Hello everyone and welcome to the session on TCP option, learning outcome. At the end of this session, students will be able to describe the concept of TCP option. About TCP option, in the previous video we have discussed about the different parts of the TCP protocol and the option is a extra field available to the user to add any extra information to that particular packet used in TCP protocol packet format of TCP packet TCP and datagram used in the UDP. TCP header how can have up to 40 bytes of optional information, it means extra space available to the user to add the information to that particular place. Options convey additional information to the destination are align other options to the user. There are two categories of options, first one is a byte one byte option, second one is a multi byte option. Let us see one by one in detail, first one is a one byte option. The first category contains two types of options, first one is the end up option list and no operation. Second category in most implementations contains five types of options, first one is a maximum segment size, window scale factor, timestamp, SAC that is selective acknowledgement permitted and SAC only SAC that is SAC and SAC permitted. Here this diagram can contain the first one is a option, just now we have discussed about the definition of option that is extra field available to the user to add the information. Here two types are there single byte and multi byte. In the single byte end options first end option and no operation. Second multi byte can contain the different types that are first one is a maximum segment size and second one is a window scale factor, third one is a timestamp, fourth one is a SAC permitted and last one is a SAC, SAC permitted and SAC. What is mean by SAC and SAC permitted, the details about this one it is there in this selective acknowledgement. So, about end up option first byte that is a end up option can be used only once in option field. The end up option is a one byte option used for padding at the end of the option section. In each and every packet format of datagram and user datagram used in the UDP packet and packet used in the TCP, both the packet format can contain the option field that is we can add any extra data to that particular place. It can only be used as a last option only one occurrence of this option allowed. After this option the receiver looks for the payload data and one end up option is inserted to align the data with boundary of the next word. After adding the first data next we have to go to the next, if the user want to add the next byte or data then we can check out the boundary of the next word, ok here. The end up option imports two piece of information to the destination that are end up options. So, there are there is there are no more options in the header, ok except that there are no more options are available in the header field. The data from the application program start at the beginning of the next it is a 32 bit word is a block format of the end up the option that is it can contain kind here we initially we have used 0 all field it can contain 0 and 3 byte option is there the end up option is there. This is the data what user want to transfer the data when you say end up option list and then is a used for the padding this is the data the user can keep it here, ok. No operation here can be used more than once, NOP that is no operation can be used more than once in a packet there is no operation option is also one byte option used as a filter it normally comes before another option to help align in a forward slot, ok. Below figure this figure is used to align one 3 byte option such as window scale factor and one 10 byte option such as the timestamp here just you can see kind even the previous diagram we have used kind 0 and here we have used the kind 1 that is no operation option here no operation option we have used and then 1 byte option, ok here the 10 byte option is there in this one the user can add the any data this is a 3 byte first to this part second this one part and third one is a this this byte, ok there are 3 parts can contains one is a 1 byte 3 byte option 10 byte option and data this is a user want to keep any data in the time the user can keep the data in this place, ok. Maximum segment size m s s shortly we can call it as m s s that is maximum segment size the value of maximum segment size is determined during connection establishment and does not change during the connection it means maximum segment size we have to use in the TCP connection establishment phase only, ok. Maximum segment size option defines the size of the biggest unit of data that can be resued by the destination of the TCP segment. Since the field is 16 bit long the value can be 0 to 6 double 5 3 5 bytes, ok. Here it means the maximum if the user is transmitting some data from the client to the server then it can determines the maximum size of the or maximum segment size used while transmitting that can be determines in this maximum size maximum segment size, ok. m s s is determined during the connection establishment each part defines a maximum size can contain different or maximum data each part can defines m s s for the segment it will resue during the connection, ok. If a party does not define this the default value is 536 bytes if the transmitter have not defined then by default value will be 536 bytes we have to, ok. Kind here we have 0 it is also size is 1 byte and length of that is 1 byte that is here maximum segment size is here 2 byte this is maximum segment size, ok. The window scale factor the value of the window scale factor can be determined only during the connection establishment it does not change during the connection whatever we have used in the maximum segment size, ok. The window size field in the header defines a size of the sliding window concept. Sliding window concept already we have discussed in the previous video that concept we have to use in this part, ok. This field is a 16 bit long 16 bits long which means that the window can range from 0 to 6 double 5 3 5 bytes, ok. This seems like a very large window size it still may not be sufficient especially if the data are retrieving through a long fat pipe, ok. It means it whatever the size we have used it is not sufficient because while transmitting the data lot of space is required, ok. To increase the window size window scale factor is used, ok. If the user want to increase the size of the window it means that time the user have to use window scale factor. Here the new window size is found by first rising 2 to the number of specified in the window scale factor, ok. Then this result is multiplied by the value of the window size in the header, ok. The formula we have to use new window size equals to window size defined in the header into 2 raise to window scale factor. This formula we have to use. This figure can show the window scale factor that is here it can contain a kind, length and scale factor. Kind can define 1 byte, length is 1 byte and scale factor is also 1 byte, ok. Now, think and write it can contains the one question, list some use of option field in TCP protocol, ok. There is some use of option field in the TCP protocol. Pass the video now and answer the above question. The answer for the above question is the option field in the TCP header. This is extra field as I said while discussing initially the extra space or extra field is available to the user by transmitting the data either user make if any data in this field, ok. Even packet format also can contains the user data gram can contain this field, ok. The TCP segment has option field that consisting of 0 or more 32 bit words and provides a way to deal with limitations of the original header, ok. This the MSS that is maximum segment size is defined as the largest block of the data the sender using TCP will send the send to the receiver, ok. And it can be transmit this part of the maximum largest size of the part while transmitting any data from the client to the server, ok. Option field, timestamp as we have already discussed about the TCP options. So, while discussing about the TCP options we have discussed about the different types of timers. Here is also it time timestamp is a 10 byte option with the proper format and at the end at the end the with the active open announcer timestamp in the connection request segment that is syn segment. Here if the user want to transfer the data from one user to another user they can use the timestamp it means how much time it will take to transfer the data from client to the server to identify that the user can use a timestamp, ok. If the data is not reached to the destination they how the user have to wait for maximum time and after that he can go to the reset the time and then they can resend the data. If it is resues a timestamp in the next segment that is segment plus acknowledgement from the other end it allows to the timestamp, ok. The timestamp option has two applications it measures the round trip time and prevents a wrap round sequence number. It means round trip time it means whenever the user want to transfer the data if that data is not resue to the not reach to the destination the user can wait for maximum time after that once again he can reach at the time and then once again he can resend the data that is round trip time. This one we have already discussed in the previous video and it can prevents some sequence number also why we have to use a sequence number it means to identify the how many package how reach to the destination or not based on the sequence number the user can identify the reach data in the receiver side, ok. This is the diagram of the timestamp kind can contain 8 length and then times of values or timestamp echo reply can contain this, ok. This is about the timestamp. This is the reference I have used to prepare the above PPT. Thank you.


What is it against the Patriots defense that is different if there's anything because Bill Belichick's over there for you going into the game week? Well, he's the best coach of all time. GM2 probably, by the way, GM2. Yeah, I mean, he's a legend, living legend, and he's been ahead of the game for a long, long time. He makes incredible in-game adjustments, half-time adjustments, third-quarter adjustments, fourth-quarter adjustments, whatever it takes.  We figured that out in 2014. Not those before. They wanted to take away Jordy and Randall. We went to Devante, and they wanted to take away Devante and went to Jordy. They really take away Jordy for sure and Devante. We went to Randall. I mean, that's what they do. They're always mixing it up. There's different fronts. He's added an extensive zero-blit scheme to the repertoire, but he's a fantastic coach and he just never know exactly what you're going to get, but you've got to be ready for all of it.


We have a husband and wife here and both of them received their healing today This man here he was using this walker for the past 16 years And now he's walking free for the glory of God Wow And this woman here she was using the cane in the hand right here for the since 2012 so she came With the cane since 2012. She's been using the cane. Yes, sir. Okay, and this man Was using this walker for the past 16 years due to an injury on the job But today he received his healing and now he can walk freely without having to use this walker Let me see come walk this way Give Jesus a glory. Give Jesus the glory 16 years and look at this and she's walking too Wow Where do you guys come from? From Mexico Vienen Wow Lima The Michoacani qualima y como cómo se enteraron de esta reunión. How did you find out about this service? My daughter my daughter's in there my bigger daughter. Oh, so you daughter girl of faith It kissing Tieron cuando dió los toco. What did you feel when the Lord touched you? And we was happy Yeah, and I feeling like you know the pain work way when they started singing, you know singing I had a really bad pain because I fell like 45 no on Monday I fell I take him to an appointment and I tell him hurry up honey because we're gonna be late to your appointment And I don't know where I fell on the floor and I hit right here And I the pain was really bad and then this person pray for me and I start moving my leg Wow, and I went to the bathroom and then I walked with out of the cane Without a cane How many years did you have that came for this and this is how many how many years did you have the cane? I had a cane since I had a car accident in 2010 and then I cannot get it out of the bed So the doctor gave me the cane in 2012 About six years and one touch of Jesus is totally healed and how long did you? Even the doctor say they when I'm with my surgery Yeah, and the doctor say I died with the pain in my low back and my leg, you know It's like why I fell all the time. What happened. Why did you have this problem? And when the pastor start, you know The person and I started a feeling something had right here in my body, you know and And He offered for my wife and the chair after I'm feel better after that I was scared to walk and after that for my wife It's my wife So you want the chair over there and he's he doing again for me and he a star he started He gave me the hands and start walking, you know to the chair and I sit down right there And he hit my legs and see my feet. Yeah Yeah He say when it's short and when I start growing up More bigger. So one leg grew one leg. Yeah Like sure the the website this is awesome. Yeah, after that I I'm working fine. No pain or nothing. No, man. I can see walk over here 16 years and look at him walk in Jesus name I Can't get a surgeon of the spirit of santo.  See her to soh-hs Stevens stretch your hands towards him. Lord. Thank you for this miracle Blessing Lord may he go back to Mexico and be a testimony of your glory and your kingdom that you power to put her The sienna so real talk a little spirit of santo Thank you Toca to a hamada jenna la de tu amor de tu presencia que se vaya jenna de tu gozo De este lugar a tijer susia toda la gloria toda la honra Give Jesus a big big hand of praise


Sukurigams, Sukurigams. Don't you know everyone wants to g- I don't know. Ha ha ha ha ha! This episode... Uno, dos, tres, cuatro. Quatro! Game is de la toca! Uh...  I am Corbin. And this is Rick. I just realized we should learn how to count in Hindi. Yes. Please let us know. Yep. Ha ha ha ha! Uh... Please follow us on Instagram! Come on! Juicy! God turned! It's so juicy. Ha ha ha ha ha! So today, for you couple people that like these sacred game reviews. Six or seven of you. Ha ha ha ha! Uh... We are now on episode four. Ya boy! Uh... So the last one... Spoiler alert! If you haven't watched Sacred Games, go away. Obviously, spoiler alert. Go watch it. Um... But the last episode we left off with uh... Which one number three? Yeah it was three. She got a call from um... What's his face? Uh... I have a bad guy's name. Bunty. Bunty. Yeah. She gets a call from Bunty's... Or somebody in Bunty's party saying we'll meet you in 30 minutes. Right.  And then we found out. And then we found out. It was almost exactly what we thought was going to happen. That's true. Ha ha ha ha! And we liked it a lot. That was our favorite episode of the three. Yeah. So far. What? The third? The third? Yes. Absolutely. This one... Halfway through the first episode of episode four. Halfway through I'm like, okay wow really you're going backwards guys. Yeah. This is like boring. Um obviously but then obviously halfway you get to old school what's his face again. And that's the really enjoyable part of this. I'm sitting there taking notes right? Yeah. The first half of it. And I'm like, okay Sartaj is a good guy. I like that he's a good guy. How long has Bunty been in that wheelchair? Yeah. That was interesting. It was. Yeah. I wasn't expecting that. So that was. And then the real business is politics and then it went back to, what's his name, Nawazid and Siddiqi. Yeah. And Kuku. Yeah. Gaitande. Gaitande. Oh yes. Gaitande and Kuku and then I stopped taking notes. Yeah. He has always been the most interesting I think in this whole... Yeah. The whole thing. For me it's even more so her and even now after this episode even more. It was totally almost, at least it seems, off topic what the surprise we got. I know. But I was like, what? What? Did you see Crying Game years back? No. Do you know about Crying Game? I'm surprised you have not seen Crying Game. I don't know that it is. Is that the game you play on this channel to see if I could cry? Yeah, that's it. No, it is a movie that came out long, I'm talking probably 93, 94. I was 2 or 3. Well, you wouldn't have seen it then and that's all I'm going to tell you was that scene reminded me of the movie The Crying Game. Okay. That's all I'm going to tell you. Yeah, but it was so interesting. I was like, because they were in... I was already into it because it was Noa's at NCD, his character, and he's just so good. Yeah. He is so, what? A lot of charisma and he's just so good at acting. Yes. And he's just so fun to watch. And I was trying to figure out who he emulates and he's like a young al Pacino. Very much. And that whole rewind sequence is after watching it now for several episodes, it really is beginning to feel like the Godfather. Yeah. It's giving me that sense of the characters and the culture and the time. So yeah, now he doesn't have for me the weightiness and this is not a fair comparison but like Amitabh Bachchan, his weightiness is just frickin' ten tons of screen presence, right? But I mean, we haven't seen him in an epic scene yet. Correct. Which is why it's so crazy. He's been small most of the time. You know who it is? It's more for me. He's more De Niro than he is Pacino. Yeah. A little bit more De Niro-y. Yeah. But he's got his own thing going on and those two, man. So I'm guessing in the future when shit starts to hit the fan that we're going to see him in some epic scenes. For sure. So that's what I'm hoping but we haven't really seen that. Like we've seen Amitabh Bachchan give some epic speeches. Right. We've seen him do all that kind of stuff and so that's why. He really hasn't had his cathartic moment yet. Which is why it's so crazy because he's been so impressive but being so minimal. Yeah, doing so little. Which is great. Yeah. That's hard to do. Very hard to do. But yeah, the big surprise in this one at least unless we've missed something totally was. Yeah. If there was something else besides this. Cocoa or cuckoo? Cuckoo. Cuckoo. Yeah. You just randomly saw her, like she was trying to tell if she was a bad person. Like he was trying to tell Noazah Denzedeki, that guy. Right. He's trying to, he's like, oh are you with her?  Right.  Right. When she did that, I thought she was just playing a mind game on the guy. I didn't think there was anything to that. Yeah, that's what I thought. I was like, wow, that's impressive. Yeah, wow. That's a, that's a trip. What is going on? Yeah. Yeah, that's all. It left me with that. Yeah.  Right. Okay. Yeah. Did not see that coming. Not at all. Totally. I don't want to see, but then at the end of the episode, when he was like, that's the last time I, did you see, saw or saw her smile or? No, he said, and that was the last time. I think he said, that's the last time I saw Cuckoo because she basically told him to go because he was going to be this big shot and she was just going to bring him down. Yeah. She was going to bring him down. They could never have babies and people since she, I don't know what exactly she was, but that they would kill him because some religious reason I'm guessing or something. Well, I guess, yeah, because she was transgender. So the entire thought of if it was ever found out that she was she transgender or was she a hermaphrodite? No, she was, she's, I did some research after that on the actress who plays Cuckoo to see, because she's so good. Yeah. She's phenomenal. I thought, did they hire a transgender actor? Yeah. Did they? No. It's a woman. It's a woman. Yeah. Woman playing a trans, and it says specifically that Cuckoo is a transgender. Transgender. Okay. Yeah. So, but that says also look down upon a lot of societies. Even still. Yeah. Yeah. So back then, which was the 1970s, it would have been totally not okay. But then somebody was obviously attacking them at the end. Yeah. Well, it was, it was his rival. His rival. That's right. Who Cuckoo was with before. Yeah. That's right. Right. They came, shot the place up. Yeah. Which was a very epic. That was the same scene, right? Yeah. I love you. This is the gangster moment. The gangster slow-mo. Just kind of slow-mo walking. Very starving. Boom. Boom. I don't care. Boom. Yeah. Shoot me. Boom. Say hello to my little friend. And then at the end, I didn't quite know who he was saying, because obviously somebody pulled the gun on him right at the end. And he says, right, what's his face says hello. I don't know who that was. I don't know what's going on.  Yep. You probably all know of guys. That's... Is it the guy? Is it his rival? I don't... I didn't recognize the name. And so... Me too.  Because he had him point blank. So there's a reason...  Right. Or did we? Or did... Yeah. That would be freaking cool. If he's like a character that like the... What are the guys from Game of Thrones? The... Oh, the faceless man? Not the faceless man. The one... Six times. They're a group of the firemen. The... Oh. The... Of the fire... The fire priesthood or whatever they are. Yeah. I forgot their names. Anyway. So yeah. Maybe... Maybe they... He dies and comes back multiple times. No spoilers! If you've seen the series, don't put that in the comments, please. But yeah. I'm... I'm hoping that... Because the begin... Like I said, the beginning of this episode was probably the most disappointing. Flat. It was... I... I enjoy what's his face. The... Sartage. Sartage. I enjoy Sartage. But he's our good guy. A lot of the scenes just... I was like, get to... Get to the... No other density keys. Yeah. Or at least continue on with something that's... It was flat. It was a lot of rehashing of what was happening before. Correct. And so I'm getting to the end. I mean we're right in the middle now. Right. And so we have what? Four or five, six, seven, eight. So we got the four episodes left. So we got the four episodes left. Four more left. So something's going to happen. I'm guessing. Right. But it's... That was... I'm hoping that's going to pick up a little bit. Yeah. And the other person I like... This was the first episode we're really getting to know him now, I think. Is Bunty. Oh, yeah. And that guy is good. He is good. Really. That whole... And I'm interested in him. And why is he in a wheelchair? Yeah. And... Yeah, why is he in a wheelchair? The relationship with obviously the woman who is the restaurant owner who is now also, we get her both in flashback and we get her right now. Oh, yeah. Because she brought the food member in the room. And she yelled at the guy for beating up his sister. Uh-huh. And she was like, women are goddesses and I like her a lot. I like her. I'm hoping she... Yeah, she goes and she throws... I love when she throws the boiling water. Yeah. Says it'll be boiling water the next time. Yeah. Yeah. She was awesome. I'm hoping she sits on the throne. Yeah. I like her a lot. Yeah. She also was the first one that was in my notes. And I'm guessing this is where we're going to go with this. I felt like this has all been preamble to what the major story is going to be, which is the corruption of politics and the mafia's connection to the political world. Yeah. And how that plays a bigger picture in this than we probably even know yet, as well as the religious tensions and the games that are being played between the Hindus and the Muslims. And how the mafia and the political elite are going to use the antagonisms to inflame them to get what they want politically, which pisses me off. Yeah. And still happens today. Not just in India. It happens all over the world. Yeah. So I'm really looking forward... I've been waiting for that shoe to drop. Yeah. Like the mind-bending political spiritual... I thought it was going to happen this one and then it was a completely different shocker, which was cool. Very cool. But that was one of the points that was so frustrating upstate for you probably the first 25 minutes of this was like, come on guys, you've baited us real as in. Yeah. But the second half was worth it. Yeah. It was. And so I'm hoping they'll continue that. Yes. And the whole episode is as interesting as the second half. Yeah. Don't let go now. I don't want another half episode where I'm looking at my watch and what's going on. Yeah. So let us know what you thought. Do not give us spoilers, please. And yeah. More Nwazid and Siddiqui and the actress who, I'll not say her name right, but it's Cooper. I think it's Sate. Okay. She's just... No, no. She was so good. I thought this is a transgender actor. Yeah. Man, she's good. Yeah. Love you. She is so good. Good stuff. Episode 5 next. Suckers gobs!


Joe Biden He keeps putting his foot in his mouth. He can't help himself. So last week he not once but twice Defended the 1994 crime bill. He defended it Which is unbelievable because it was an unmitigated Disaster now if I'm advising Joe Biden if I'm on team Joe Biden and I'm getting paid to Strategize for him. This is what I tell him one never ever mentioned the crime bill But if it is brought up to you, which it will be you always apologize and unequivocally commit to undo the damage caused by the crime bill because objectively speaking It was a disaster. It exploded the u.s. prison population and Exacerbated this crisis this this mass incarceration crisis, which was already a problem, but it made things a lot worse So that's what I would be telling Joe Biden However, the people closest to him aren't really instructing him to do that. Otherwise He would have not bragged about the crime bill But nonetheless, you saw what happened when his senior advisor Simone Sanders tried to defend his remarks She utterly face planted. So with that being said Joe Biden I've said this once I'll say it again. He is a threat in the event. He becomes the nominee He could very well lose to Donald Trump because Donald Trump can weaponize these issues exploit these things That are very big weaknesses that hurts Joe Biden And use them against him in the same way he did this to Hillary Clinton when it comes to trade and guess what? Trump is doing it again. He's doing what he did to Hillary To Joe Biden except this time he actually is going after Biden for the crime bill So we tweeted out anyone associated with the 1994 crime bill will not have a chance of being elected In particular, african americans will not be able to vote for you I on the other hand was responsible for criminal justice reform Which had tremendous support and helped fix the bad 1994 bill Super predator was the term associated with the 1994 crime bill that sleepy joe biden was so heavily involved in passing That was a dark period in american history But has sleepy joe apologized?  She was corrupted. Now. He was corrupt as well.  However getting to the substance here when he hits joe biden here This has the potential to be a devastating attack on joe biden because donald trump is right He did in fact sign criminal justice reform into law And it's not the end all be all but nonetheless It's still a positive step in the right direction and it had bipartisan support So when you have joe biden bragging about the 1994 crime bill and donald trump attacking him from the left I mean this could be a disaster And donald trump knows how to exploit these weaknesses how to attack Democrats from the left because let's look back at 2016 when he criticized hillary clinton For her support of nafta and free trade deals that essentially devastated the middle class Look at how masterful and I hate to call anything trump does is masterful But look at the way he played hillary in this clip and I had your husband signed nafta Which was one of the worst things that ever happened Well, that's your manufacturing industry. You go to new england. You go to ohio pennsylvania You go anywhere you want secretary clinton and you will see devastation where manufacturers down 30 40 Sometimes 50 percent nafta is the worst trade deal may be ever signed anywhere But certainly ever signed in this country and now you want to approve trans specific partnership You were totally in favor of it Then you heard what I was saying how bad it is and you said I can't win that debate But you know that if you did win you would approve that and that will be almost as bad as nafta Nothing will ever top nafta that that is just not accurate. I Um Was against it once it was finally negotiated and the terms were laid out. I wrote about that in you called it the gold standard Well, I you called it the gold standard of trade deals. You said it's the finest deal You've ever seen no and then you heard what I said about it and all of a sudden you were against it Well, donald. I know you live in your own reality, but that is not The facts the facts are I did say I hoped it would be a good deal But when it was negotiated which I was not responsible for I concluded it wasn't I wrote about that. So is it president obama's fault before is it president obama's fault even announced Look, there are secretary. Is it president obama's fault? There are because he's pushing it There are different views about what's good for our country our economy and our leadership in the world If he does that to joe biden But on the crime bill He could beat joe biden Because I don't think that donald trump's claim that you know, he'll win over black voters or that Joe biden will lose support from black voters.  And that's all he needs to do To win demonstrate that the democrat isn't really looking out for you and he could win because Democrats always lose when turnout is low So if donald trump can convince people to not vote for the democrat that can serve him very well Again, I don't think he's going to win over these voters who are dissatisfied with joe biden because of his support for the crime bill But he doesn't need to win them over in order to win All he has to do is demoralize enough voters in order to win now remember back in 2016 hillary clinton couldn't barely generate enthusiasm All of her crowds were small nobody really cared and we're already seeing the same signs that joe biden is struggling as well He's technically the frontrunner right if you look at current public opinion polls and averages But he's suffering from the same enthusiasm gap that hillary clinton suffered from So what donald trump could do is capitalize on this by pretending to be a populist again Hitting joe biden from the left in an area where joe biden is objectively terrible And that could be enough to discourage the democratic party base From coming out to vote for joe biden and trump could win and joe biden Even if i think he is a little bit more strategically savvy than hillary clinton he could potentially be more vulnerable because Donald trump doesn't just have the crime bill where he can hit biden from the left joe biden also voted for nafta So we can replicate the exact same attack That he used in 2016 joe biden also voted for the iraq war trump can use that as well So if joe biden becomes the nominee This could be a disaster Now what matters is how joe biden responds to this if he's actually going to be apologetic about the crime bill or If he's going to continue on with this trend of narcissism and brag about it I mean the fact that he would brag about the crime bill is honestly absurd But it's joe biden so you never know so here's the thing if i'm joe biden How do i respond to this if i am smart First of all again you apologize for the crime bill but the second thing I think maybe it could work if he called out donald trump's pro crime pass because he actually has A relatively dark history even if he wasn't a politician when it comes to the issue of being tough on crime Because as eugene scott of the washington post writes while trump is taking credit for criminal justice reform His track record advocating for harsh responses to criminal activity greatly proceeds his political career Most notably his affiliation with the central park five a group of five teenagers was wrongfully imprisoned Following the brutal sexual assault of a woman in central park in 1989 The teens were deprived of food drink and sleep for more than 24 hours before they falsely confessed to the crime During the 2016 presidential election use of salam one of the teenagers wrote about how the current president responded to the headline grabbing story for the washington post During our trial it seemed like every new yorker had an opinion but no one took it further than trump He called for blood in the most public way possible He wrote trump used his money to take out full page ads in all of the city's major newspapers Urging the reinstatement of the death penalty in new york I don't know why the future republican nominee bought those ads But it seems part and parcel with his racist attitudes trump has never apologized for calling for our deaths In fact, he's somehow still convinced that we belong in prison salam added It's further proof of trump's bias racism and inability to admit that he's wrong And if i'm joe biden, i'm definitely bringing up the fact that donald trump took out a full page ad To call for the death penalty of these teens who were wrongly accused Now is that definitely Going to help him Deflect i mean maybe but certainly he can't do what hillary clinton did right? He can't just say well. No, I don't support the crime bill anymore You have to actually play offense yourself You can't just play defense because what donald trump did in that clip Is he had hillary clinton on the ropes? He was playing offense and hillary clinton was playing defense Joe biden would be smart to actually hit back at donald trump and put him On defense as well, but we don't know if he's gonna do that and furthermore That's assuming he becomes the nominee But the best case scenario for all of us is if we defeat joe biden So he doesn't become the nominee because I don't want donald trump to get reelected And if you put up joe biden democrats You're opening the door To donald trump replicating the exact strategy that made him successful in 2016 Put up a shitty centrist neoliberal democrat donald trump does his fake populism thing and attacks him from the left Which I mean if he's attacking you from the left And there's some credibility to his claim that he's more electus on this particular issue That's really harmful. That's damaging because democrats should never be outflanked from the left by a republican So let me just emphasize We want to defeat joe biden Otherwise we could see a repeat of 2016 We could see former years of donald trump and if democrats are clearly Trying to think about electability, which a lot of them do Then you would be a fool To go with joe biden because out of all the democratic party presidential contenders He's probably the least electable. Am I saying that it's a sure bet that joe biden would lose to donald trump? No, in fact It's possible that he wins, right? There are reasons To believe he has a better shot than hillary clinton just because I think he's a little bit more strategically savvy than her But nonetheless It's still you're rolling the dice if you go with joe biden. We'll just leave that there You're rolling the dice if you go with joe biden


Okay, we're back live here in Las Vegas. This is SiliconANGLE.com's theCUBE, our flagship program, got to the events and instruct us to look at the noise. This is IBM's information on demand conference, their premier conference about information management, big data, analytics, all kinds of great stuff happening. I'm John Furrier, the founder of SiliconANGLE. I'm joined by my co-host. I'm Dave Vellante of Wikibon.org. Welcome to theCUBE. We're live in Las Vegas, IBM IOD. We're here with Mark Kettering, who's the CEO and president of Brightlight Consulting, an analytics company that works with IBM, works with the T's to help customers get the most out of their data. So Mark, welcome to theCUBE. Well thanks Dave, appreciate being here. Yeah, so we're here at IBM at the IOD. This is their big information management conference. IM has sort of become this sort of stodgy old term. Now it's think big, big data. So you've seen, you said your company's been around for about eight years. You've seen this sort of transformation from business intelligence, a lot of compliance and reporting and now all of a sudden it's exploding into big data. We're actually seeing the promise of BI put forth as, we maybe recast as big data. What do you think about that? Well, for us it's like a dream come true because in the world of business intelligence and data warehousing that Brightlight lives in, we always were attracted to the higher end of that market, it's a large multi-terabyte, the really complex requirements of a business to want to really interrogate their data to gain more insight. And of course for us, getting better answers means asking better questions and it's not just the standard monthly report, it's really about the idea that comes up in the conference room and someone runs out of the room and comes right back with the answer so you can take action. That's what's interesting to us and that's where we think data really provides the biggest bang for the buck and that's what big data I think is really all about. I mean, little data, data marts, the monthly report, that stuff's been around forever and will continue to be but big data is when you're really getting that extra insight that makes you move ahead of your competition. So I mean that existed with big large data warehouses but it certainly didn't exist in anything that came close to real time. That's right. You know, very much looking in the rear view mirror. That's right. Maybe doing some mathematical models to try to predict and do some advanced analytics. That's changing. It is. It's changing because what people are calling data today is not stuff that necessarily fits into columns and rows and a table. It could be emails. It could be a comment in Twitter and often that's what it is. And so interrogating that kind of data that's unstructured is the new challenge and going through tens of terabytes of comments out of Twitter in order to glean what people are saying about your product or your customers or your company. That's the new challenge and that's where big data really has relevance. If I think about traditional business intelligence and data warehousing infrastructure, it's sort of this patchwork because the problems are and were so hard that people would throw the latest and greatest at it as a result. They've got this mixed collection of stuff. It's bubblegums and band-aids. It's one of my clients that it's like a snake swallowing a basketball. Now you hopped on Netiza early. Yes, we did. Talk about why, what that type of architecture brought to your business and then where we're going. Yeah, yeah. So when we formed Netiza eight years ago, I'm sorry, when we formed Brightlight eight years ago, we wanted to focus just on the most challenging data warehouse and BI projects. And we very quickly saw that Netiza was taking that on and defining this space of a purpose-built device where the operating system and the database and the storage and the CPU were all hacked on to just focus on analytical processing. And that created such dramatic performance improvements that we wanted to be part of it. It was also nice. They didn't have a professional services department. So we kind of became virtually their lead partner for doing that kind of work. Now, as they've almost broken Moore's law and continue to grow the capacity and decrease the price point of what they offer, you know, they're getting into petabyte implementations. That for us and the 60 people inside of Brightlight, that's what they love to get out of bed and work with those really large, complex implementations. What are some of the barriers that you got your facing when you go into an environment? Because that's where they all see the blue sky, like they see the transformative nature of big data and analytics, as we said, it's SAP Sapphire, running at the speed of business is what people want. To get an iPad, they go, wow, I want that, right? So then comes that from the CEO down, I want that on an iPad, which basically means analytics in real time. And so everyone goes, okay, great, new work order, new job, new investment, which is great. Now, the reality is it's got to start somewhere. So take us through that process, help make the sausage and the sausage factory, as we say. And what are some of the barriers that need to come down? You know, interestingly, the biggest barrier we find people really being in a place where they want analytics is if they're doing too well.  They still believe they can get where they need to get based on their own gut instinct. And that's kind of the old business model, but it's often business that are hitting some sort of a wall of challenge, either from competition or their growth curve has stopped or there's some paradigm shift in the marketplace. Those are the folks that are saying, if I don't get under the cover beyond my instincts and look at real hard data to really correlate what's happening in the marketplace that I can bet on, then I'm probably gonna fall behind my competition. Like this morning in the keynote presentation, they said companies that invest in meaningful analytics are, I think it was 3.6 times more likely to outperform their peer group, because they've made that investment. And it's the ones that either want to zoom ahead of their competition or feel like they may be falling behind, those are the clients we find are most motivated. The other barrier we find is some of the other companies that are out there, they look at analytics and complex data as just another database application. You look at Oracle, to them it's just another note on the grid, no difference, no purpose driven device type stuff. Didn't Oracle invent big data? Well they invented a cloud, hit flash, that's right. Dot, dot, dot, I'm sure they'll take credit for all that. It's all for service. Next year they'll take credit for something else. That's right, exactly right. Probably your tie. The cube. Yeah they did, they copied it. That's right, but when we've been in competitive situations to them Exadata and what they call an appliance, it's sun hardware and an Oracle database pushed together. Beyond that it's not very purpose built, but the stuff coming from IBM and these announcements on pure data, I think it's fascinating because they're acknowledging that different kinds of data compute tasks require a different architecture. What's your take on pure systems? Because we're trying to tease that out and kind of unpack the pure system, pure data approach. Yeah and compare it to Oracle because you listen to Oracle and they put up the numbers, you know, you're coming down the escalator in Vegas and it says Oracle 20 times faster than IBM and then of course you read the fine print and you say okay that's the three generations ago of IBM. That's right. But you hear Ellison talk, very compelling, very dynamic speaker, you're, at least quasi-independent, you could use anybody you want. You don't have to use Matisse, you're not part of IBM, so you chose that as an independent. So talk about that a little bit. Well, you know, again, I think it's the acknowledgement that Oracle is the big player for relational database and tools around relational database and then thus applications involving relational database. To them, when I truly listen to what they say their BI and analytics and data warehouse strategy is, it sounds good marketing-wise, but as soon as you get into a POC, competitively and you're looking at what they're doing, they treat it just like any other database application. They don't acknowledge a lot of the differences. Analytics is a completely different data model, it's a completely different way of navigating through data and you need to organize the data very specifically to get performance out of that. Oracle, I always say they can do it, but they don't build it to do that. To them, it's a grid with a bunch of nodes and the data warehouse is just another node on that grid. So as John was asking, so compare that to pure, so pure data was announced a couple of weeks ago, what does that all mean? So pure, the pure data systems, and I listened to the presentation this morning, they're acknowledging that whether you're doing transactional reporting or deep analytics or operational analytics, those are three different functions that require a different appliance, a different system with different architecture and now what they've done is they've, they use Natesa based systems for the deep analytics, using that MPP, they use DB2 which supports a lot more concurrency, so you can have more hundreds of users doing what they call operational analytics. And then they have this other transactional thing which I think is the ISAS, the old ISAS DB2 application, but they've worked on it and really honed it down for its particular function, so a client gets more out of the box ready to go as opposed to just a database that you got to change it for this or for that or for something else. I think it's, it's pretty sharp. I have to pressure you a little bit on that because help us understand this. So Oracle's got exolytics, they got exologic, they got exadata, so they got different exes, are those just packages or, you know, that's putting lipstick on a pig, my words, not yours? Well, you know, I'm not the most technical guy in my company, so I'm sure one of my consultants could give a deeper answer as to what's under the covers, but what I can tell you is that when our customers have done POCs, comparing Neteza and Teradata and Oracle, the two things we notice is the performance from Oracle for pure analytical processing, for pure data warehousing, always lags. Yeah, which makes sense that it would. Yep, and then second, and secondly, the work they have to do to get it to even its best performance is significantly more dial turning and indexing and partitioning, and they say, oh yeah, give me another couple of days, I can make it do that, whereas, you know, like Neteza and these pure data systems, they come much more ready to do that right out of the box. So you're saying dials and knobs, think of the past, we prefer not to have that, we want to focus on the business problem. I wouldn't say it quite that binary, but yeah, less dials and more ready-to-go functionality is better in the long run. Mark, I want to ask you kind of on a different tack, more on the business model side, so you guys are growing organization, and you're in the hot space, right? Obviously, big data, and IBM, they are the 800 pound gorilla, and when they do things, it affects the market, both internally IBM's business as well as around it. We've been covering on Silicon Angle a new site called Services Angle, and we started it mainly because no one was covering the services business, including web services, cloud services, but consulting services, customer services, essentially the channel. Yes. And so the question is, this is so transformative, this big data opportunity, it's accelerating change, not only for customers, but also the delivery side. So the old guys, the Capgeminis, they want to be the outsourced partner now, they want to be your, whatever their latest thing is, I'm using them as an example, the same is true for Ascension and everyone else. Those cycles are longer, and they're getting shorter, and they're not really built that way. Right. So share with your perspective, as someone who's in the trenches, you're in the vortex of this opportunity, what's it like as a channel, as an integrator, as a developer, as you're talking to customers, you've got to deliver solutions and work with IBM. So explain that whole market, what's the dynamics, what's it being disrupted, and what are some of the business angle there? Yeah. I've always loved, you know, I've been in the consulting and high tech world for over 30 years. I love this space the best of any space I've ever worked in because the opportunity to be deep in technology, and yet so quickly be directly connected to the business user, is more evident in BI and analytics than anywhere else, because it's very technical on the one hand, but it highly influences the day-to-day job of the business user. So from that perspective, the consulting opportunity, the services opportunity is really fantastic because you get to do the technical services, which a lot of my consultants love doing, but there's another group of our consultants that really love showing the business user how the technology will affect them in their everyday work and really make a difference to their decisions, their corporate performance. I have to admit- Disruption, how about the disruption? Because, you know, client server, that was a gravy train during those years, and we've been saying on theCUBE that this big data revolution is like the PC revolution and the client server together times 10 at a shorter cycle. So that's going to possibly decimate incumbents. Like the big guys out there. So what do you see as disruption points out there that affect the economics and opportunities and profits for consulting firms and the new boutiques that may grow into- Yeah, well I know you guys know that any time there's paradigm shifts, it's disruptive, you know, 50% of the market falls out because they're not able to work their way through. I'll give IBM credit. I think of all the big players over the years, they have always seemed to find a way to push through a lot of paradigm shifts and they're doing Hadoop work with big insights while they also still have a great mainframe business going on in the background. It was a period in the early 90s that didn't look like they were going to push through. I know, I completely agree. Amazing. It's an astounding. They've done an amazing job. But in terms of disruption, I think the fact that what data is is changing so quickly and where that data is going to be stored and how cost-effectively you can manage it, you know, the whole unstructured data thing is hugely disruptive. It's changing all the rules as to how we look at data, how we analyze data, you know, how we correlate different parts of data. That's going to open up a massive amount of new products and for a company like mine, Brightlight Consulting, it, we're constantly in room saying, how can we incorporate this new capability into some of the more traditional things we used to do? You were talking earlier about sort of what I would call the deeper business integration that analytics enables. That's why you're so excited about this. I feel like, I just always remember this in a flexion point, John, when Nick Carr wrote the book, Does IT Matter? And the premise of the book was essentially you can't gain competitive, sustainable, competitive advantage from technology, which I think we, most of us in this business, took offense to that. I said, oh, you've got to be kidding me. But CEOs listened. I mean, it was symbolic. And since that time, IT budgets have been down. IT as a percentage of revenue has been down. People, the mantra of doing more with less and cost cutting and budget cutting. And that is really, you know, to me underscores the fact that CEOs kind of bought into that. Ken, do you see the point at which analytics, will it live up to its promise in your opinion? I'm asking you to make a prediction here, whereby the business will actually get meaningful productivity gains from big data analytics and it will change, this is the prediction part, will it change the IT spending pattern so that it will actually increase as a percentage of revenue? Well, the first part, I think what's going to make it, you know, really be success is not the technology as much as it is the people issue. We find the companies where analytics is having the biggest impact, is when you have a visionary executive, you have an executive champion that sees the power that it could provide and basically wills the organization to wrap their arms around it, not around just the expenditure for IT to build the system, but for the entire user community to incorporate the analytical process into the fabric of the culture, how we do business, how we make decisions. You know, we go back to the data constantly and we look at the data and we ask new questions about the data and we demand a system that will respond to that. Now in terms of how it will affect the IT spend. Yeah, wouldn't IT spending be proportional to that? You know, my experience is that there's been paradigm shifts all along the way and the IT spend drops other things. I really don't see it that way. I don't see it causing a big spike in IT spending. Because of the advancements in technology, because more is lost. Yeah, yeah, I really do, I see that. I see the big opportunity with analytics is how it empowers end users and end users getting more self-service oriented. Expecting less from IT. IT, I need that report, when can you get it to me? No, it's more like I can go and get that report myself. So I actually think it's going to happen. I just think it'll be, you won't be able to count it because it's going to be so blurred, the lines between technology and business are going to be so intertwined and so blurred, you won't even be able to meaningfully count it. I mean, Dave, I think that book is so off base because it's like, it's so going to happen, but the thing that we're trying to track down is how. And one of the things that we've been trying to vet out and we're dancing around it and talking about it here, Mark, is on the consumer side, it's pretty clear. Personalization matters, right? We had some user experiences with Jeff Jonas. The resistable experiences solves the privacy problem. Interesting angle there, but okay, so personalization's good, but now you look at a business, how do you apply that kind of personalization to business processes? App store. We had the guy on from IBM Answers talking about stuff that they're doing. So this is going to create kind of a whole new mindset around IT. I think it is too. You have a perspective on that? Well, I just see that if you look back through the history of IT, it was about, it was always almost like a service bureau. You knocked on the glass wall and asked for things and IT produced it for you. And then suddenly about 10 years ago, there was this focus on service levels. IT's starting to treat their customers like customers. And now I see it almost like IT is going to evolve to where they're a fabric, they're in the background and they're running things, but it's all self-driven. It's all user-driven. They don't have to ask IT for things. IT just delivers up all the interfaces for anything and you ask your own questions and data. And IT fabric like. Yeah. I see that as really possible and of course the cloud is going to drive a lot of this because if you don't do it and if you're not cost effective, out to the cloud and your department's liquidated. My last question, if Dave has one, we can go there, we got to go to our next guest but consumerization of IT, converging infrastructure, all that's happened, software-led infrastructure, we're calling it. Shoot the arrow forward five to 10 years out, knowing what you know. You've seen a lot of business cycles. You're excited about the tech and the business, touch points here. Yep. What's your vision for the next five to 10 years? With big data and more compute, ingestion of tsunami of data, vertical markets, just green field opportunities for new kinds of apps. Self-service enterprise, this kind of thing. What's your vision? How do you see the half-shaped marking shaping out? I think we're all moving to the matrix. I think that's, and I say that facetiously but in a sense, I see us moving to a real-time world eventually where the data is always just flowing and you start pulling what you want out of the data, out of the river. It's almost like you're fishing because instead of the data being something you have to go get, it's just moving in front of you all the time. You've just got to pull it out of the river, out of the water. You've just got to pull it out of the river and you'll have monitors that say, well, the data that's going past us is saying this and you pull it out of there and you can see it. I see that happening. IBM Streams product is starting to, it's a very complex product now to use but utilities, they're starting to use it in utilities so all of your meter readers are constantly pulling data and it's just moving in real-time and then you just grab it and put up results. I see that's probably the trend where all this is ultimately heading. Yeah, we had a CUBE interview with the CEO of Bleco. He was involved in Firefox, Netscape, and he's an old-time tech geek like us and he said everything that was ever invented will be invented was on Star Trek. So I'll add that the vision is the matrix plus Star Trek. There you go, there you go. Mark Kettering, thanks for coming on theCUBE. We appreciate it. Bright Light Consulting, congratulations. Folks, go see Bright Light Consulting. Great, great friend, we got to know them. They're our neighbors here inside theCUBE. They're booths right next to us, great group of people. Enjoy kind of hanging out with them here. Live at IBM's Information on Demand, this is SiliconANGLE and Wikibon's theCUBE, our flagship program. Extracting the signal from the noise, we'll be right back with our next guest after this short break.


David, good morning everyone. So I'm Trevor Perrin with OpenWhisper Systems and I'm gonna be talking about the text secure protocol for encrypted text messaging. I'll start with some background about whisper systems. It's an open source project founded by Moxie Marlin Spike with the goal of making private communications simple and ubiquitous. The main focus of whisper systems is the text secure protocol. This protocol is used by our own apps which are Signal for iOS and Text Secure for Android. It's also used by a couple other systems like Sanogen and WhatsApp. In general we think this is a good protocol where we'd like to see other people adopt it and we'd love to try to make it a more widely supported standard for secure and encrypted messaging.  I'll start by talking about the sort of the threat model and the goals for this protocol which are pretty straightforward. It's an encrypted end-to-end messaging protocol. So when I send a message to someone else, I wanna encrypt that message on my device so they can decrypt it on their device so that anyone in the middle can't read the message, can't tamper with the message or can't forge the message to make it look like their messages are coming from me. So that's like very standard kind of cryptography sort of objectives. We wanna do these things and we're gonna talk a lot about this but we also wanna do these things in a forward secure manner and what that means to me is that if someone steals my private keys, whether that's hacking my device or stealing my device or the keys leaking out through some side channel or other means, we wanna limit the damage that that does to my messages and to my security. In particular, we worry a lot about the case where someone might say hack into like a messaging server or an email server, steal all the archived messages there that go back for a long time in history or someone might be eavesdropping and observing on messages at a large scale and we don't want that attacker to be able to choose anyone to attack, steal their keys and then go back and decrypt all of their messages. So we're gonna talk a lot about how we can change keys and make sure keys evolve over time so that compromise of a single key has a limited effect on the security of other messages. The trust model for this is an end-to-end trust model. So we want to not rely on infrastructure, just rely on the security of people's own devices and their own systems as much as possible, but we're gonna need a certain amount of infrastructure to make this practical. We're gonna need some key directories and we're going to try to design things so that you have to trust these as little as possible and you can verify that they're behaving correctly and we'll talk about how users can do that. So that's a little bit about just the goals and the trust model that we're gonna be trying to achieve. The components of this protocol, which I'm just gonna sort of talk about in order, are firstly, the heart of it is really just a two-party protocol for sending authenticated and encryption messages back and forth and with forward security and that protocol basically has two phases. There's an initial phase which happens in the very first message that someone, let's call her Alice, sends her first message to someone else, let's call him Bob. So when Alice sends that first message to Bob, she fetches some of Bob's keys from a server, she calculates what we call a key agreement, gets a special session key, when Bob receives that first message, he calculates a matching key agreement, gets the same session key and then they're gonna use that session key to encrypt not only the first message but also all subsequent messages. So there's an initial sort of key agreement phase that happens in the first message. For subsequent messages, we take that session key that was established by the first message and we keep using it and we roll it forward and update it as we communicate for forward security and we do all this because it's sort of more efficient to do a bunch of expensive things in the first message and then just kind of reuse those things for later messages. So that's why we have this sort of two phase stateful protocol and I'll be saying a lot more about how that works and the details of each of those mechanisms. Once we've got that two-party protocol set up, then I'll talk about how we can extend that to a multi-party case, like where there's group communications and to a multi-device case where a single user might want to be sending or receiving messages on multiple devices that they own. These are other cases we want to generalize the protocol to handle. And then finally I'll talk about how users can authenticate that the key directories are actually giving them the correct public keys for each other without having man in the middle attacks. So that's the basic outline of this talk. So let's start at the beginning, start, talk about just how a two-party, encrypted and authenticated messaging works in the tech secure protocol. As I mentioned, it's a stateful protocol. We use the first message to set up some state that's more expensive than we're gonna reuse that state over time for subsequent communications. And so we're gonna start talking first about the first message and what happens in that pre-key and key agreement process. And we're gonna assume that there's a setup that looks kind of like this. So Bob is gonna have a public key, he's gonna publish this public key through some directory where Alice can retrieve it. What exactly this key directory is, it could be different things from the protocol's perspective in a more centralized messaging system. There might just be one key directory that has everyone's public keys. If you think of a more federated or distributed system like email, you could imagine everyone's email server hosting their key directory. And so if Alice goes to send a message to Bob, she contacts his email server or something associated with it to get Bob's public key. But from the protocol perspective, we don't really need to care about where this comes from as long as Alice can fetch Bob's public key from somewhere. So let's assume she can do that. The question of how she knows this public key is authentic is really, is Bob's correct public key? That's a good question. It's a question we're not gonna answer right now. We'll get to that later. For now we're just gonna assume that Bob is going to, Alice is gonna use that public key she fetches. They're gonna trust the first key they see. This is gonna be a sort of trust on first use model at the moment. And we're just gonna talk about the mechanics of encrypting and authenticating messages between Alice's public key, sort of to Bob's public key. So we could kind of simplify this situation like here. We see Alice and Bob. We see Bob having a key pair, which is a private key and a matching public key. He's publishing his public key through a key directory and Alice is fetching it. These key pairs are going to be elliptic curve key pairs. We use the curve 25519 elliptic curve. And so that will be true for all the public and private keys that I'm talking about here. So that's like a 32 byte public key, for example, that Alice fetches. So you might look at this and say, okay, so this is a pretty simple setup. This is really easy to do encrypted messaging within. Alice just has to say, come up with a symmetric key and AES key, encrypt the message with the AES key, encrypt the AES key to Bob's public key, send all that to Bob, and she's done. She's sent an encrypted message. And you could do that and it would work, but you would not have forward secrecy then, or you'd not have forward security, because all of those messages that are inbound to Bob then, it would be encrypted under Bob's long-term private key. Someone can steal that private key, decrypt all of those messages. So we're gonna wanna do something a little bit better than that. And there's a couple things we can do. So let's talk about some options. One thing we could do is we could give Bob not just a long-term identity key, this key, but he could have a bunch of one-time use key pairs as well. He could generate like 100 one-time, what we call pre-keys, publish these pre-keys to his server. Then when Alice wants to send him a message, she fetches one of those pre-keys, encrypts the message so that it can only be decrypted by Bob who knows his long-term private key and his pre-key private key. And then when Bob decrypts the message, he can delete that pre-key private key right away, thus making the message undecryptable if he gets compromised. So that gives very good forward security because he's deleting a key the message was encrypted under immediately upon receiving that message. So that's very strong forward security in a sense, but there's a couple problems with this setup. One of them is that Bob might run out of pre-keys. He's publishing 100 at a time. As they get used up, he's gonna publish more. But so it's sort of unlikely in regular usage, say that Alice or someone is gonna send him like a hundred new messages from a hundred new parties before he has a chance to publish more pre-keys, but that could happen and it particularly could happen if someone is aggressively trying to steal his pre-keys to just kind of denial of service the system or degrade the security properties that Bob gets. So that's something we'd worry about a little bit. Another thing to worry about is that the key directory could lie about Bob's pre-key public key and it could serve Alice's correct authentic identity public key, but an incorrect pre-key public key that it knows the private key for. And that's kind of a weird attack. If it did that, Alice would encrypt a message that Bob can't decrypt. It would be kind of this weird broken message, but that message would also not have forward security because the attacker would just have to go and steal Bob's private key by itself to decrypt that message. So those are a couple kind of downsides to this system. So let's consider an alternative system. An alternative would be to have, instead of one time pre-keys, have pre-keys that are signed and that change on a timed basis. So Bob can use his identity key pair to sign a signed pre-key public key, post that key up. It'll be used for all messages that people send to him. I'll first message his people send to him for a week or so. And then he periodically signs a new key and replaces the old key. If he does this, we've sort of fixed a couple of the problems with the one time system in that this is not a one time key. It doesn't get used up. He's not gonna run out of it. Also it's signed so the key directory cannot lie about what it is and provide a false public key. The downside to this system is it doesn't have as optimal forward security as the previous system because Bob's holding onto that pre-key for a longer period of time. He's not deleting it right away. So if you think about the signed pre-key system and the one time pre-key system, they have sort of complimentary strengths and weaknesses. What we do in tech secures, we just do both. At any point in time, Bob has a long-term identity key. He has a signed pre-key. He has a bunch of one time pre-keys. When Alice goes to send him a message, she fetches his identity public key, his signed pre-key public key, a one time pre-key public key, if that exists. And she's gonna use all these to do a key agreement to send him that first message. So that's kind of the setup that we have. We can simplify it a little bit like this. So under Bob's column, we see the things that Alice is fetching from the key directory when she wants to send him an initial message. Under Alice's column, we see the things that Alice is gonna need to send in her initial message for Bob to complete the first phase of the protocol. And so just like Bob has a long-term identity key, we're gonna say that Alice has a long-term identity key.  So we have this setup of keys, of elliptic curve public keys. And what we wanna do, the calculation we wanna perform is to take all of them and construct a shared session key that Alice and Bob both share and that's known only to them. Because if we can get to that point, then we can use that shared session key for encrypting the first message and also all later messages. So we wanna get a shared session key that has forward security, but that it also is sort of authenticated so it's only known to the holders of Alice and Bob's respective private keys. So how do we do that? In an RSA world, if we were using RSA cryptography instead of elliptic curve cryptography, we could just think of this as like a public key encryption problem. So Alice could take all of Bob's two or three public keys, she could encrypt secrets to each of those public keys, hash those secrets together and call that the session key. The downside to that is that then Alice would be sending hundreds of bytes of ciphertext for each of those encryptions in her first message. So we don't really wanna do this, we want this to be a very efficient protocol. Luckily we can do something a lot better than that with elliptic curve cryptography. We don't have to do public key encryption, we get a better operation which is Diffy-Helman or elliptic curve Diffy-Helman. And what Diffy-Helman key agreement lets you do is it lets two parties with a key pair, with a private and public key, look at each other's public key, and only by seeing it they can calculate a shared secret that's only known to those two parties and they don't have to send any other data to do that. So that's really nice and we can use that in this sort of system. If Alice wants to come up with an agreed upon shared secret key that's only known to her and Bob that has forward security, all she has to do is add a sort of one time ephemeral Diffy-Helman public key that she freshly generates for this message. She adds its public key into her first message and she just calculates a bunch of Diffy-Helmans with all of the keys from Bob that she got. And so she just has to send an extra 32 bytes in her message, she doesn't have to send hundreds of bytes of RSA Cypher text. These are relatively fast operations that she constructs and gets the outputs of all these Diffy-Helman key agreements, hashes them together to get a secret key. And so that's gonna be part of how she creates the session key. So that's a simple and efficient way of doing things. What it doesn't do yet, what we haven't done yet is we haven't authenticated that this session key is known only to Alice because anyone could have created an ephemeral key and sent this message to Bob. So we also want to mix in something that authenticates Alice and we could do that a couple ways. In an RSA world, we could have Alice sign the message, do like an RSA signature, but again, that means we're adding hundreds of bytes of signature to the message. And once you start signing message contents, you lose a property you could call deniability. So Bob could take a signed message and show it to anyone else to prove to them that Alice said something that might have been embarrassing. So we don't wanna add that property into our system, we'd rather not create these permanent signed transcripts of everything everyone says. So we're gonna authenticate Alice in a simpler and more lightweight way just by constructing another Diffie Helman and hashing that into the session key as well. So we're gonna say Bob's signed pre-key is a relatively fresh key. We're just gonna do a sort of Diffie Helman between Alice's identity key. That's kind of like Bob challenging Alice to prove knowledge of her long-term private key. We hash all those things together and this is the key agreement that TechSecure does in an initial message to get a shared session key between Alice and Bob. You can look at this a couple ways. We tend to call this a triple Diffie Helman key agreement because if you look at the core here, there's really like three Diffie Helmans that are particularly kind of crucial. The ones that involve the identity keys are basically the other party challenging each other's identity keys. So those are serving for authentication. The one or two Diffie Helmans on the bottom are really just adding forward security because these are between more ephemeral keys that get deleted quickly. Once those private keys get deleted, you can no longer reconstruct the output from these so you get forward secrecy from them. So that's the function that's served by all of these calculations. So that gives us a good shared session key between Alice and Bob. But we don't wanna do this process on every message Alice sends because it's expensive.  So we don't wanna repeat this on every single message. What we wanna do is just take that session key and use it repeatedly in a more efficient way. But if we just use it directly to encrypt and decrypt every single message, we wouldn't get any sort of forward security. So now the question becomes, can we update that session key as we use it in a way that's more efficient than this, but also is gonna give us forward security if it's compromised? And so we could do something sort of like this. And we'll call this like a ratcheting algorithm or in particular a symmetric key ratchet. And the idea here is you take that session key that they agreed on in the first phase of the protocol, you derive a sending key, each party derives a sending key and a receiving key from the session key so that Alice's sending key matches Bob's receiving key and vice versa. And then whenever they encrypt messages to each other, Alice uses her sending key to encrypt, Bob uses his receiving key to decrypt that message. Then they both hash that key to create a new key and delete the old key. And this is sort of a one-way hash function. So you can only go forward, but you can't go back. You can create new keys, but from a new key you can't reverse the process and get old keys. So we call that a ratcheting algorithm. A ratchet is a tool that only goes in one direction, it only goes forward, it doesn't go backwards. And so with this we get a pretty good amount of forward security very cheaply because it's very cheap to just hash a key and delete the old key and throw away the old key. So this is a nice mechanism. One small downside of this, as I've shown it, is it doesn't handle out of order messages very well. So you could imagine that if some party receives a message encrypted under this key right here, this second key in the chain, what he'd like to do, if he receives that message, let's say he receives that message before he gets the first message, what he'd like to do is decrypt that second message, hash the key to get the third key, delete the second key, and have it be gone. But he might also like to hold on to the first key in case that out of order first message actually arrives later. So that's kind of a dilemma because if you hold on to the first key, you can always use the first key to re-derive the second key so that sort of defeats the purpose. Luckily there's kind of a minor modification to this that solves all that. We can just have two types of keys. So we could have keys in the chain that we hash to get the next element in the chain. And when we hash it, we could take some extra output and create a separate message key and that message key is what we're gonna use to encrypt and decrypt. And because that message key can't derive any other keys in the chain, we can hold on to it without impacting the security of later keys. So that lets us do this sort of forward secrecy updating while also handling out of order messages when they arrive. So this is what TechSecure does. At any point in time, it has a sending chain, it has a receiving chain. They're being updated just like this so that every message you send or receive, that old key gets destroyed, new chain keys and message keys get created, and out of order messages can be handled when they arrive. So that's a very simple, a very efficient thing to do. It has a downside though, which is that if someone comes and steals all of these keys, if they hack your machine or something, get a copy of these keys, they can passively decrypt all future messages. And we'd like to have more security and more resilience in that case. We'd like to make it so that even if someone steals all your keys, they would have to do active man in the middle attacks to decrypt all your future messages because an active attack is a harder, more intrusive thing. It's easier to detect. We have some possibility of detecting it. We don't want to make it that easy to just do passive attacks based on a key compromise. So there's a different way of doing a sort of ratcheting type thing which does achieve that property in a way that this does not. And that's to use the sort of ratchet that's used by the OTR protocol. And so I don't know how familiar people are with the OTR protocol, but it does something that I'm gonna call a Diffie-Hellman ratchet. And the idea here is that it's a little bit complicated, so bear with me for a moment. But the idea is that each party is gonna have a current ratchet key pair like a elliptic curve private key and public key. Each party is gonna advertise that public key with every message they send. And each party is gonna keep track of the latest public key they've seen advertised by the other party. And so then when you see a new key from the other party, you're going to create a new key on your own and start advertising that. And then when the other party sees your new key, they're gonna create a new key and start advertising that. So it's gonna be this sort of ping pong process that goes back and forth where the parties generate new keys once they see new keys from each other. So they're just generating new keys and advertising their new keys and taking turns doing that. And as they do that, as they generate those new keys, they're also doing Diffie-Hellman between every key they received and the previous key they had and then this new key that they just freshly generated. And it turns out that if you do all that, each party ends up driving the outputs of those Diffie-Hellmans are a sequence of shared secrets and it's the same sequence from both party because they're just doing Diffie-Hellman between the same keys. And so they're both calculating this evolving set of keys that match between each party. So this is how OTR works. I'm gonna try to explain this visually and see if that makes sense. So up here we're seeing Alice, this is her ratchet public key, she's advertising it, Bob has just received that message from Alice. He's calculating a Diffie-Hellman with his old ratchet private key which is very faint up here and that's this output. And then he's calculating a new ratchet private key and a new Diffie-Hellman which gives him a new Diffie-Hellman output. So we see here that like Bob is doing two DHH operations on receiving Alice's new key, the first one creates a key that matches Alice's latest key, then he creates a new key. He starts advertising his new public key when Alice receives it. She does essentially the exact same thing. She does two Diffie-Hellman operations, one of them, the first one gets the latest value Bob had calculated, the second one gets a new value, then the same process happens again. So she's advertising a new public key, eventually Bob will see that key in a message, he'll do two Diffie-Hellmans, calculate the same latest key Alice had and a new key. So they're just going back and forth taking turns generating the next key in the sequence or generating the key the previous party had generated and then the next key in the sequence and kind of leapfrogging each other in this fashion back and forth. This works in OTR and in TechSecure. It's a little complicated to think about but it's a nice algorithm because these Diffie-Hellman shared secrets are evolving. So once you delete your old ratchet private keys you can't go back in time and get the old keys but they're also evolving in the forward direction. So if someone steals your keys at some point in time they can't passively decrypt all future message because new Diffie-Hellmans are being introduced. They'd have to perform an active man in the middle attack and introduce their own Diffie-Hellmans. So this has some sort of complimentary properties with the old symmetric key ratchet that we'd also like to use because this ratchet deletes old keys right away. This ratchet has to hold on to them until it receives a response from the other party. So if I use one of these keys, one of these Diffie-Hellman outputs directly to encrypt like 10 messages in a row and I send 10 messages in a row without waiting for a response they'll all be encrypted like an OTR for example just with the same key. So we might like to do a little bit better than that and try to combine these approaches and that's kind of exactly what TechSecure does. And we call this the axolotl ratchet. It's just combining these two types of ratchets. And the idea is pretty simple. It's just we're doing this Diffie-Hellman OTR-like ratchet and whenever one party receives a new public key and does those two Diffie-Hellmans it uses the first one to reinitialize their receiving chain, the second one to reinitialize their sending chain. So we're just doing a Diffie-Hellman ratchet to reinitialize the keys that are used in the symmetric key ratchet. So this way if I send a bunch of messages in a row they each get good forward security but we're also evolving the keys based on new Diffie-Hellman values. And so you see the pattern here in a pretty straightforward way. When Bob receives Alice's new ratchet key his two Diffie-Hellmans reinitialize the new receiving chain key then a new sending chain key. When Alice receives a message from Bob she initializes a new receiving chain key and sending chain key and you can see how these sort of match up. So Bob's new sending chain ends up being equal to Alice's receiving chain which they need to be for messages to decrypt and then when Alice sends her public key to Bob the process just reverses. Her latest sending chain gets recalculated by Bob as his receiving chain. He calculates the new sending chain. So you have this shared sequence of keys that they're calculating with the Diffie-Hellmans and they're just being used alternatively as sending chains for each party if that makes sense. So that's something that TechSecure does. You might look at this and be a little confused though because you might say well if you're reinitializing the chain keys based on the Diffie-Hellmans why did we do that whole session key thing at the beginning? We wanted to get a session key and like that's authenticating the long-term keys shouldn't the sending and receiving chain keys be a function of that session key and in fact you would be right. You do want that to happen. So if you zoom in on this a little bit more you see there's a little bit more detail here. What we do is we actually take that initial session key that's output from the key agreement. We call it a root key and then whenever we reinitialize the chain keys from the Diffie-Hellmans ratchet we also mix in the root key and generate a new root key and also the chain key. All the chain keys end up being a function of that initial key agreement that has all the authentication in it as well as being functions of this Diffie-Hellmans ratchet. And so this is sort of with full detail what we're doing as messages fly back and forth in TechSecure. So let's circle back for one moment to the initial key agreement and just see how that connects up with the ratcheting protocol.  She also needs to advertise a ratchet key in every message she sends so we're going to add one other detail that we didn't mention before. She has to include a ratchet key in her first message. So this is the full set of what comes in Alice's first message to Bob. It's around 100 bytes of keys. And then once Bob receives that first message and responds to Alice, he's going to send a new ratchet key because that's how the Diffie-Hellman ratchet works and mix that into his latest sending chain that encrypts that message. She's gonna, when she receives that message calculate the same Diffie-Hellman, update her receiving chain so she can decrypt that message. Then Alice is going to calculate a new ratchet key for her new sending chain and use that to send a message to Bob and he's gonna calculate a new ratchet key to decrypt that or two, he's gonna calculate the same receiving chain and then a new sending chain and then they're just gonna go back and forth as they exchange your messages doing all of this ratcheting stuff. So it's the key agreement sets up an initial key, sets up the state and then they evolve the state as they continue to communicate. So that's the basic two-party protocol that we do at any point in time, that both parties have sending and receiving chain keys and there's these Diffie-Hellman updating of those keys going on. So let's take that two-party protocol now and just assume it works and look at how it generalizes to multi-party or multi-device cases. So you can handle multi-party communications very easily. If you're sending a message, if you can send a message to one person and you wanna send a message to five people, you can just send five copies of that message and that's something we do. It works fine. You just have a bunch of separate ratcheting states, separate sessions set up and you use those with every message you send. In the general case, that's the best you could do. You could imagine in like an email case where everyone, you're sending a message to five people under five different email servers, you need to send five copies of that message in any case. But in some situations where there might be multiple people at one email server or multiple people behind a single server, that starts to look a little bit inefficient. If you see the top here, the pink person is sending three messages to people who are at one server and it might be nice if it just had to send one copy of that message. So you might want something a little bit more like this. You send one copy, the server can fan that out into three separate copies and we support that as an optimization. It's an optional optimization and what we do there is the sender can send a special message to all of these parties. So they send a special sort of pairwise message to each party that has a special sender key. We call it a sender key. It's like an AES key and a signing key and then the sender uses that special key to create a special chain that it uses just to send messages that can be decrypted by all of these people. So it's sort of, you know, we've talked about having sending and receiving chains between each party. You can also set up a sending chain that represents a group of people you're sending to and then you just have to encrypt that message once and everyone can decrypt it and you don't have to encrypt multiple copies of it. So that's an optimization to make multi-party communications more efficient. So we do that. Let's look at the multi-device case as well because people might, you know, people do have multiple devices, you know, phones, laptops, tablets, et cetera. We want the protocol generic enough to handle the case where people are sending and receiving messages on multiple devices. And so the way we would handle that is if you have your original device, you would synchronize its long-term private key to the new device in some fashion and so then the new device would become a sort of clone of the old device and it would have the same private key. It would generate its own pre-keys and then when Alice goes to send a message to it, she would just treat each of those devices as sort of like a separate party and so we're building multi-device support on top of multi-party support. In a case like this, Alice is sending, you know, a message to two parties. One of them has three devices, so she just sends four messages and we could make that more efficient by using the sender keys thing I talked about where she just sends them all like a sender key and then she can just send one message in the future and have the server, you know, display that out or send that out to all the other parties. So that gives us multi-device support. So that gives us, and that really gives us, you know, kind of the basic core mechanics of everything we want from the low-level crypto protocol. I mean, we can send and receive messages back and forth based on public keys, based on long-term keys with pretty good forward security. We can do group messaging, we can have messages spread out across, you know, multiple devices that people own. That's kind of all we want from the low-level, you know, crypto mechanics and crypto plumbing here. So let's, you know, now turn to this, you know, kind of question of how we authenticate and make sure that the keys you're retrieving from this key directory are actually authentic, are actually owned by the other party because we haven't said anything about that yet. And I'm gonna set back a little bit and just talk about our sort of philosophy or approach to that here. And our basic philosophy is that end-to-end authentication of keys is a harder problem than end-to-end encryption of messages. We can make end-to-end encryption happen, essentially, invisibly, so that users never see it. They don't know it's there. You're using your messaging app. You're generating keys, publishing keys, fetching keys, encrypting everything. You know, that's easy to kind of slide under the covers and make exist without users even noticing it.  You know, they don't wanna just trust everything that's happening in the infrastructure. They wanna, like, do something for themselves to get trust. That might be verifying a key fingerprint. That might be signing someone else's keys in, like, a web of trust type system. That might be paying attention to warning messages that tell you that someone else's key is changing or that your key has changed. But users are gonna have to do something and most users, most of the time, are probably not gonna wanna do that. They're not gonna wanna spend a lot of effort on end-to-end authentication. So we have this sort of paradox where end-to-end encryption is easy, end-to-end authentication is a lot harder and is probably always gonna be done by a smaller population of people. And so now what do we do? It's a hard question and one approach, some people say, well, end-to-end authentication is really important. We should try to force people to do it. We should make it so that if you don't do end-to-end authentication, you don't get encryption so that that's just like a requirement of being part of the system. And if you take that approach, you end up with something like this where a small set of your larger population is doing more authentication and getting encryption and everyone else isn't really getting anything out of this. I think the downsides of this sort of system are that the people who really do care about security and are really trying to secure their messages are kind of standing out. It's obvious that they're doing extra authentication and doing encryption. They're making themselves obvious targets and they're kind of signaling which messages and which communications they really care about. So that's not very good. Another problem is that for all these other people who aren't spending this extra effort on authentication, they're not getting anything out of this at all. They're not getting any default encryption. They're just not getting any security. So the other approach and the philosophy that we kind of take is to just encrypt everything and say, let's just have default encryption as built into these systems. Some of these people will be doing authentication. Some of them will not be doing end-to-end authentication but we wanna make it so that you can't actually tell who is who. It just looks like everyone's doing the same thing. It looks like everyone's encrypted. And then we get a couple of advantages. Firstly, we get the advantage that the people who are doing this extra authentication are not advertising themselves. They're not making themselves obvious targets. They just kind of fit into the crowd. But also those people sort of protect everyone else because if you're looking at this as an outsider, you're trying to figure out which communications to man in the middle and attack, you don't know who's vulnerable and who isn't. You don't know which man in the middle attacks might get you detected and which might not. The larger population is hiding the smaller population. The smaller population is protecting the larger population and so that's how we kind of try to deal with this world where end-to-end authentication is more difficult than end-to-end encryption. But we still need to do something for it of course and so we provide ways that you can do sort of manual and out-of-band checks of public keys. An example of that would be letting one party display a QR code. The other person scans the QR code. That tells them that they're seeing the right public key for that party. And that's something you could do, you could imagine having other ways to try to streamline that or optimize that. The protocol is sort of agnostic to how you want to do that. But we take the idea that some subset of people will do this and in doing so will sort of help keep the whole system honest. So it's about all I have to say about the kind of tech secure protocol and the basics of how it works. I run a mailing list that talks about a lot of these topics. If people think that's interesting, you can find it up here. Whisper Systems is also hiring some full-time development positions if you want to move to San Francisco and work on this stuff. It's all I have and I hope I have some time for questions.