay into and the government pays everybody out based on how much they put in. Or should we have something like a safety net program allowing people to say for their own retirement, but giving a safety net for those that can't say for retirement. So more and more social security has leaned towards like a federal funded, you know, 401K plan or something like that. And it's kind of going bankrupt. So most people I would think you wouldn't want to completely depend on if you don't have to social security as your sole source of income at the point of retirement. So obviously in practice, what we have to be thinking is practically in terms of there's two parts to social security. When we talk about social security, there's the amount that we have to put in when we're working. And there's the amount that we get back at the point of retirement. When we put the money in, the question is, is there any way we can avoid putting money in legally? If you can, I would say that's usually the good thing to do because then you can say for your own retirement much more efficiently than the government most likely. And then when you get the money out of retirement, the question is, do I have to include it in income paying income taxes on the benefits that we're going to be basically getting in retirement? So your payments of self employment tax contribute to your coverage under the Social Security Administration. So again, the argument from the IRS side is the more money you put in, the more you're going to get out of that beautiful like 401K type program or whatever. But obviously, again, it's kind of a mess because the more money you put in, it does increase the amount of benefits that you will get back. But the amount of increase in benefits goes down at a decreasing rate because they're also trying to use it as a safety net program to basically pay out larger amounts to lower income individuals. So that's why it's kind of a mess. So again, the idea would be, I would think, to try to save for your own retirement and reduce the amount you're putting into the Social Security and give it to other things if possible would be the general strategy usually. So Social Security coverage provides you with retirement benefits, disability benefits, survivor benefits, and hospital insurance benefits at quite a high cost. Because I could pay for those myself with all the money, I mean calculate all the money that's coming out of your wages at one of these days. Anyway, how to become insured under Social Security. So you must insure under Social Security system before you begin receiving Social Security benefits. So obviously the benefits happen at the point of retirement. How do you get the benefits? Well, you're going to be putting money in during working years. And again, it's kind of sounding like it's voluntary right now, but it's not voluntary. You mandatory put the money in and then you're going to get some benefits if you qualify for them at the point in time of retirement. So you are insured if you have required number of credits, also called quarters of coverage discussed next. So earning credits in 2023-2024. So for 2023, you receive one credit up to maximum of four credits for each $1,640, $1,730 for 2024 of income subject to Social Security tax therefore for 2023. If you had income self-employment wages of $6,560 that was subject to Social Security tax, you received four credits. Now this is getting a little bit wonky in terms of the calculations for Social Security. And again, from a simple standpoint, the simple strategy would most likely be, look, I'm going to try to pay as little into Social Security as I'm required to pay just like I would for federal income taxes. I'm going to pay the least that I'm obligated to pay under the law, even though in this case I'm going to get benefits based on the more I put in, because I'm of the standpoint that I would be better off putting my own money away for my own retirement and not relying on Social Security in part because we're really not fiscally sound from a federal standpoint and Social Security is a huge driving factor that's causing that problem. So if we don't redirect that ourselves, we're going to hit a wall at some point in time and whatever happens when that happens, you know, can't be good, right? Well, so I don't depend on the Social Security. But with these calculations, some tax planning strategies could come into play. We saw before that we might have a situation where we have a Schedule C and we might have like two people that are married, but the Schedule C is owned by one person. But maybe two people, if two people start working in the Schedule C, you might say, hey, look, one person wasn't making wages because they were a homemaker. Maybe if we were allowed to have them work for the business, they can put some money into Social Security so that we're still paying the Social Security on the income, but now because the Social Security is assigned to two different Social Security numbers, two different people, you might be able to get greater benefits at retirement. So that's the kind of planning that could come into place. Again, you have to be quite careful with that kind of planning, making sure that it's legitimate splitting of the profits and so on. So it's a legitimate strategy and so that you don't hit the cap. Because remember, if you make a high amount of income and you split the amount that goes to two people instead of one, then you might clear the cap ending up paying more money into Social Security, which I don't think might not be worth the added benefits that you're going to get from Social Security at the point of retirement. Okay, anyway, for an explanation of the number of credits you must have to be insured and the benefits available to you and your family under Social Security program, consult your nearest SSA office, Social Security Administration office. It's useful to note here as well that although these are both federal programs as opposed to state and their government programs, the IRS is different than the Social Security Administration. We're going to be reporting the calculation of our self-employment tax on the Form 1040, which we're basically sending to the IRS, but when we think about the benefits that we're going to be receiving, we're typically looking at the Social Security Administration, the SSA. So the SSA Social Security Administration time limit for posting self-employment income. Generally, the SSA Social Security Administration will give you credit only for self-employment income reported on a tax return filed within three years, three months and 15 days after the tax year you earned the income. So there's kind of like we might call a statute of limitations that's typically quite a long enough time because usually we file by April 15th following the year that we earned the income. So if you file your tax return or report a change in your self-employment income after this time limit, the SSA may change its record but only to remove or reduce the amount. The SSA will not change its records to increase your self-employment income. So who must pay self-employment tax? S-E tax. You must pay S-E tax and file schedule S-E Form 1040 if either of the following applies. Your net earnings from self-employment including church employee income were more than $400. So we're typically looking at the Schedule C type of business because when we think about self-employment income, that's the main thing we think about and that's our point of focus, which means you would be filing a Schedule C, which is basically an income statement. If you had income minus expenses on the Schedule C over $400, that would be attributable to you. The IRS basically thinking of you as having like net income similar to W-2 income, but both employee or employee portions allocated to you and then you'd have to file that Schedule S-E for the self-employment tax. You have church employee income of $108.28 or more. That's kind of a funny number. Why do those funny numbers come up? Because they came up a long time in the tax code and they never updated the tax code so they just had this wonky kind of low ball limit and now it looks kind of ridiculous. It's kind of funny to see some of those numbers that come up. They're almost irrelevant like $108.28, really. So in any case, so S-E tax rate, let's do a quick comparison of these numbers to numbers that you might be more familiar with as a W-2 employee. So in other words, the Social Security, if you were a W-2 employee, would be 12.4 divided by 2 or 6.2% because that would be your half as the employee. The employer would be paying, in essence, the other half and the Medicare. You can see here is the 2.9. If I divide that by 2, it's going to be the 1.45. That's how much would be on like your W-2 as kind of a flat tax generally. Remembering that the Social Security does have a cap that if you go over that, you don't pay more than what is on the cap. So it was 1.45 plus 6.2 gives us that times 2, and that's where they're coming up with this 15.3%. So remember, you have a schedule C. The bottom line of the schedule C income minus expenses is what the IRS sees as your wages, in essence. They also see you as both the employee and employer. Therefore, you're paying both the employee and employer portion of self-employment tax, Social Security and Medicare, on the net income. That's the idea. Now, it's not perfectly that amount. The actual form is a little bit different, more complex in the calculation, which we might talk about in a future presentation. So maximum earnings subject to self-employment tax. So only the first 160,200 of your combined wages, tips, and net earnings in 2023 is subject to any combination of the 12.4% Social Security part of the self-employment tax, Social Security tax, or the tier one part of railroad retirement. So in other words, Social Security, we just said the total tax rate is the 15.3%, but it's not that simple because we have to break it out between the 12.4%, which is allocated to Social Security versus the 2.9, allocated to Medicare. Note that the Medicare tax is much smaller and Medicare is more appropriate to me. It seems more correct in that it looks like it's structured more like a safety net program, as opposed to a government-wide retirement program, whereas the 12.4% Social Security is a pretty large amount of tax that is funding everybody that might get benefits from the program instead of having a safety net type of program. So because the Social Security, we're thinking of it now as a retirement program for everyone, like a government 401k program, then there's a cap on it. So in other words, if you pay more, if you have more income than 160,200, you no longer pay any amount above that into Social Security. And that means the Social Security or self-employment tax calculation is a little bit complicated if your amount is above that because you have to break out the Social Security versus the Medicare and then apply the cap to the Social Security. You can see this on W-2s, by the way, if you were an employee in that the wage boxes, box one, three, and five, might differ if you had income over 160,200, box one possibly being higher wages for federal income taxes than box three, which would be capped at 160,200. Why would they do that? Because if you think of it as a retirement program, then if you pay more money into it, you should get more of a benefit out at the point of retirement. But over a certain threshold, you don't get any more benefit because they also think of it as a welfare kind of benefit program where your benefits actually go down as you pay more into the system and after you clear a certain point, you no longer get any more benefit. So that's why there's kind of a cap in there and that's one of the things that people are often going to argue over in terms of tax code. What should be the cap? Should there be a cap? And so on and so forth. So that's the idea with the cap. Now also realize that you could have complex situations meaning if your net income on Schedule C is over 160,200 then you're only going to pay Social Security up to that 160,200. But what if you also had W-2 income and it's applied to the same Social Security number and the combination of the two of them is over 160,000? Why is that complex? Well, because you should only have 160,200 to every Social Security number and the W-2 wages, you only paid 6.2% half your employee half whereas this amount on the Schedule C, you'd be paying twice that because you're paying both the employee and employer portion. So tax software can be helpful with those types of calculations as well. In the case. So all your combined wages, tips and net earnings in 2023 are subject to any combination of the 2.9% Medicare part of self-employment tax, Medicare tax and Medicare part of railroad retirement tax. If wages and tips you receive as an employee are subject to either Social Security tax or the tier one of railroad retirement tax or both and total at least $160,200 due to do not pay the 12.4% Social Security part of the SE tax on any of your net earnings. However, you must pay the 2.9% Medicare part of the SE tax on all your net earnings. So now that's the situation where you have W-2 income that's also subject to self-employment but you're paying only the half versus also having Schedule C income, right? So tip, deduct one half of your SE self-employment tax as an adjustment to income on line 15. So here's another one that we will see this will become more clear when we get to the tax software, tax software helps with these calculations but it's useful to compare this concept to the similar situation in a Schedule C business where the Schedule C is a separate legal entity paying taxes on the business or corporate level. If you were a Schedule C business, everybody that works for it highest executives are still going to get that W-2 and they are going to pay their half of the self-employment tax as far as a deduction for the Schedule C that will be shown as wages, right? It'll be part of their wages which they paid but we as the corporation had to actually take it out of their check and pay it to the government on their behalf. We still get to deduct the whole thing as wages. Then we have to pay as the corporation our half of the self-employment tax as well but we at least get a deduction for that. We deduct that as payroll tax expense. So if we're on our side now we're saying well what happens on the Schedule C if you're saying that the net income on the Schedule C income minus expenses is subject to both employer and employee taxes then I should get a deduction for the employer part of the taxes just like because you're trying to mirror the same thing that would happen on a separate entity like a Schedule C. So it's like okay that makes sense so they're going to let you deduct that but I can't deduct it on the Schedule C because I had to calculate income minus expenses to get to net income to then calculate what the tax was in the first place. Therefore that half of the self-employment tax is an above the line deduction or adjustment to income deduction on the Schedule 1. So we'll see that later. Additional Medicare tax. So there's a 0.9% additional Medicare tax may apply to you if your net earnings from self-employment exceed one of the following threshold amounts based on your filing status. So Medicare seems more like a safety net type of program to help people that need it whereas Social Security seems like it's leaning more towards a federal government funded retirement program. And so the Medicare so that means the Social Security we saw had a cap you no longer pay into it whereas the Medicare actually goes up as your income goes up. You might have to pay another 0.9% additional Medicare tax which is like another layer of a typical progressive tax kind of move on that one. So married filing jointly if it's over 250,000 so this of course now it's a progressive tax. This kind of makes sense because it's a safety net program but anytime you add a progressive level to the tax it does greatly complicate the tax calculation and planning situation. So married filing jointly 250,000 married filing separately 125,000 single head of household or qualifying surviving spouse 200,000 so tax software can of course help greatly in those calculations. So if you have both wages and self-employment income the threshold amount for applying the additional Medicare tax on the self-employment income is reduced but not below zero by the amount of wages subject to additional Medicare tax use form 8959 additional Medicare tax to figure this tax. So again if the Schedule C is your only source of income then you can apply this rule it's fairly straightforward but if you had W-2 income where you're also paying into Social Security and Medicare and you have a Schedule C business then you can see how these kind of caps and progressive systems will get a little bit more complicated because you're calculating them on two different areas and applying two different methods for the W-2 payroll tax versus the self-employment tax. Alright, so here's a table. So which form must I file? So if you are liable for income tax then use the 1040 or 1040 SR the Schedule C do the Dubai 15th of the fourth month after end of tax year self-employment tax then use the Schedule SE which will be attached to the form 1040. File with the form 1040, 1040 SR or 1040 SS. Estimated tax payment, those are your estimated payments you've got to make basically quarterly. That's called the 1040 ES which is basically just a payment stub that's not the 1040 form. Dubai the 15th day of fourth, sixth and ninth months of tax year and 15th day of the first month after the end of the tax year because you have it basically on a quarterly basis or the month after each quarter that means that the last payment you would think would be due in the first month of the following year. Social security and Medicare taxes and income tax withholding this is the 941, 944. This is a different form than we're focused in on here if you're a Schedule C employee business you might also have Employees in which case you have to deal with payroll taxes in which case you have to deal with their social security and Medicare and your half of paying related to their social security and Medicare but the net income that you have will still be subject to possibly the self-employment tax. Payroll is a whole different thing but it has similar rules across different types of entities and so those are due on a quarterly basis on April 30th, July 31st, October 31st and January 31st providing information on social security and Medicare taxes and income tax withholding that's the W-2s, W-2s and W-3s if you're sole proprietor business and you have Employees then you're the one that's responsible for withholding their money, paying it on their behalf to the government as well as your portion to the government and reporting the W-2s and W-3s not only to the employees but to the government by January 31st federal unemployment tax otherwise known as FUTA that's going to be a 940, that's another payroll tax situation so if you have employees you're going to be subject to the FUTA tax and that is usually filed on a yearly basis April 31st typically, April 30th, April 31st October 31st, January 31st but only if the liability for unpaid tax is more than 500 usually FUTA tax is a lot smaller amount of tax filing information returns for payments to non-employees and transactions with other persons see more information that's like your 1099s so you have people working for you not as an employee but rather as a contractor you have to then file or process not a W-2 for them possibly but rather the 1099 giving it to not only them but the IRS so the IRS can go after them for the money you gave them because to them it's income in the IRS's eyes so to the recipient January 31st and the IRS by February 28th other forms see the general instructions and then the excise tax if applicable you can see the instructions for excise tax as well


Thank you for the introduction IK and thank you to everyone for being here. Today I'm going to be talking about a new definitional framework called public seed pseudo random permutations and this is joint work with Stefano Tassaro at UCSP. The traditional approach to build cryptographic schemes more so in symmetric cryptography is to base them on generic building blocks. These blocks are block ciphers like AS or hash functions like SHA-3 and this paradigm has been very successful in practice and hence applied cryptographers recently have started asking the following question does there exist a simple building block that suffices for all symmetric cryptography and the recent trend has been to use a seedless permutation as the basic building block. To cite a few examples there are constructions of hash functions like catch-act a variant of which is the SHA-3 standard of authenticated encryption schemes of prfs of compression functions that use this permutation pi as its core primitive. Why? This permutation pi is nothing but an efficiently computable efficiently invertible one-to-one function. These permutations in recent times have seen a lot of applications and prominent cryptographers like Joan Damon have even gone on to call them as the Swiss Army Knives of cryptography. These permutations arise in practice in one of two forms one is via ad hoc constructions which are designed to withstand crypt analysis this is the approach taken in constructions like catch-act nor X. Another one is to use an existing block cipher like AES and fix its key to say zero. This approach has been used to construct faster hash functions even fast garbling schemes. So permutations are great in practice but what about their theoretical foundations? In theory for a construction permutation based construction C we ideally want to prove a theorem like this that if pi satisfies some security notion X then C of pi satisfies some security notion Y. So the question is what is the notion X that suffices to prove something non-trivial like collision resistance for a permutation based constructions like catch-act. Sadly there are no known standard model proofs for permutation based constructions. The only known approach is hence to use the random permutation model where pi is modeled as a random permutation and the adversary is given only oracle axis to both pi and pi inverse. However random permutations are ideal objects and they cannot even be instantiated. Moreover random permutation model proofs only give security against generic attacks where we hope that the adversary is not going to exploit implementation specific vulnerabilities and this case is in stark contrast to that of hash functions where even though the random oracle model is popular we have a sound understanding of what standard model assumptions or properties good hash functions can satisfy. When we come to permutations we do not know of any such properties. So the question therefore is what kind of hardness can you expect from a permutation? Note that we cannot expect one wayness compression or even pseudo randomness from a permutation. So in this work we propose the first plausible standard model security assumption that you can make on permutations and show that this assumption is useful. More concretely we give a new definitional framework called public seed pseudo random permutations or PSPRPs for short. In addition we address two fundamental questions that any new framework like ours should address. First can we have PSPRPs at all and second are they even useful? Note that our definitions are just a conceptual contribution and they can be easily adopted from the use CE framework for seeded hash functions. However proving that this the notion of PSPRP makes sense and it's useful is what we show in this work which is where our main technical contributions lie. So before moving forward I want to give you a teaser of how we resolve these two fundamental questions. So we show in the paper that PSPRP implies a lot of applications. We recover a few of these applications by constructing use CE hash functions which are known to imply them from previous work. In particular we construct use CEs via existing practical constructions like sponges. We also investigate what applications can be directly instantiated from PSPRPs and for that we study efficient garbling from fixed key block ciphers and use CEs via the fiscal construction also imply PSPRPs giving some validity of the existence of PSPRPs. Okay so the plan of my talk is to give the PSPRP notion first then give constructions of PSPRPs and discuss a few of its applications and finally I'll conclude with a few. In fact many open questions. Okay so the first observation is is as same as in the complexity theoretic analysis of hash functions which is that we need to extend any primitive to have a seed to define non-trivial security notions. So now our basic object is going to be that P which is a couple of three algorithms gen, pi and pi inverse all of them are efficient such that gen takes in a security parameter and outputs a seed. Pi is the forward evaluation algorithm that takes in an input x and a seed s and outputs y. Pi inverse is the backward evaluation algorithm and I'm going to just assume pi with the seed s as pi s throughout the stock. So when the seed is kept secret the traditional security notion that we all know of is that of a pseudo random permutation where an efficient distinguisher cannot distinguish if it's been given access to a permutation p under a seed s or to a random permutation and it's inverse. But here the seed is kept secret. If you give the seed to the distinguisher the notion of PRP completely breaks down. So informally the way we define security in the public seed case which is what we care about is we tear the distinguisher into two stages. The first stage adversary still pays the PRP game that is with oracle access to one of these oracles and the seed is kept secret and the second stage adversary learns the seed but has no oracle access and we allow some information flow between these two stages. This paradigm for defining security was first seen in UC framework for seeded hash functions. So UCE is a two state security notion for hash functions where the first stage adversary called the source is given access to a hash function or to a truly random function. Source makes multiple queries to its oracle and outputs a leakage to the second stage adversary which we are going to call a distinguisher which in addition as promised is going to learn the seed S and output a bit P. And UC expects that these two worlds be indistinguishable. To define the PRP security we are going to adopt the same paradigm except that now source is going to get access to a permutation a seeded permutation and hence we need to take care of both forward and backward queries respectively in the other world it's going to get access to a random permutation row and its inverse. The second stage proceeds as before, D gets the leakage and the seed outputs a bit P. We say that P is PSPRP secure if for all efficient sources and distinguishers these two worlds are indistinguishable. Unfortunately we cannot have security against all sources and distinguishers because there exists this source that makes a forward query on zero to the end of fixed input to its oracle gets the response y sets its as leakage and now distinguisher getting this leakage seed is going to output one if and only if y is the image of zero to the end under pi s. So in the left case it's always going to output one in the right case why because of this row is going to be a uniformly random string independent of the seed so it's going to output one with probability at most one by two to the end. Therefore S and D can distinguish these two worlds and we cannot have PSPRP security against all sources. So to define non-trivial security notions we need to restrict sources. So now we say PSPRP is PSPRP calligraphic S secure if for all sources in this class calligraphic S and all distinguishers these two worlds are indistinguishable. Okay so that's our definition. In particular in this work we are going to introduce two new source classes, two source classes which are adopted from the UCE framework one of unpredictable sources one of reset secure sources and both of these restrictions captured in some way that the distinguisher cannot predict the queries by the source which is what in the previous case led to the attack because distinguisher knew that source was querying on zero to the end. Moreover the set of unpredictable sources as you can see is a subset of reset secure sources and hence PSPRP for reset sources is the stronger assumption. Okay so let me define unpredictability first a source having access to a random permutation row and its inverse is said to be unpredictable. If a predictor A given the leakage from the source and access to row and row inverse cannot predict any queries by the source or its inverse. Okay which is what is captured by this game. Moreover if A is computationally unbounded or computationally bounded will give you two different notions statistical unpredictability, computational unpredictability where statistical unpredictability is clearly the stronger restriction. Moreover we can show that a technique by Bruce Koff, Arsham and Mittelberg that the computational notion of PSPRP security does not make sense if IO exists. So for the rest of the talk I'm only going to focus on PSPRP security for statistically unpredictable sources. Next reset security it's a two-stage it's an indistinguishability based notion where in the first world source and the reset adversary they are interacting with the same random permutation row and row inverse and in the other case source and reset adversary are interacting with independent random permutations row and row one. And we say that S is reset secure if these two worlds are indistinguishable in the eyes of R. And as before there are going to be two notions when R is bounded and unbounded and since computationally unpredictable sources are a subset of computationally reset secure sources the computation notion does not make sense and hence for the rest of the talk I'm going to focus on PSPRP security for statistically reset sources. So just for recap if I have lost you on the way we have defined two new assumptions and permutations called PSPRP for reset sources and PSPRP for unpredictable sources. These are in fact where reset security is the stronger notion or stronger assumption. These are in fact mirror images of the UCE notions for reset secure sources and unpredictable sources and this UCE notions have played a central role in the UCE theory and a lot of applications are followed from them. So a natural question is can these two also play a central role? And in fact they do and that is what we are going to show next. So construction and applications. So we come back to the two fundamental questions that I was talking about. We've defined PSPRP security. Can we have them and are they even useful? To address the first question we are going to give constructions of PSPRPs from UCEs and also we are going to give heuristic constructions which we validate in ideal models. To answer the second question we are going to construct UCEs which will allow us to recover all applications of the UCE framework now from PSPRPs and as a direct application we're going to study gobbling from fixkey block ciphers. And in particular I'm going to start with these two because this reduction between PSPRPs and UCEs have a common technical denominator which is a new restricted notion of indifferenceability called CP sequential indifferenceability. So indifferenceability in the traditional sense for the special case considers a construction C that uses a random permutation RP as its primitive and we want the C to behave like a random oracle and we want this in a setting where the adversary can make queries to the construction as well as to the primitive. However this does not make sense because there is no primitive on the right hand side. So indifferenceability asks that there exists a simulator that makes these two worlds indistinguishable. So this is a traditional notion. We restrict the notion even further by asking the adversary to make all its construction queries first and then move on to primitive queries and this notion we define as CP sequential indifferenceability. We say that a construction C is CP sequentially indifferenceable from a random oracle if these two worlds are indistinguishable and clearly full indifferenceability implies CP sequential indifferenceability and if you consider the reverse ordering where you allow the adversary to query the primitive primitive first and then ask A1 to query the construction later that notion is called sequential indifferenceability which is incompatible to our work. So now let's address the question of how do you construct UCEs from PSPRPs. Why are this new notion that we have defined? So if you are given a construction C that uses a random permutation which is sequentially indifferenceable from a random oracle, if you instantiate this permutation with a PSPRP what you get is this construction CP which is UCE reset CQR. This is what we prove. Similar result was proved by the UCE authors in the follow-up paper but they required full indifferenceability for this to go through and they stated it only for UCE domain extension. As an immediate corollary of our work every permutation based indifferenceable hash function now would be a good way to transform PSPRP into a UCE and one such construction is the sponge construction which is the basis of the char3 standard and a result by Bertoni et al already establishes the indifferenceability of this construction and hence as a corollary you get that sponge is CP sequentially indifferenceable from a random oracle and hence if you instantiate this row with a PSPRP you get that sponge is now a UCE and this is great because this validates the entire sponge paradigm for UCE applications. But since we are relying on CP sequentially indifferenceability we ask if simpler constructions exist and we show that indeed there is this construction called shop which takes in an n-bit input passes through the permutation row and outputs in r-bit output. We show that this construction is CP sequentially indifferenceable from a random function and however this is not completely indifferenceable if you instantiate row with pi s now which is a PSPRP what you get is shop is a UCE for a set sources however there is more to this construction this construction has a special property as we show in the paper that allows us to get UCE for unpredictable sources from PSPRP from unpredictable sources which is the weaker assumption. However we are getting something weaker in terms of UCEs but that also suffices for a lot of applications as shown by BHK. So and shop is a fixed input length function to get a variable input length UCE you can use domain extension techniques from previous works. So now the second question which is constructing UCEs from PSPRPs a similar reduction follows if you are given a random oracle based construction C which is CP sequentially indifferenceable from a random permutation if you instantiate this random oracle by a UCE for reset sources what you get is a PSPRP for reset sources okay and an immediate corollary is that if you have a hash function based indifferenceable permutation it's a good way to transform a UCE into a PSPRP and one such construction is that of FISIL. There is a long-standing work on FISIL which establishes the full indifferenceability. The state of the art we know that eight rounds suffices for full indifferenceability. So eight rounds suffices to transform a UCE into a PSPRP therefore PSPRP now exists in the standard model if UCEs do which is great but since we are relying only on CP sequential indifferenceability for this transformation we ask if a round number lower than eight suffices and we show in this work that five is indeed sufficient because CP sequential indifferenceability can be achieved at five rounds already so if you have a UCE for reset sources passes through a five round FISIL what you get is a PSPRP for reset sources okay our five round prune proof is the most technically involved result of the paper however i'm not going to go into the details because i think i'm running out of time so our simulator also relies on chain completion techniques from previous works and it heavily exploits the query ordering in the sense that adversary does not query the construction after making its primitive queries and we have to in the process introduce new chain completion techniques to get away with the low round number and that is this open question is that if do four rounds suffice for transforming a UCE into a PSPRP okay we showed PSPRPs can go through FISIL but that's not how you would want to come up with instantiation in practice in practice you may want to work with a block cipher and a natural way to get a PSPRP from a block cipher is to use the key of the block cipher as the seed we show that this is a good way to get a PSPRP in the idle cipher model another primitive is to start with the kechak permutation these permutations are very efficient in practice but they don't have a seed so we say that if you extend these permutations to have a seed via the even monsoil construction then that's a good way to get a PSPRP and we validate this in random permutation model note that we are validating everything in ideal models because we do not have standard model assumptions on block ciphers and permutations as a direct application we study the we study application of garbling which is known which is known to have applications as far as multi-party computation we study fast garbling from BHKR and which only makes fix key which only makes calls to fix key block ciphers and hence is very fast but they have a proven in random permutation model we show that if you replace that the fix key block cipher with a PSPRP for a random seed what you get is secure garbling in the standard model so we put that proof in random permutation model to standard model so this shows that PSPRPs are useful beyond just recovering applications of the UC framework okay so finally concluding we introduce the notion of PSPRPs which is the framework that introduces the first standard model assumption on permutations we discuss construction of PSPRPs and its applications there are a few open questions in this area one is that can PSPRPs enable other applications like PRNGs authenticated encryption another one is to resolve the round complexity of five still for PSPRPs we show that five is sufficient we don't know if four works public seed pseudo randomness is a general paradigm which allows us to give PSPRPs and UCs as special cases which this this is the paradigm that we define in the paper and as a special case one can consider now a public seed idle cipher but we do not know if it has any applications and finally we realize that PSPRPs are a strong notion so simpler assumptions on permutations that maybe allows you to prove collision resistance of the shatri hash function is another open question thank you okay any any question or comment okay that and no there is one question in the back so should we call QCEs public seed PRPs now so they are public seed hash functions yes they are public seed PRFs exactly so you're already getting familiar with that notion thank you


Hi, I'm Ryan Ritchie and I'm a door hardware nerd. I am the institutional locksmith for the Southern Alberta Institute of Technology. I've been in the industry for about six years now. I spent my first five years working for Calgary Lock and Safe where I completed my apprenticeship, learned to trade and became a journeyman. Obviously, I've spent my last year here at SAIT. My door disclosure story comes from when I was with Calgary Lock and Safe and working on call. Of course, any locksmith that works on call knows most of our memorable stories usually happen after hours. This call came from a customer that was actually locked inside their home. When I arrived, luckily enough, they had a small window and screen right beside the door that we were able to talk through. They explained to me how the deadbolt, the thumb turn on the inside, was just spinning freely and they couldn't get out. So I asked the customer to remove the screen from the window and pass me the keys so I could try them on the outside. Unfortunately, the keys just spun on the outside, figured it's a broken tailpiece and that's why the lock wasn't working. So I thought the next step would be to disassemble the lock. Of course, the customer's on the inside, I'm on the outside. So I passed the customer and my screwdriver through the window and explained to them how to disassemble the lock. Once they had the screws off, I was able to take the outside of the deadbolt off. They passed the screwdriver back to me and I was able to use the flat head to manually retract the latch and open the door. I thought that was a really fun job and it just showed the creative thinking that sometimes can go into being a locksmith. Happy I was able to share the story. Thanks.


Good evening everybody. So how was the first day of Defcon with you guys? You enjoyed it? Like it? Everyone is pretty much very tired so that's Defcon. So guys we have last talk of the day before we have contest briefing right. So we have Mike and Ron and they will be presenting Cryptocurrency Security Standard CCSS. So here we have Mike and Ron. Thanks Ajit. Yeah you know what they say, save the best for last right. Thanks everyone for staying a little bit later for for this talk. I promise it will not be very technical. We're not going to tax your brains. It'll be it's just an overview of what the CCSS is so that you're able to understand the goals of it and you can research it on your own time if you want to learn more. Yeah yeah so I'm Ron Stoner. I'm a security engineer at Shapeshift hoping to keep everybody's accounts safe while you do your crypto. I'm also the curator of the CCSS exam. So we're going to talk about the CCSS today. We have some exciting things also as a result of that. I run my own consulting firm and you can find me on Twitter at Forward Secrecy. And I'm Michael Perklin. I'm the chief information security officer at Shapeshift. I work with Ron. Also I'm the president of C4 which is the nonprofit organization that spent all the time with a variety of companies to pull all the the data together to create the CCSS and to publish it in an open way so that all of you are able to use it without any restrictions for your own work. I also run a contest here at DEFCON called Coindroids which is the world's first blockchain battle game and it's been running here at DEFCON for five years now and it's pretty interesting. So a quick note about C4. C4 is a nonprofit organization that deals with measurements and standards. Our first project was the CBP certified Bitcoin professional which is for people and our second project was the CCSS which I'll be talking about today which is for systems. It's been running now for six years and we've got some pretty good board members including Vitalik Buterin, Andres Antonopoulos, Pamela Morgan and Joshua McDougal. The CBP which is what I mentioned is the world's first certification related to Bitcoin or blockchains. It's a basically how this was formed was we recognized that there was a need in the industry for everybody who didn't know what Bitcoin was to be able to identify somebody who did know Bitcoin. When we started C4 we realized that while I know what Bitcoin is and if I'm interviewing somebody I can ask them pointed questions and I can tell if they actually understand Bitcoin or if they're just repeating a news headline and they don't quite understand what a Bitcoin is but I'm already knowledgeable about Bitcoin so it's easy for me to identify knowledge and others but there are so many hiring managers, presidents, CEOs who know that they need someone who understands Bitcoin on their team but they don't know the first question to ask them in the interview. This problem has been solved many times before in a variety of industries like in accounting they have the certified professional accountant designation the CPA. These types of certifications have meaning for HR just to make sure that they are interviewing the right candidates and we realized that there was no such animal for Bitcoin so we decided to make it. Can you talk the talk and can you walk the walk? While the CBP was the first project we did which is related to people measuring a person's knowledge to make sure that they meet the minimum bar for understanding how to use Bitcoin safely. The CCSS is much different. The CCSS is for information systems for a vault that you've created for your enterprise or for any other system that ends up holding Bitcoin. Yeah so when we're talking about the CCSS we're talking about security standard so we've seen a bunch of different security standards throughout industries over time and in crypto we have CCSS it's providing clear security guidance it's providing a framework it's providing security controls that information systems can adapt into their into their system and it's free for everybody to use. Why do we need it? We want to instill confidence in customers and people using these systems. There's a lot of fly by night operations in crypto you guys have seen the news articles you've seen funds go missing everybody's kind of doing it their own different way and there's not really a good standardization for this. So we can see that you know with these different companies mount gox coinbase a lot of these companies were wrapped up with hacks and loss of funds unfortunately because they weren't following proper security standard and procedures or they weren't hacked or they weren't hacked because they were following the proper procedures there was everybody was sort of doing it their own way. Yeah as we said before when you're looking at things like doing business with people that are processing credit card companies you look for PCI when you're talking about your medical data you want to see that HIPAA on it right and we know that that may not be the be all end all but they're protecting your data they're taking the steps they're doing things correct within a standard to make sure that your information and your stuff is safe. We have things like ISO 27001 but when it comes to currency what do we have crypto currency? So every industry has a standard and we're trying to fulfill that need. So now that you have an idea of what the CCSS is let me reinforce what the CCSS is not. The CCSS is not a replacement for ISO 27001 or for traditional cyber security. You still have to worry about you know malware you have to worry about insider threats you have to worry about all that stuff. The CCSS focuses razor sharp on the on the keys themselves how are the keys generated how are they used how are they stored and how are they decommissioned after use right additionally who's accessing them what are they doing with things like that. So when we get into CCSS we know security isn't just tech. Security is all encompassing right it's a whole bunch of different domains it's a whole bunch of different systems within itself if all you're doing is installing host intrusion detection and calling it a day you're not doing it correctly right so when we get into information systems we're talking about all these different domains with hardware with software with all of your procedures with your policies are those things being cut up to date are they being tested who has awareness of those policies or if x employee leaves an information system is that knowledge gone.  So the CCSS looks at an entire information system as a whole which is all five of these areas all combined. Does anybody know where the weak chain is in this picture? Yeah nice nice joke. So when we get into the CCSS we get into 10 overall aspects that we're talking about here and as Michael said it's very heavy on keys with usage storage how those keys are handed off who has access to them but then we get into other things that people may not be thinking about like your data sanitization policy so DSP is a big one where all the corporations say you know we've got these policies and we're doing all this stuff but when you dumpster die them you find out that may not be the actual case. Yeah and there are 33 separate controls that fit into these 10 different aspects we're going to give an overview of each of these 10 aspects and what is covered in them we're not going to get into too much detail because this is a fairly high level talk if you do have any questions specifically about some of these there's definitely going to be some time at the end and of course all this is published free open source online. The CCSS has three different levels and they are additive there's level one level two and level three whereas level three would be the highest level one is is the lowest but where level one is the lowest that doesn't mean that that is poor security it's actually great security level two is even better security and level three is paranoid to my knowledge no system out there meets level three security but that's fine they don't necessarily have to I've said this many times before and I'll say it again any system that is certified level two I believe would not be able to have the funds exfiltrated now I'm not saying that they won't be able to get hacked they could still definitely get hacked but a successful hack would not be able to pull any of the funds out of a system if it is level two compliant we'll get into a little bit the details of level one two and three but as a as a high level the next slide shows sort of the the chain model if you're to take a look at all 10 of these areas now across the top you can see level one two or three if this is a an example checklist for ACME exchange company now if ACME exchange company the way that they generate their seeds are compliant with level one they don't do a compliant with level two or level three but they are still secure with level one but the way that they create their wallets actually does reach level three and you can see some of the differences here this system would be graded as level one because that is the one commonality all of these boxes would have to be in level two in order for the system to be compliant with level two and similar for level three so it's it's important to look at the system as a whole to understand how all of these things are individually graded in order to apply a grade to the overall system and that overall grade is the lowest common denominator out of everything and as Michael said even with level one some people think level one's bad but if I was looking to do business or move my funds to an information system that was level one certified I know that they're checking off all those boxes or level one compliant I know they're checking off those boxes they've done proper procedures with their keys I can more trust that information system that somebody that's not compliant with any of these controls and actually before we jump in to each of these in a little bit more detail one thing I want to say is how the ccss was compiled so in in 2012 and 2013 c4 contacted as many exchanges as we could to understand more details of any of the hacks that occurred and we gathered a whole bunch of data from security professionals all over the world and then we started organizing it why was this exchange hacked here why was that exchange hacked here why is this exchange not hacked and we identified the commonalities which allowed us to group them together into these 10 aspects so it was through a lot of data analysis that the volunteers at c4 and the companies that submitted data we all work together to pull them together like this and with no further ado let's jump into each of these 10 aspects in a little bit more detail so the first one we're going to tackle is key c generation and probably one of the most important parts of a cryptocurrency information system you can have everything secure but if the person that generated your keys has a copy of that private key or seat at home you're screwed at that point so when we get into key c generation we're talking about things like was the key and seed issued by another actor was it created with a compliant d rbg deterministic random bit generator so when you get into the very fine technical details of randomness and pseudo randomness that can have some far-reaching effects on your business right in your information system depending on on how those keys were rolled and what they were rolled with we also talk about things like wallet creation um what was being used when that while it was created were unique addresses being used for the uh ultra paranoid level three side of security um as you can see level one doesn't have any controls here listed for uh for wallet creation but level two and three does so if you were looking at a compliant level one system you would know that they may not or may have done some things with this control um but depending on how they've done it they they can certify different different levels one two or three based off of how those wallets were created and for those of you who are here at the in the previous talk where mila went through the the various algorithms that make up bitcoin um uh that's denoted here where uh bitcoin is quantum safe as long as you are always using a brand new address uh now you can still use use bitcoin uh while while reusing an address uh and and uh keeping to you pardon me um while you can still use bitcoin safely while we're using an address the ultra paranoid people will always make sure they're always using a new address just uh to make sure that they're quantum safe there is no known attack today that uh can reverse a a private key uh from the public key however uh if you want to be paranoid you should always be using unique addresses and that's why that's a level um three control when we're talking about keys we're also talking about the geographic distribution of the keys um where do those keys live is it in single location multiple locations when we get into this we're talking about things we're looking at business continuity and disaster recovery or uh if a key's lost or uh access to a wallet is lost is it in another location that you can get access to and either get access to those funds or do what you need to do in those in those times so we've got generated keys and we're generating them securely but how are we storing them so we've got different controls here for things like backup keys um one that people don't really think about is are you storing your keys encrypted so everybody might have their backup of their key and they're safe or in their desk drawer but when somebody gets access to it do they have another step that they have to take to get access to that key material or do they just then have raw keys that they can take and start using at that point we also look for things like does the backup key have a tamper evidence seal um however you want to achieve that that's fine as long as there's some evidence to say this key's been accessed or somebody else has had access to this in the last time that I've had that um and as you can see when we get to one to three those controls get a little bit more paranoid with backing them up with access controls um even encrypting backup keys which people don't think about they always think about encrypting the primary key after they see the information on the previous slide but they never think about their backups or you know different copies of those keys they have in other locations continuing on the lifecycle of a key we went through how the key was created and then how the key was stored let's jump into how the key is used so there are a variety controls in this section including um how many factors are required to access the key can anybody just get it or do I need to have um a username and a password and maybe a 2fa code in order to use use the key um are the keys used in a trust environment or are you uh uh signing something in a Starbucks off of an unsecure wi-fi um who gets to use those keys and what checks do you do on them whoever is going to be interacting with your keys has an opportunity to to make a copy of the key and use it in an unauthorized way so before you give them access to your key what checks are you doing to make sure that you want them to have access to your keys and are they even the the right person um maybe they started at your company with a fake name or or something like that so I mean these are small checks but they're definitely important before you give access to these people a few more for key usage um background checks do they have a history of of credit risk um while their personal finances have nothing to do with your business um if they uh if they're constantly in debt and they're constantly having a difficulty making their own ends meet they're more likely to find money another way um whereas the opposite is true if they're not um now when the key is used to sign something what kind of uh double checks are you doing to make sure you're sending to the to the right destination address and are you sending the right amount um if it's a multi-sig system are those multiple keys brought together on a single device or are the multiple keys used independently on separate devices there have been a number of hacks of a multi-sig system where a Trojan made its way onto the if the final signing system the the system where multiple separate keys for multiple separate key holders are brought together that's not the safest way to do it making sure that each key is kept separate is important and as part of every digital signature I believe Mila also talked about this in her last talk as part of every single digital signature there is a random number that is used how is that random number derived there have been cases where the same number has been used for multiple signatures which can allow someone to uh re re compute the original private key and staying with keys we're going to get into how they're granted and revoked because this is an important part of the process itself so we have controls in place for um is there actual grant and revocation procedures created um who's knowledgeable on the staff with those procedures or does it just sit in a uh a document repository somewhere that you know they've checked off the box saying this policy has been created but nobody ever looks at it nobody ever uses it and nobody knows how to enact it when the time comes um we also look for things like authenticated requests over authenticated communication channels um so this gets interesting because we get into the concept of uh of strong authentication and making sure that you know who you're speaking with verifying them over different ways not just getting a slack message or an sms message and trusting that this person has said yes sign this transaction and send 10 000 bitcoin to this address right we're going to verify that before we do that um and then looking for things like audit trails with employee sign-offs for all of these actions so not only are the steps being taken and are they being followed but are we taking down audit trails so that if there is an issue we can go back and find out where there was a problem or where something went wrong this is one of my favorite ones as a security engineer the key compromise protocol kcp so the shit hits the fan and we need to do something um we want to see that uh a key or a key compromise protocol exists number one have people thought about this have they built a system to take care of this or a policy or procedure um do they have staff that are uh knowledgeable with key compromise uh policies uh are they comfortable running that type of that type of procedure if they need to go in and revoke keys that control x amount of dollars or x amount of funds and for those who don't know what we mean by a key compromise protocol uh it's basically a script of what you would do the moment you believe maybe a key might be compromised by spending the time to think about all this beforehand uh when you're in a rush situation you don't you don't need to worry about making mistakes because you just follow the script step one step two step three and now all the all the keys are properly replaced uh moving on there there are only a few more uh aspects and then we'll open up to questions uh security audits the ccss defines a couple of requirements for security audits namely that they are done regularly um uh it's not really much more to to say about this one um there are oh no i was gonna add on to that but um one thing that we haven't really talked about that's important to see on this slide is the uncertified status um so you can see here in red no proof of security for security audits um i i think we all know of places that claim they're secure but when it comes down to it you want to see the audit information there's nothing there right they've never done a pen test they've never done vulnerability scans or code review um with that uncertified status you could be level three across the board on everything else and if you're uncertified on one of these controls you're not going to be compliant with the ccss because if michael said you're only as strong as your weakest link and in this example this would be the weakest link um approaching the end now um the data sanitization policy keys have to be stored somewhere when when they are uh in use likely on a hard drive of some kind of uh of a server or um maybe they're on uh on a cold storage device uh some laptop that has been air gapped um the having a data sanitization policy uh that details how you're going to scrub the data from those devices when those devices reach end of life is mandatory otherwise anybody who finds your old laptop hard drive in a dumpster somewhere they could in theory get your keys back yeah this man loves dumpster diving um and it's also important to have an audit trail of uh what has been uh sanitized and when although that is more of a paranoid level uh control um next is proof of reserve uh there are a variety of ways that companies implement proof of reserves uh oftentimes just publishing a report saying hey uh here here's all the here's all the crypto we have uh the the controls uh mostly mandate that there is some way to prove uh control however uh the the best way is when the blockchain itself uh can prove it for you by publishing all the addresses that your system uses to the users of your system now your users are able to independently validate that those coins really are there at those addresses instead of trusting uh the entity that just says yes we have a thousand bitcoin here oh but no we're not going to give you the specific addresses of where all those are are held uh it removes all trust and if we look at level three the question may come up of um what happens with information systems that don't hold funds anymore uh non custodial exchanges which i happen to be a big fan of um in those instances um they would comply with level three because there's no funds stored there's no need to actually list the proof of reserve because they're not holding anything on behalf of uh behalf of customers or systems at that point and then we get into audit logging so we've talked about keys we've talked about key holders we've talked about verifying identities and making sure people can be trusted and are following the pop proper policies and procedures uh but we need to make sure that again audit logs exist for all these actions in the system um level one we're logging some actions level two we're logging everything for user and admin controls uh and the same for level three so as you can see some level two controls are good enough to meet level three requirements um outside of a full audit trail existing for user and admin uh actions i don't know what else you could could add in there for audit logging to uh to make it more secure and then we also want to see backups of our audit logs so it's great if you're running your server and everything's uh fine but then somebody goes in and wipes it or you have a disaster event are you keeping your logs off site uh do you have bcdr policies and procedures in place business continuity uh for for audit logging information so that is the ccss in a nutshell there are 36 individual controls that are spread across 10 different aspects or 10 different categories um and all of them need to be uh graded individually and the lowest common denominator will be the overall rank of that information system uh as far as using the ccss the standard is published online for free for anybody to use without need for royalties and the source for the standard is published on github if you're interested in in reading about it i encourage you to visit cryptoconsortium.org and if you are passionate about security like ron and i are we encourage you to to get involved we have a handy empty matrix just like that acme checklist uh you can grab that that checklist uh off of the the c4 website and i encourage you to try to assess yourself uh think critically about each of the different controls and and see where your system falls what's great about measuring your your system like this is um once it's done you'll see exactly where you have an opportunity to improve the security of your system um we are always looking for people to uh to submit feedback on the standard either um posting comments on github or posting issues or posting uh pull requests if you feel that you could improve it we'd love to hear from you um c4 is a volunteer run organization and if you want to volunteer your time and your security knowledge we'd be happy to uh to take it as well as becoming a part of a never-growing uh compliance standard in cryptocurrency last thing i'll i'll talk about is the upcoming blockchain training conference now uh the coupon code you see on on screen will will save you 10 off the ticket price and if you visit the coin druids booth in the contest area you can get another coupon code for another 10 off giving you a combined 20 off of the ticket price at the blockchain training conference this is the first time c4 is going to be having a full day workshop on the ccss to train you or or anybody that you'd like to to send on your behalf on how to use the ccss in real world scenarios uh it's taught by by ron right here um who also wrote the ccss a exam uh the goal of this bootcamp is to prepare the next generation of auditors on using these standards to assess a system and to guide their clients on improving their security uh with that let's open it up to questions i've got some some swag for some uh some good good questions if uh if you have them you sir had your your first uh the question was how do you detect that a key has become compromised uh or might be compromised that that's a great question and there unfortunately is no silver bullet like everything in security there is no silver bullet that uh that can solve that um there are a variety of ways that you you could um try to detect things such as um canary payments or sorry i guess canary addresses uh putting small amounts of funds on certain keys that are available on servers and watching for when those funds move uh during your normal course of business those funds should never move but the moment that they have moved it could indicate compromise of that system um uh also um the key compromise uh protocol that we talked about doesn't only cover known compromise it also covers suspected compromise if one of the key holders suddenly becomes unavailable for for 24 hours and all attempts of contacting them have failed their family doesn't know where they are either um it's possible that they could have been kidnapped uh it's possible that uh god forbid they may no longer be around um in any of these cases if you suspect that either the key or the key holder may be compromised the the key compromise protocol should be enacted as if they were compromised either way uh it's always better to um to proactively uh move all the funds to new keys when you think there might be a problem than to hope and it doesn't work out uh the the the question was uh does the ccss have a standard for uh detection uh no but because the because every information system is different uh the way that you would detect a actual compromise or a possible compromise would be different for every standard uh if you have a a good way of of writing an aspect that could cover that for a variety of different information systems i'd i'd love to add something like that to the ccss uh if you want to um visit github and submit that do you want to take the next question ron yeah um so the question was when you're looking at reviewing things like the random number generator the drbg the deterministic random bit generator um how far do you go when you're looking at that control are you looking at things like source code and i think it really depends on the implementation so um there's a variety of ways to do entropy in rng where people could be rolling dice and cards and then putting that into a script and spitting out some keys based off of calculations they could be using a hardware device that's measuring the difference in electronic current um so it really depends on the implementation i think when you you get into that aspect you do look at how did you roll them what did you use did you use your own code did you use something you pulled off github did you use a device um and at that point it's a lot easier to drill down and determine where does this fit level one level two level three or um uncertified and tad to ron's answer um the ccss uh requires drbgs to be compliant with a variety of uh well known and globally globally accepted standards specifically nist uh 800 a 60 i think it's written on here somewhere um if the yeah he'll pop it up but uh if if the drbg is compliant with the nist there it is sp 890 a um uh then uh it would be a compliant drbg uh if you're using let's say electrum to uh generate your keys um uh the the the source code of electrum should be looked at to make sure that it's not using its own method of uh of random generation and it is calling a well-known uh prng and then it should also look at how that prng is being seated once we know that electrum is using a well-known prng that is compliant then uh then we know that that one would be certified did that answer your question yeah perfect but uh dual e cdr bg i'm sorry could you ask that question again so easy the the comment was that uh even nist compliant drbgs uh have been uh known to be compromised and you know what security is always evolving uh as long as we're doing the doing your best to be up to date with with the the current best practices then we know that we're doing our best but we can't uh protect against unknowns that haven't even been uh invented yet uh let's go with uh red shirt how useful is the ccss to non custodial wallets was the question uh it's a great question um so a non custodial system let's say uh a a dex a decentralized exchange uh the exchange itself doesn't store uh funds on their own uh dex's match make uh someone who is selling one token and somebody who is selling another token so uh the dex itself actually can't be certified by the ccss because that system doesn't actually store funds each user each participant of the system would be required to safeguard their own keys for for their own funds on that side does that answer your question perfect miss in the back so the question was um and that was a long one uh but please correct me if i get the question um uh incorrect but uh how would risk managers use the ccss to actually i'm sorry could you repeat the question gotcha so how does the ccss map to other standards or other um uh systems of control um uh my answer would be again that it is uh a separate uh set most of the existing standards that are out there uh relate to uh one aspect or another for example the pc i uh compliance relates to storing of credit card information but only credit card information uh HIPAA relates to storing of healthcare information the ccss is razor focused only on the storing of private keys now uh because both pc i and HIPAA have been around for so long uh it's common knowledge for for board members to say oh are you HIPAA compliant yes are you uh uh PCI compliant uh it's our hope that through the development of the standard and the regular curation of the standard that uh being ccss compliant tomorrow will be as as common knowledge as being PCI stand uh compliant is today and to just add on to that um i think for anybody that's trying to make a play to a board or anything like that all you have to do is link them and show them all the different hacks and loss of funds and cryptocurrency information systems that have happened even within the past few months right um they they like dollar figures and showing them dollar figures and making it real world i i think always brings a full circle and one one other thing i'll uh i'll add to that is um the uh a variety of exchanges already list uh their uh voluntary compliance with the ccss standard if you dig into their frequently asked questions um so a lot of exchanges are already using this and there have been a a number of um uh so a number of regulations from a few different jurisdictions that have already referenced the ccss in in the laws um most notably in um in bermuda uh they recently uh passed um a i don't know if it's a if it's an act or uh i apologize i'm not a lawyer um but uh it was referenced in their um uh in their laws that any any company that is going to be uh operating the cryptocurrency space should be compliant with at least ccss level one also in wyoming uh right here in the united states uh the ccss was referenced in the recent blockchain laws there as well so uh the standard is already starting to be adopted by lawmakers worldwide and um uh anything that we can do to help these people who don't understand tech to at least get a nice little checkbox uh i i think is a win for all of us mr and the black shirt so uh summary of the question please correct me if i get it uh wrong is um how do you actually ensure that people are using the standard the thorough standard and they're not just um uh i guess uh making a bunch of check marks without doing it and you know what i don't know of any way that you can um uh if an auditor goes in and just issues a report and they sign their name on it and it says hey you're everything's perfect um if they want to put their reputation on the line to make a lie there's nothing that i don't think anybody can do to stop that um uh maybe having two independent auditors uh perform the same checks and if you see any inconsistencies between the two that might make some progress in doing that but even still uh just like just as these those one person could could lie on a report two people could could lie on a report um if you can think of any way uh to enforce um i guess uh the integrity of uh of these people's reputation i'm all ears i think too it comes down to um if a business says they're hip a compliant right and they've checked off all those boxes and then they have a breach in your medical data gets out there everyone's going to look at that and say well you aren't you weren't actually hip a compliant right you weren't following those those standards and procedures you you fleece the auditor you just check the box off to check the box off and i think at that point that's on the business right from a little litigation standpoint and everything in a reputation standpoint um so we would hope that businesses wouldn't do that but having the auditors in the pipeline definitely helps with the process to validate some of those controls and say well no your kcp is two lines on a word document it's not an actual procedure that anybody can follow you know step a to z so any other questions gray shirt have third party audits been completed yes um i i'm aware of at least three consulting firms that have used the ccss when uh grading the security of their of their clients work i only know of this because um c4 was was reached out to by these uh these firms uh just double checking um some minutiae in in the standard to make sure that they were they're using it correctly um and now that the the now the c4 is planning on launching the auditor certification uh later this year um these auditors who are already doing doing doing this this type of work to see if uh if a system is compliant uh these auditors can become certified and they'll be able to say that not only do i believe this to be compliant i am bestowing the certification on that uh on that system uh right now uh because it's a uh it's an open system uh the best anybody can say is i believe i am compliant with it or i believe he is compliant with it but no there are no uh exchanges there are no systems that are certified compliant once we have the auditors that are properly trained uh and we know that they understand the uh the standard thoroughly their word will be their bond um yeah sure the acme uh slide yeah it's a little bit farther it's doing the build yeah patience one more or two more there we go oh but the yeah the ten the tenor listed here so any other questions so the question was uh are there any plans to expand this from an auditor focused thing to more of a qualitative uh focused standard um it it's my belief that in order for any auditor to be effective they have to do a qualitative assessment sure there um there are some quantitative pieces to it making sure that this is done enumerating you know how many keys are in the system some of those will be quantitative but uh those numbers don't really mean anything unless you put them in context just because there is a multi-six system that is three of five doesn't suddenly mean that it is good um like the the picture of of the chain it it's everything around the ecosystem of those keys that make it a secure system um auditors need to make sure that they look at all aspects of the information system not just the the quantitative part in order to make a accurate assessment edgy um depending on the uh the yeah thank you the um level that you're going for so some people may say we can never be level two or level three or um i think let me see in the instance where yeah so for level one you do need to have backup keys right so we want to see that for bt dr um we want to protect it from environmental damage and then we want that primary key to be stored with strong encryption across the board now when you get into backup keys um we're starting to get into the more paranoid levels of security right really uh really tight secure systems where there as michael said level two that we shouldn't see any any loss of funds or anything like that um but at that point you're you're starting to get to the paranoid level of security now we are question was about backup keys of the backup keys only for level three uh so um uh every system that i've ever worked with i always recommend that you do not encrypt the backup key because of that exact problem where do you store the decryption key for the backups um however there are there are some companies that feel more comfortable knowing that even their backups are encrypted um i would advise those those people to make sure that those um decryption keys are stored equally secure but uh somebody said turtles all the way down and i definitely think that that applies here uh which is one of the reasons why i personally um don't like systems that encrypt the backup keys because if the person who knows where that decryption key is uh dies or passes away how do the surviving uh operators of the system get that uh i i said earlier that i i believe uh a system that is level two compliant uh can never have the funds stolen even if they are hacked uh and i i i stick by that yes uh the question is how do you feel about social key recovery do you want to take this one or should i what do you mean by social uh isn't that like yeah so so social key recovery um involves sharding a key into let's say three of five and then you give each of these five pieces to five people that you know and trust uh if something ever happens to you any three of these five friends or family members can get together to reconstitute the the key um in my opinion that's just a backup mechanism whether you you etch the key on steel and put it in in in a safe or you shard the key and you divide it amongst um key custodians uh either way you're backing up the key um i i definitely would think that that would be compliant with the ccss yes sir the question was um at what quantity of funds um would you recommend a certain level of uh of compliance with the ccss uh and my answer would be i can't answer that for you every business is different does 10 million represent a uh a fraction of your daily volume or does 10 million represent like the the cumulative sum of of you know years worth of work uh to your business 10 million um could mean something totally different than to somebody else's business um my advice would be uh take a look at your use case take a look at the funds that need to be secured and use your best judgment on on how to secure that yeah i i don't think there's like x number to say at this value you want to be doing business with a level two company or anything like that it's all all based more off of your own personal risk profile and what you're comfortable with um yeah i i believe you could yeah yeah if you're doing proper development processes and you're going through this checklist and checking off each of those boxes and getting into the controls in depth three person team could definitely be level one compliant they just um so we're level two yeah that's for level two and we're getting into things like multi multi signatures and stuff like that um to go back to your original question two with the 10 million let's say you have x amount and we're talking about cryptocurrency right so we're storing crypto on these information systems or processing crypto 10 million today could be 100 million tomorrow so if you're comfortable with x money on that at level one you know what's it going to be at level two and we're at the moon um level one requires uh or it doesn't have any requirement for multi-sig level one is a secure system with with single signatures um that would apply more to ethereum style um uh systems where there's only one key for that uh contract um multi-sig is level two and above um so you don't need to be level two uh sorry you don't need to have multi-sig in order to be compliant you can absolutely be compliant with level with one key that is all the time we have um if you do have any more questions uh maybe we can walk and talk back to uh the rest of the the conference area but thank you very much um coinbase for host for sponsoring this blockchain village thank you very much uh jeet and all the volunteers that that work with you for putting this together uh i i think it's great that we have a blockchain focused uh village at defcon and i'm thrilled to be here thank you thank you everybody


This paper proposes a framework that uses social media data and traditional methods to accurately predict traffic patterns for last-mile delivery logistics. It employs deep learning techniques such as graph convolutional networks and long short-term memory neural networks, as well as data from sources like coins and social media check-ins. Additionally, it incorporates simulation tools such as agent-based simulation, discrete event simulation, and system dynamics to further enhance vehicle routing. This article was authored by Valeria Lanes-Viascunari, Edgar Gutierrez Franco, Luis Rebello, and others.


Let's say we have a string, and we want to classify each character as a letter, upper or lower case, a digit, or other. We'll loop through the string one character at a time. Because we can compare strings, we can have an if statement like this to see if the character is greater than or equal to a capital A and less than or equal to a capital Z. If that's true, we'll print that the character is upper case. Otherwise it might be lower case when the character is greater than or equal lower case A and less than or equal to lower case Z. Then we'll print the character is lower case. Similarly for a digit, then the range will be the character zero and the character nine. And the character is a digit. Otherwise we'll say that the character is not a letter or a digit. And let's run the program. And there are the results. However, the world is a big place and there are a lot of different alphabets. And their character codes don't fit our simplistic definition of letters, as you'll see when we run the program with this string.  We'll modify the program to use the isUpper method. If char dot is upper, it's upper case. Otherwise, if it's lower case with the isLower method, we can use char dot isDigit to classify the letter as a digit. And everything else will be other. Let's put another character in here. And now when we run the program, we've almost got it working except for this Japanese character, because Japanese characters aren't either upper or lower case, but they are alphabetic. Let's add a little bit of extra code here. Otherwise, if char dot is alpha, so it may not be upper case, it may not be lower case, but it's an alphabetic character, then we'll print that the character is alphabetic. And now let's run the program again, and things are classified correctly. One extra note, you can use these methods on a multi-character string. For example, if I set the string s to the word classify, I can say s dot is alpha, and it will return true if all of the characters are alphabetic. If I set it to classify with a question mark at the end and ask, is the whole string alphabetic? I'll get false. You can see a list of the classifier methods and all the string methods at docs dot python dot org.


These sites have been assigned different science themes, so in some sites we are looking at climate change, and others we're looking at grading some land use. We're also looking at things like timber production. NEON will provide data that is collected by sensors on the tower, in the soil, and in aquatic systems, both lakes and in streams, as well as by making observations on the land and in water. In addition to that, we are going to be collecting data by sensors that are located on our airborne unit that are going to fly over each site every year. And so by having this co-located set of data coming from each of our sites, we hope to really inform these grand challenge questions. So what we have resulted in is a generalized site design. This is what it looks like on an actual NEON site, or by a social biological station down in Domain 3 in Florida. And while this is a specific design to Ordway Swisher, this is actually representative of what we will be implementing at most other sites throughout the U.S. So within this, you can see that we have a tower that is located within the site, and then surrounding that tower location, we have a number of observations that are made for the Tertial Observation System that their intent is to scale very closely with the measurements that are coming off of that tower. We then have a series of other observations that are made distributed throughout the site. Those measurements are co-located with each other to increase the value of each of those measurements so that we can create the linkages between observations of different kinds of organisms. In addition, that data will be used to scale with the data that is being taken by the airborne platform. At Ordway Swisher, we also have two different aquatic sites, two different lakes called Suggs and Barco. And we have also worked to make sure that we can ensure linkages between the data that's being taken in these aquatic systems with the data that's being taken on the Tertial System. So surrounding the lakes, we have different measurements of riparian habitat. We have groundwater wells. And then we have different kinds of sensors that will be located within the aquatic system itself and then observations that will be made by field crews within that aquatic system. And this is, again, getting to the general strategy of NEON. We're re-utilizing observations made on short timeframes and on smaller spatial scales by both the sensors and by the field operations crews to then combine that with the data that's being taken by your airborne unit and then with other data sets that are available in the communities such as data that's collected on satellites to create a full look of what's happening on the continent and the kinds of changes that are happening to ecosystems on this continental scale. On the very first level is the actual collection of the raw data either by a sensor or by field crews who are collecting that data. The data is then processed through a basic level of QAQC. The sensor data is calibrated within our automated data portal. And then eventually that data ends up getting pushed out to the actual data portal as an L1 data product, which is the basic level of QAQC data.