Ok, tako, da smo počeli, tako, da ne, ok, da smo počeli, ker smo počeli, da bi smo počeli, da bi smo počeli, ker je točnje včetko. ... ... ... ... ... ... ... in 3 znastrza, ki še je to pobijel, zato sem bila. Zato sem hvaj dnev, bo je zelo vrša začetna, da so všem, da sem idej o to, in, če bomo, nekaj da sem si očisela, če pa v tomom moram, da sem odvih jeva, da se vzelo vzelo, da sem podržela pobijel Polimer. In začetno, druga moram, nekaj nekaj nekaj najtečnega vzbavna tudi, nekaj najtečnega vzbavna tudi na mande.  Ha, tako malo še bila, da jeo spesit njisi. Kaj so ma ne bo odlišal, načo se našelje odlišal? Zemlje vložne. Našeljene je zašelje. Tantro. Zelo, še radim, ker sem njič še odlišal. Nekom tako ne se poplavljo,btokratijo povedelji. Vljuba do zelo predlženja piv zelo. ne zelo. OK. So, what I will present today will be about polymer dynamics. So, does it work? Yes. So, polymer dynamics means exactly what you imagine. So, I have a polymer in a solver. So, a single polymer in a solvent. And so basically because of the temperature there are, so this polymer is kicked by the surrounding, by the molecules of the surrounding solvent, and it moves. And these kicks are random. So, it's like just a random Brownian, so it's just a, so you can imagine that a polymer is just a collection of random Brownian particles. And just like, as you can imagine, it will be like a system of Langevin equation. So, just to give you an idea, if you have a single particles, in a single monomer, in a solvent, so this particle receives the kicks from the surrounding solvent, and so this is, the dynamics of this particle is described by the Langevin equation. OK. So, it's dr over dt. No, sorry, minus, OK, let's do it. Anu to minus gamma dr over dt, plus eta of t. OK. So, this is like a Newton equation, so you have the term with, yes. Oh, sorry. Yeah. How was that? Yeah, of course. I was thinking, I was always doing it with the dots, and so this is a second derivative, it's just a Newton equation, equal minus gamma dr over dt, this is the speed, the velocity, plus eta. So, this is the Langevin equation for a freely diffusing particle. And so this equation, as you probably know, is supplemented by two more relationships, that characterize the noise. So, this is just a Gaussian noise with correlation eta t equal zero, meaning that if I, the ensemble average of noise, I mean, over time is just zero, and the noise is delta correlated. So, namely, if I took the cross correlation in this thing time, this is just 2k dt, gamma delta t minus t prime. So, you know this thing. Is there anybody who doesn't know this thing? You don't know? OK. So, down to, I just give you a brief physical explanation. So, suppose, so, this is a Newton equation, roughly, right? So, you have m, the mass, times the acceleration. This is equal to a force, which is a friction, and the friction is because you have a particle in a solvent, when you experience some friction, plus some stochastic term. So, this stochastic term describes the kicks that the surrounding solvent exert on this particle. Right? So, it's just a, they are just random kicks. OK. So, physical, this is the physical description of this equation. So, and this is a force, and this is a force, too. So, then you have to, it has to be equal to the acceleration because of the Newton equation. OK. So, but then, in order to, let's say, to complete this equation, we need to give some prescription on the noise, because this is a stochastic term. So, it's not like, it's not like a regular term. So, in general, we don't have to be too specific on the exact shape of this thing except for two things, if you wonder, that the average of the noise, and the average over time, the ensemble average of this noise is of the time average, actually. This noise is zero, namely, on average, this is obvious because that means that on average the kick can be on any possible direction. Right? So, on average, this thing is zero. And then, this second prescription which is also very important, it tells you that if I calculate the correlation of the noise at time t and at time t prime with t different than t prime, then this correlation has to be zero. They are not correlated in time. OK. This is a delta function, direct delta function. OK. Otherwise, they are delta correlated. Wait a second. So, now you can ask why this coefficient here, right? And this coefficient comes so if one comes from the fact that if you calculate the mean square displacement of this particle, OK, that gives you so the mean square displacement of this particle at large time, so my mean square displacement I mean the following. This is r t minus r sorry, r t prime minus r t square average. This is the mean square displacement of a time. So, namely, it measures how on average how far my particle has moved from the initial position and this quantity has to be independent depends only on the difference of this time. So, this is equal to 6 d t where d is the diffusion coefficient. OK. Sorry, t prime because it's different time. So, this is the diffusion coefficient and then you will see that actually from calculation it comes out that this thing has to be equal to 6 d t over gamma I mean, if you do all the calculation so then you identify this with the diffusion coefficient and then from this identification you see that you have to impose the constant here equal to this so that it comes out naturally why this coefficient here. OK. Actually, this is because it's in three dimensions sorry. And then that's it. So, is it more clear? Which component? X, Y, Z, you mean? In X would be like 2 kB t gamma plus that's a cross problem. So, for each component would be 2 kB t gamma OK. No, no, this is OK. I mean, between component X and Y, this is always 0. X, X is 2 with the factor of 2. OK. So, in the dimension if you want it's 2d OK, but we do it in three dimensions we don't complicate. We don't complicate stuff. OK. I mean, the different directions of course are uncorrelated. OK. Is it OK? I mean, intuitively OK. I mean, I cannot go too much into details because I need to apply this to polymers actually. And OK, we'll do one more sorry I don't go to my again too much in detail, but what I mean we consider, actually we do a simplification of this equation we assume no, we assume that we can neglect mass effect sorry, this. OK. We can neglect mass effect which means that this term can be put to 0 and then the equation is actually much more simple because then becomes gamma dr over dt equal to eta t OK. And if you think this is so this approximation holds at times which are larger let's say then m over gamma because as you can see that if you place m here, so m over gamma is at time, so for time larger than this basically mass effects are not important and then you can neglect the mass term and you can just work with this equation which is of course much simpler because it does not have second derivative and we will use this approximation which is called the over dumped approximation for polymers which is very useful because of course it's much simpler and the effects are important in very short time so whenever times are larger than those you can neglect the mass step OK. Now how things become if you have a polymer so now of course I mean things become a bit more complicated but not that much so the model we are going to introduce is called the Rauss model and it's let's say it's a the fundamental model in polymer dynamics so it's basically ground zero you can't have anything simpler than that for polymer dynamics and the reason why is because the Rauss model was formulated for an ideal polymer chain so namely we don't have exclusive volume effects OK so it's a chain and the model is the following you have monomers connected one after the other by entropic springs by just harmonic potential OK. So this is precisely the same model we introduced at the very beginning which was under the name of gaussian model so if you want the Rauss model is the dynamical version of the gaussian model so so what you have is precisely a collection of particles like the one that I just introduced before but then each particle is connected by an harmonic spring to the next one and then what we need to do is basically a system of a Langeven equation for this particle and then we are going to solve it and then if we solve it we obtain the motion of a polymer in a stochastic environment and this is very important to know it because as I said this is the fundamental model for polymer dynamics and this is also applied to interpret experiments for chromosomes so it's very useful that you know it and then of course this model which is very simple can be generalized to include more complicated stuff but I mean this is really the ground zero so in order to solve it again we have to write a system of a Langeven equation so now we fix first we fix a frame as before monomer n so we fix a frame so this is the origin of the frame and so this is coordinate so this is coordinate r0 this is r1 and up to here rn so now we have to write down the system of Langeven equation and add the motion of this particle and so as I said we will use the over dumped approximation so we are not including the mass of the particle into the equation and then so the system of equation will be the following so we have dr over dt again so this is the friction term and then we have the forces so now we have let's say we have two forces one force is the same as before so is the stochastic one so in that we lack the on particle zero time t so it will be exactly as before plus the harmonic force and the harmonic force is described by some entropic spring k and of course we are talking about homopolymers I mean force to start from something super simple so each spring so there are no difference between spring everywhere is the same of course you can generalize to spring which are different but in this case we don't do that and then as you can imagine so we have this force instead is not stochastic determination so it's just like a Newtonian force and so that will be like minus k let's say it's a force that counteract let's say the motion of the particle and that will be like minus k r0 minus r1 plus the let's say the stochastic term because that's exactly the term for the standard expression for an harmonic spring and then we have to also ok, this is for the first monomer this one then we have to write the equation for the second monomer which will be gamma dr1 over dt and that will be equal to minus k so now there is a bit of a difference because now for instance monomer 1 and also monomer 2 up to monomer n minus 1 we'll be connecting not to only one spring but to 2 because they are internal for the first monomer because it talks on the first monomer of course for the other there will be the same term because they are all independent that's an assumption it's a bit underappreciative assumption of the model sometimes in the book it's not said more than that actually they are all independent I will tell you later in a few minutes so you have so this particle for instance particle 1 will be attached to 2 spring and not just one so that will be like 2 let me write maybe r1 minus r0 there will be then minus r sorry plus r1 minus r2 ok plus eta1 t ok this is because that will be let's say let's say a spring term particle 1 toward particle 0 and the spring term that moves particle 1 toward particle 2 so that's there will be two terms here instead of just one and so this can be just simply written as 2 r1 minus r0 minus r2 ok and as you can imagine that's the same for the other internal particles so in general that will be like gamma drI divided by t by dt minus k 2 rI minus rI plus 1 minus rI minus 1 plus etaI t with i now this is between 1 and then minus 1 so actually this is the same as this one so this is for internal monomers and the last monomer of course is like this one I mean it has the same shape so it's vrn divided by dt equal minus k n minus r n minus 1 plus eta n t ok and so this is this is the system of rouse equation this is the rouse model which need of course to be supplemented because I wrote one year I could eliminate this and put just to explain to you but of course I mean this equation is the same shape as this one what I wrote here it's because I repeated the same equation as vr in the end this equation I could I want to make exactly so essentially this equation this one but with i equal to 1 ok I was just going slowly here just to explain to you and the last equation because you have only one monomer of course it's exactly the first one I mean the same shape so this system of coupled now launch of an equation coupled because you have coupling here between monomers and this to another monomer describes the rouse model which need as I said to be supplemented by the condition on the noise but these are simple they are exactly the same as the one that I defined before so actually the conditions are given by eta i the time average the ensemble average of the noise for any i for any monomer this is equal to 0 between i 0 and then so first so it's exactly the same as before and the second one is that eta i t eta j prime so namely the cross correlation of two noises which act on two different particles or on the same particle this is just equal to 6 kBt gamma so the same gamma is here now we have a chronicle delta because the noise on two different particles is delta t minus t prime ok sorry that's and that's what defines the model ok so it's basically a sort of it's a system of coupled launch of an equation it's not much more complicated than that but I mean this assumption is quite I mean it seems a bit armless but actually it's quite important because that means that the motion of any particle in the end it influences the motion of the other particle but only because there are these springs but it has no influence on the fact that you have a solvent and because you are moving actually the solvent together with the particle you are influencing via the solvent so that would be that is something that goes into the realm of the hydrodynamic effects which are not included in this model so it's a very crucial assumption of course if you introduce hydrodynamic effect which is not trivial which is not a trivial thing to do I mean you complicate considerably the model but we are not considering this here we are just keeping the level yes the chronicle data so this is the same as before so this is chronicle data means that the noise between two particles are never correlated which is an approximation because whenever you are moving a monomer in general you would expect in the real system you would move the solvent with it and so the fact that because you are moving the solvent with the particle the motion of the solvent induced by the particle will influence also the motion of the other particle ok and which is also a coupling but it's a completely different coupling because it's a sort of multi-body effect and so that goes under let's say the generic name of hydrodynamic effect this is pretty obvious why but in order to take into account the dynamic effect I need another formula which does not enter here and of course it becomes much more complicated in general they are quite difficult to treat the dynamic effect so that's why as I was saying even if this thing looks pretty harmless it contains some strong hypothesis ok so given this equation we need of course now what we want to do with this equation we want to solve it so the solution of in order to solve this equation you need to do not something very complicated but it requires some math which actually I don't have the time to do it now which so in practice what you do so as you can see you cannot solve this equation in a simple way for a single particle because then each single particle is just independent and you can solve just one equation here each equation is coupled to the next one because of this because of the harmonic spring so in order to solve the problem what people do they introduce what they are called normal modes so normal mode is basically a linear transformation of the coordinates of the monomers so which means that you use another set of coordinates this is the same number so it will be always n plus 1 coordinates which are linear combination of these coordinates and in these new coordinates you end with n plus 1 uncoupled Langeven equation so then you solve a much simpler problem because then you have you can solve just basically one equation and then you can when you solve one you have solved everything and then you go back namely you do the inverse transformation and you go to the real coordinates so that's the general approach but that requires some so I don't want to do that because I wanted to show you more like generic physics of the Rauss model so in order to show the generic physics I can immediately show a very simple result out of this equation which is the following so this I can remove it actually this result is an immediate consequence of the of course I mean of the Rauss equation because of the definition of the correlation for the noise and it's the following so suppose you take the sum of all this equation so I sum gamma sum for i from 0 to n that is d over dt r i ok we have equal ok I have a simple term which is the sum for i equal to n eta i ah 0 and then I have the sum of all this term but you can see that the sum of these terms is just 0 ok which is quite obvious because these are internal forces ok actually this thing if I write it here so this is just gamma d and if if I divided this by n plus 1 so you see immediately why this has to be 0 so this 1 n plus 1 the sum i from 0 to n r i ok this is 1 over n the sum n eta i of t right and this quantity here is just the center of mass of particle so this gamma I can call it rcm so this d over dt r center of mass and of course the motion of the center of mass does not depend on internal forces you know ehm I mean the sum of the internal forces just add up to 0 while the of course I mean the Langeven forces are not internal forces they are external forces so then the only term that survives for the motion of the center of mass is the sum of the Langeven forces of the Langeven I mean the random forces yes because I was wrong yeah sorry depends sometimes on the notation you have in mind ehm ok so that ok this thing here so and that means that means that the center of mass is I mean it's described by just by a simple Langeven equation so we need to prove an additional thing in general this is just like a simple Langeven equation precisely the same as the one for a single particle in order to just prove it we need ehm to calculate the correlation of these noise what I mean is the following in order to see that if it's a real Langeven equation we need to see how this noise so we need to calculate correlation but for this noise so if I call it this quantity ehm I can call it zeta of t so this just by definition n plus 1 sum I yeah it's a bit hot no I t I need to prove that the following I need to prove that zeta t is equal to zero ok and that zeta t t prime is equal to sum is proportional to some delta t minus t prime and I have also to find the coefficient which I don't know so coefficient that I have to check delta t minus t prime I have to find it because I don't know it ehm if I prove that then I can use basically the same the same simple Langeven equation to study the motion of the center of mass ehm I'm going to do it immediately is it clear the problem so because this is I want to to I want to to solve this equation and of course I mean this is so first ok first let me let me do this so I have to do this first ok the average of this over the ensemble average of this quantity ok ehm so but this is very simple because this is just a linear combination of my eta ok so this is equal to n plus 1 ehm sum I from zero to n of eta i of t ehm and this is because it's a linear combination this is just zero right so the first properties let's say trivially solved I mean trivially they are demonstrated then the second one I have that this zeta t zeta c sorry t c t prime ehm so then I have to do the cross correlation this is 1 over n plus 1 square because I have one I mean term from here and multiplied by the similar term ehm that will be like the average sum I zero to n sum j zero to n ehm eta I t eta j t prime average ok and then of course I can move the average inside the sum and now I can just use this relationship right so this is equal to 1 over n plus 1 square 6 k b t gamma ok ehm then I have the Kronecker delta which means ehm that the only non-zero contribution comes from the terms where i is equal to j and so then this is just n plus 1 delta t minus t prime ok ehm so this n plus 1 simplifies with this and so what I have in the end is 6 k b t gamma divided by n plus 1 delta t minus t prime and as you can see this ehm so that means basically ehm that my object right is like a it's like a Brownian part so the object in the center of mass it moves like a Brownian random particle but with n plus 1 friction smaller some bit strange no it's ok smaller ehm no but it's strange sorry it should be larger I'm getting confused ok up to here ok then what I did I divided by n plus 1 and then plus 1 so then I defined ehm sorry did that no yeah but that counts for 1 because then I have the delta yeah but that's here so here it goes delta ij so it's when only the i is equal to j and then it contributes only when they are different do not contribute so then it becomes n plus 1 ehm and then ok that simplifies with this so then I have 6kBT gamma over n plus 1 delta t minus t prime I think this is ok ehm what I so let me just finger second ehm no no but that's correct because ok it comes from here ok so what I plus 1 gamma let's not even finger second no it should be below I agree but that means it's a bit maybe this way so this I sum up ok that's fine so then I divided by n plus 1 this is definition of the center of mass no because I don't yeah because it seems a bit the opposite effect that I wanted to show ok but ok for time ok this is this is correct I mean the mathematical is correct ehm sorry what time is it now maybe we can do just 2 minutes break then I realize what I mean 15-16 ok maybe we do a small break 2 minutes ok so then I realize there's nothing mathematically is correct I just because I want to show a different so ah si si no ok ehm sorry I made I don't know my life more complicated so actually this is correct but the only thing that so actually I have to do this way so n plus 1 gamma so this is correct but I don't need to divide this by n plus 1 so actually this is like n plus 1 gamma equal to just the sum of the different noises so then I define CT like this and I calculated the correlation the way I did it except that now I don't have this term here and I don't have this term here and I don't have this term here but then this thing so this does not simplifies which is what I want actually and because now I have an equation where this thing here which I call gamma tilde is the same as gamma tilde here so it has exactly the same shape as the normal Langeven equation so that means that if I can write an equation for the center of mass which is just a simple Langeven equation ok which means that actually which means that the center of mass so it's like this way R cm dot or if you want the first derivative over time is equal to this quantity that I call the c of t, which is the sum over all the noises over all particles with this correlation which means basically that the more c of cm which means basically that the center of mass moves diffusively for the rough model so which means that if I calculate the mean square displacement over time of the center of mass the same as I calculated before which I did but I just show you for the center of mass of my polymer this is just equal to 6 d center of mass prime and my the diffusion the diffusion coefficient of the center of mass is just the diffusion coefficient of the single monomer divided by n plus 1 because the friction of the center of mass is n plus 1 times the friction of one single monomer and this is a very important result that we will use now to introduce a sort of approximate solution of the rough model because as I said the exact one is a really cumbersome it took a bit of time it would took more than two hours not more than two hours but it would take a lot to explain it carefully but this result is easy to show and this result comes directly from this approximation where the forces are uncorrelated between different monomers so that's the result of cumbersome diffusion because then what I did here I just added up on the forces and then as you can see I used the correlation between different the noise on different monomers is exactly 0 so that's where it comes from ok sorry for the small confusion but at this point so now that we have this let's say this result we can we can actually introduce a let's say an approximate solution for the rough model because now what I want to solve actually is the following problem because this is relevant in experiments especially for cumbersome this is very relevant because people now apply even analytical by using they use rough model to model the motion of specific portion of the chromosome and I will show you to tomorrow maybe or Monday this kind of experiment so then what I mean in order to model such a kind of thing we don't have to look at the motion of the whole polymer like this one because basically the motion of center mass means the motion of the whole polymer but we need to look at the motion of a specific portion of the polymer and in particular you can look at the motion of a single monomer and we want to know how the monomer moves in time on average of course we will always do the ensemble average and now I will show you that there are very nontrivial effect for the motion of a single monomer so this I keep it so what I showed you now is that the motion let's say the mean square displacement of center mass this is 6 v0 is just I call it the motion of one single monomer n plus 1 t ok, they are right so now the problem I want to solve so I have my polymer I want the average motion of one single monomer in time as it evolves in time this problem can be done exactly but as I said one has to do normal mode so it's a bit cumbersome so we just use a simple scaling approach and which actually is very useful because then it allows us to generalize the dross model to more complicated polymer model so namely also to polymer models where you have excluded volume effect which here are not taken into account so the way one can approach this kind of problem is the following so first of all one has to realize the following thing polymer relax polymer relax in this way so at very short time you can imagine that single monomer when it moves when it starts moving because of the solder does not know that it lives in a polymer chain basically what I mean that at very short time the monomer will move as it is free so then at later times which basically we can define times more precisely so at times t which are let's say roughly shorter then the intrinsic diffusion time of a monomer which is b2 divided by d0 so this is the time that it takes a single monomer to move diffusively on a region of space as large as its own size so that means that the monomer has not really explored much of the space around it so for times smaller than this you can expect that the motion of a single monomer which which notation I can use so I use r t plus t prime minus r t prime square this has to be like proportional to d0 times t prime if you want with this 6 here but it's not important I mean I'm interested in in power low behavior so I'm neglecting prefactor so for short time the notation just let me write this quantity like this quantity here let me write it like delta r square t prime so this is average so what I mean is just the average of the motion of a single monomer just to be short otherwise it's a bit boring to bring all this thing together ok, so with delta I mean displacement in time sorry ok, so this is because the monomer has not moved yet too much so then I'm interested in times t which are larger than this so I'm interested to describe the motion of a monomer on times which are larger than the diffusion time of s no no this is the motion of a single monomer I'm investigating so a very short time so you start from polymer conformation and then you follow on time the motion of a single monomer and on very short times because this is you start your observation in time t and you say what it happens in later time t prime for the average motion of a single monomer so you are talking about t prime which is smaller than the diffusion time of a single monomer so it is not too far and very likely has not seen that there are other monomers around there is nothing around for just the motion so possibly you will see that the motion is purely diffusive up to this time so I'm I'm asking what it happens in this time regime which is the one that is more interesting what it happens is that it is larger than the diffusion time of a single monomer and sometimes which I call tau relax which corresponds to the relaxation of the total chain and this I will be I will specify it in a moment I mean how it goes just let me write in this way so I'm not too specific at this point so this is the relaxation time and it takes the whole chain to move which means that I also know what it happens later time at later time I know it because at later time I know that the chain has to move in this way because this is the motion of the center of mass so since this is the motion of the center of mass the motion of a single monomer will follow the motion of the center of mass too of course I mean it has to physically so at very later time delta squared t prime has to go like 6 d0 and plus 1 t prime while here there is for time being the question mark and this is of course the more interesting time regime which I want to investigate so just to be precise is it clear? question? I will be more precise later because I need so actually this relaxation time is a function of the parameter of the model in particular is a function of the number of monomers you have so it has a precise power load dependence on the number of monomers you have it's called the Routh's time it's a relaxation time over the whole chain and actually if you want you can derive it even now because in the end it's very simple but first I want to also naturally from here so I first I first derive the diffusion of a monomer in this time regime and then the relaxation times come quite naturally so this is in order to derive I mean how it evolves a monomer in this time regime one has to just use two ingredients and one simple physical intuition and the first simple ingredient is the following that the monomer, the single monomer when it moves it will drag in this motion more larger and larger portion of the chains because this is the way the way polymers let's say evolve dynamically which means that at some time t, sorry at some t prime which is in this time regime the monomer is explored so now you let me if it's clear is explored at time t a region which has to be compatible it has to be of the order of b squared which is the typical size of a monomer here this one time the number of monomers which have moved at time t prime have used prime prime yes so I want to get this time regime which is the intermediate one so it's a time regime intermediate between the trivial diffusion time which is intermediate between the trivial diffusion time of a single monomer and the total relaxation time of the chain which is somehow show you it's also non interesting in fact I've already shown you it's non interesting because it's simply it's a simple drift if you want it's just the diffusion time of the chain because of course any monomer has to follow the chain so I mean this intermediate time regime so at this intermediate time regime ok so I repeat it here if you want d squared d0 and this tau relax which I define, I calculate it later so at any t prime the monomer has explored a region which is compatible with the total number of monomer and t prime which have moved simultaneously and since I know that my chain is because I am I mean at that time the chain let's say is equilibrated so it's explored region available to the chain that has to follow basically the statistics of the random walk in number of monomers and this is precisely the model basically the result for a Gaussian chain ok so the time t prime is hidden here is the number of monomer that have moved up to this time t prime so this is basically the number of monomer let's say contained between which are far in the chain between this monomer which is let's say the monomer whose motion I want to investigate and here so this is and t prime if you want so it's growing so the number of monomer that are moving simultaneously if they are moving simultaneously that means that at that time the overall region that that has been explored as a size, a linear size which is proportional to the square root of the number of that movement because it's basically the Gaussian model this is the number of monomers that which are moving in time no no they are all moving but they are all moving the motion, the polymer is in motion why they are not ok wait so I am focusing on a monomers so this thing is moving but they are also directly moving so this is on average so if it's moving then at some time t prime and then if the motion so how to say this so this monomers the single monomer is exploring a region together with its neighbors which at time t prime has to be compatible with a region which is explored by the number of monomers which are moving which are moved after time t prime and that has to be to correspond to a region of size which is given basically by the statistics of the statistics of the polymer which I am considering in particular here I am considering Gaussian polymer so then the total size has to be let's say proportional to the square root of the number of monomers that is moved at time t prime ok so if you want this is so the implicit dependence on time t prime can be written this way for better so it's contained in this dependence is it yes this is on average so if you keep a spot on single monomer so then it's moving then there are also the other monomers which are moving so they are all relaxing so they start from here then the second one then the two, the closest one then the third one at some on average at time t prime the total number of monomers and the region explored have to has to be of this size ok if you want this is ok this is, maybe I didn't say that but this is like a sub chain of my chain of length and t prime but it's an average sub chain so if you do it you have to consider this as a collective motion so if you take one sub chain they are all growing in this way if you want this is the same as saying that if I chop my polymer in pieces so namely I took the first 10 monomer the second 10 monomer the third 10 monomer for instance then up to the relaxation time of these 10 monomers all these different pieces they relax almost independently they don't feel each other at shorter times because I will derive two relationships so this is delta r squared t prime this was b squared and t prime ok so that's the first relationship ok now as you can see I can tell too much because I can tell too much in the sense that this I need to determine so in order I have to close this relationship so in order to close it I need to find a way to express anti prime as a function of time if you want then if I have average expression for how anti prime grows of the mean square displacement of the single monomer in this time interval and in order to do that I resort to this comment your question ok if you want to ask us what is so what I am interested in is the following problem find the time behavior of single monomer in this time interval because the first time interval the first and this one are trivial because I know them so I am interested in this one ok so what is anti prime anti prime so I am focusing on one single monomer ok that is moving the single monomer but with this single monomer they are moving also the other monomer around so this equation describes how time t prime how many of those monomer time t prime have moved collectively they are moving together because everything is moving ok but they are closing they are along the sequence because it is moving this monomer then it is moving the other monomer according to each other of course they are closing because they are moving if you want more or less it is sort of correlation length more or less but then it means because in here I am using the statistics of the polymer namely the which kind of model I have behind this model the polymer is a Gaussian polymer so then the size the linear size of the region explored by this monomer time t prime is equal to b squared time n t to the square root because the linear size is I mean it is just the Gaussian statistics ok because we have to imagine that the polymer ok it moves this way so you have the monomer you have the monomer and then there are the other monomers around and then the other monomers around so it is moving from smaller scale to larger scale and so the number of monomers that have moved up to t prime are linked to the region of space which is explored by this n t prime monomer by this relationship for this specific model ok time t zero is when you start the observation so because they are moved they moved all together no no no they are all together no no not considering in specific no it is not like you have one monomer fixed ok I see what you have in mind it is not like you move one monomer and then the other like frozen and then you start moving the rest no no it is a different story so they are all together it is simply that the influence of the way the other monomers influence one specific monomer does not happen I mean nothing happen until they have reached a certain length maybe your friend said it is called the sort of compression length if you want but they have first in order for this monomer to fill this other monomer this monomer have to move a region whose size is compatible with let's say the total size of the region that that can be explored by also by this monomer so you see so if you have so you have one monomer here one monomer here and one monomer here so this monomer is moving right so it is exploring a larger region larger region and so on and so forth and this too larger region and this motion will involve also closer monomer but in order for this monomer to fill this one they have first these monomers first to explore a region compatible with let's say this average contour length and then they fill each other otherwise they don't if you want this number of monomer in that region the average number of monomer in that region so they have to be linked by this relationship this is the polymer statistics I'm assuming now for time being in the Routh's model so I know that it's a bit not entirely obvious but yeah yeah but see I see what you mean with a second so actually yes and no for the following reason because so you remember that R squared divided by 2B squared ok so this is so this is the average this is the distribution of the average distance between close to close by monomers ok because it's a spring and I want to be this for the following reason because if I have a collection of monomers which are where nearest neighbor distances are distributed in this way then the end-to-end distance between I mean the first one and by the last one I mean this is an exact relationship you can this is basically just a Gaussian integral ok so this comes out this way and then R squared this is let's say it's equal to nB squared and this is a Gaussian polymer so I need to fix the harmonic spring between close by monomers by this ok so the spring constant is actually it contains B squared so let's say k elastic is actually it contains also the temperature so it's beta kBT divided by B squared ok ok and so my k contains B squared so if I took a larger k then I have to make a smaller b ok so my b contains the information on the k elastic so ok it's a parameter but then if I change the parameter then it means that I am just changing this what I was saying ah yes here ok so now as I was saying we need to find another relationship in order to close this equation and the second relation is actually I can use this thing here for the following reason because if I say that a time t prime actually sorry let me write this way so this is I am just writing the same thing I am not changing it this is B squared and t prime ok so the second equation comes directly I mean it is inspired by this because if I say that a time t prime a number if I say that time t prime a chain made of n small n n t prime monomer as relaxed that means that this has to be I mean of the same order of d0 divided by n t prime times t prime ok because this is exactly the same relationship contained here but for a smaller portion of the chain so now because smaller portion of the chain are independent from each other because they don't feel each other that's contained precisely the amount of information contained into the Rouse equation ok so now I have two relationships that I can put together because I have something which is B squared and t prime and something which this is just a coefficient monomer it's a difference it's an independent relationship C but it's the same order because this thing has moved and has to be explored in a region which should be compatible with the position of the sub chain to be of the same order can be otherwise because I want to so this is a sort of scaling approach to the problem as I said you can do it exactly in more cumbersome so if you understand this actually this can be generalized to much more generalist system so if you put this relationship now together it's very easy because I want to be equal they have to be equal so then I can so that means that D0 and t prime t prime it's the same order of B squared and t prime ok, so now I can put nt prime square here nt prime square here and this is like D0 over B squared t prime or so I can yeah so this is nt prime goes like divided by B squared over D0 which is a time one half ok and you see that this is just a pure number because this is a time it's B squared over D0 and this is a time so it's the ratio of two times which means that the following if I now put this relationship here this goes like B squared t prime over B squared over D0 one half ok and maybe you can already observe something which is a very simple observation that the mean square displacement of my monomer does not grow linearly in time actually but grows with the square root of the time, so namely this is sub diffusive ok you see so and this is a very important effect in due to the fact that the monomer is not basically free but it's part of the chain so at intermediate times so now we can complete this picture here delta r squared t prime goes like B squared t prime over B squared over D0 one half so namely you can see the difference it's sub diffusive instead here at large time it's diffusive again and it's diffusive at short times and this is a very specific effect actually this is a genuine polymer effect so the fact that you see sub diffusion so the exponent depends on the fact that you are using the Rauss model so the specific value of the exponent but the fact that you are seeing sub diffusion does not so it's a genuine polymer effect even if you change a polymer model you would still see sub diffusion and that's because a monomer is embedded I mean it's part of a chain yes you will still get sub diffusion with a different exponent even if you change the hypothesis the model but you will still have sub diffusion it's an assumption of the Rauss model yes exactly not really the Gaussianity actually it's always contained here now the Gaussianity can be removed it's very easy to remove this but it's still, if you still assume take this assumption you can still do the same reasoning actually and I want to to show you that from here actually you can also divide tau relax and it's very easy in fact that's because actually this regime here so first of all you can see that actually this thing matches with this if you take tau prime equal to b2 over d0 so namely this time here so then delta square t prime is b2 so the two things are compatible so now what I want I want to determine tau relax tau relax is basically defined when so tau prime is equal to tau relax when this motion is equal to the total size of the chain so namely if this is the same order of b2n which is the typical size of my chain ok so then now I can extract tau relax tau relax is basically so this b2 simplifies so tau relax is ok because here I have a neglected olpre factor of course is d0 over b2 which is a time of course time n square and this is the right dependence so you should which tells me that the relaxation time of a polymer chain within the Routh's model and within the assumption that the chain is a Gaussian is proportional to n square so the number of monomer to the square so this is this is the largest relaxation time of the chain and then when we look at chromosome dynamics we will see that there are experiments where people have modeled chromosomes like Routh's chain precisely using this model and they have extracted the exponent and they find that actually in experiments the motion of the portion of the genome they are remarkably well described precisely by this law with a power law of one half so namely it's roughly ok there are some error bars of course but roughly yes and in some time regime probably not always but for very long time regimes it works pretty well it's inside no clue which sounds strange actually there can be another explanation but I mean can be coincidence but for that we have to go more into detail but for time being it's of course I mean before going too much you need to know the ground zero model ok how much time do I have I finish? what? can I finish? ok then I just show you how you can generalize it's very simple how you can generalize model to more complicated polymer model you can still use it that's why this scaling behavior is very powerful because otherwise you cannot really use the exact solution for that or you need more complicated assumption instead scaling behavior is always very simple and you can do the following so actually if you want to generalize it's very simple so of course I mean the generalization touches this time regime I mean this one and this one will be always the same they are independent of the statistics of the polymer that's the first one is trivial simply because one monomer at very short time does not know that it is a polymer chain so this is also trivial and it follows as I said by this assumption and this thing it's always true so no matter the statistics of the polymer you have extruded volume effects whatever if you make this assumption this is always true ok so so in order but if we have a specific statistic namely for instance if we don't have a Gaussian polymer an ideal polymer we need to generalize the two relationships that I wrote before so this one and the second one so this is anti prime this goes like delta r squared and t prime ok and this is first and second relationship so as you can imagine precisely for the reason I said before this one we still be the same so it does not change if I am using the Rauss model so this it's still the same what it changes because of the statistics of the polymer is this one because that means that for instance if you don't have a Gaussian polymer but for instance you have a self avoiding polymer the one that for instance I've solved where I found the exponent by using the flow theory so this has to be like n to 2 nu sorry anti prime to the power 2 nu with some generic nu before I used nu equal 1 half for then if I have a flow let's say a self avoiding polymer I can put here for nu the nu that I have with the flow theory ok so then I repeat the same game I put all the relationship together and I get a generalized Rauss relationship which is given by d0 and t prime that has to go like b2 and t prime 2 nu ok so this is and t prime 2 nu plus 1 1 plus 2 nu goes like t prime over d0 no sorry t prime b2 over d0 ok and if I invert this 1 over 1 plus 2 nu and if you put nu equal 1 half this is I mean of course it comes to the relationship I used before and then I can put this thing here and that goes like b2 t prime divided by b2 d0 2 nu divided 1 plus 2 nu so you can see that so again if you put nu equal 1 half you get 1 half I mean this exponent is equal 1 half and you get a different value for instance you can put now flory exponent ok and you have for example in 3d no we can put 3 over 3 over 5 which means that this exponent here is 6 over 5 divided by 1 plus 6 over 5 6 over 5 divided by 11 over 5 which is 6 over 11 ok which is which is larger than 1 half no so as you can see the exponent expected for the dynamical exponent expected for for self avoiding polynomial is larger so it relax somehow with the same number of monomer it relax a bit faster then the equivalent the equivalent ideal polymer and I would presume because you have left the conformation to explore but I want also to just conclude to show you a very important to stress a very important thing that this is a dynamical exponent this alpha this one is 2 nu divided by 1 plus 2 nu and this is very nice result because actually the dynamical exponent here is linked to the static exponent nu so namely the statistics of the polymer the statistical equilibrium of the polymer to the time behavior of the polymer the dynamic time behavior this is a very nice result because in principle it allows you from the knowledge of alpha so if you imagine that you have an experiment where you have access to alpha you can derive conclusion on you can derive conclusion on the equilibrium properties of the polymer on the statistics of the polymer so it's a very powerful relationship of course I mean you make the assumption that there are some models if you think that it's not a good model then if you apply it you get crap but assuming that it's a good model then you derive you have a way to connect the statics to the dynamics you can do for instance in case you have access to both tools for some reason you can do ok so maybe if I conclude here tomorrow if I have a short time I will tell you a few things about confined polymer because they are quite relevant to chromosomes as well and then we move to describe a bit the physics of chromosomes which is supposed to be the main part of this but you need to know also some part of polymer in total this time it ok


Thank you for tuning in to this talk on the impossibility of quantum virtual black box obfuscation of classical circuits. My goal today will be to argue that it's impossible to securely construct a certain cryptographic primitive, and that primitive is some variant of the obfuscation primitive. An obfuscation seems to be an extremely powerful primitive, and so it has gotten a lot of attention already in the crypto community in the last years, and you may have already heard about it many times.  Informally, the obfuscation of a program, for example, this Hello World program, is another program that does exactly the same thing, but somehow it is less intelligible.  So it's functionally equivalent, but that's very hard to tell just by looking at this code. And a good obfuscation reveals nothing more about its functionality than what you can already learn from actually running it and just observing the input-output behavior of the program. One observation that will be crucial for today's talk is that the obfuscation of a program does not necessarily need to be a program itself. There is no fundamental reason why it couldn't be, say, an image, together with some public instructions on how to interpret that image, how to run the program that's encoded by that image. Or why couldn't an obfuscation be a quantum state that you can interact with in order to execute your program? So when I say obfuscation of a program or of a circuit, I really mean it to be any possible object. After this informal definition of obfuscation, let's take a look at the plan for this talk. I'll first formalize the definition of the type of obfuscation that we're looking at today, the virtual black box obfuscation. Then I will walk you through the ideas behind a famous proof which shows that it's impossible to obfuscate programs into classical objects according to this definition. And then I will move on to our contribution, which was adapting that classical proof to show that a wider notion of obfuscation is also impossible, namely that we cannot even obfuscate classical programs into quantum objects. And finally, I will put our result into some context of previous and concurrent work and comment on some open questions. OK. The formalization of obfuscation that we will be interested in today is called virtual black box obfuscation. And it is as follows. An obfuscator O for some family of classical circuits F is an algorithm such that the following three things hold. First, the obfuscation of a circuit is not too big. It's polynomially related to the size of the original circuit C. We call this polynomial expansion. Second, if the obfuscation is itself a circuit, then that circuit is functionally equivalent to the original circuit C. And we can generalize this second point whenever O of C is not a circuit but any other object. Then we need to add a publicly known interpreter, J, to the definition. And J just contains instructions on how to use the obfuscation object. Functional equivalence then becomes if the interpreter is run on the obfuscation and input X, then it should use the correct outcome C of X. And note that O of C can also be a quantum state, like I already mentioned. And in that case, this polynomial expansion property talks about the number of qubits in OC. And third, for security, we use the virtual black box property, or VBB, which says that any efficient adversary that received an obfuscation of C, so O of C, and outputs a single bit can be simulated by an efficient simulator that does not get the obfuscation at all, only the size of the circuit, but has oracle access to the functionality of the circuit. So essentially anything you can learn about the circuit from the object O of C can also be learned from querying the oracle for C, polynomial number of times. And if O of C is a quantum state, then the adversary and simulator are also considered to be quantum algorithms, of course. And the simulator still interacts with the classical oracle because the functionality of C is still classical, but it can then query it in superposition. So that's something to keep in mind. To get some intuition for how hard it is to satisfy its third property, the VBB property, let's consider the difference between getting O of C as an input or just interacting with an oracle for C. And getting O of C as an input is quite significant because it allows the adversary to manipulate this object. It can dissect it into pieces, for example, or it can make changes to it and see what happens. So as an example, think again of this pictorial obfuscation from earlier. You could try to see as an adversary what happens to the input output behavior if you change a red area into blue or if you run the interpreter on the upside down version of the image and so forth. And the simulator, on the other hand, really only sees inputs and outputs and cannot do all of those things. And for some function families, like learnable functions, the difference really doesn't matter. Those function families are obfuscatable in the VBB sense, but for some more general function families, the adversary can take advantage of having an object to manipulate. And those function families are not obfuscatable. In 2001, Barak et al showed the existence of such unobfuscatable function families. And they did so by defining circuits where the adversary could really take advantage of the fact that they held this concrete obfuscation object in their hand and that they could break it up into individual parts or individual gates. And since our result will be a generalization of this classical impossibility result, I will explain some details of this unobfuscatable family that they defined. It will be a family F of circuits parameterized by an alpha and a beta. And the family will essentially consist of two types of circuits, a type that we will call C alpha beta and a type that we will call Z alpha beta. In total, this is still a subset of all polynomial-sized classical circuits, but if one can show that already this subset is unobfuscatable, then certainly the set of all poly-sized classical circuits is also unobfuscatable. And Barak et al then defined an algorithm A such that for all simulators S, the following holds. If the adversary receives an obfuscation of the first type of circuit, C circuit, it will almost always output one. If it instead receives an obfuscation of the second type, it will almost always output zero. So the adversary will almost always be able to tell the difference between a C and a Z circuit. And at the same time, they show that with just Oracle access, it is impossible to tell the difference between the two types of circuits. So no simulator can tell this difference. And now towards this contradiction, suppose that this entire class would be obfuscatable. That would mean that there is a simulator that can always simulate the output of the adversary. So both if the adversary got a C or a Z circuit, the simulator would be able to simulate its output. But that leads to a contradiction because no simulator could correctly output one whenever the adversary outputs one on a C circuit. And at the same time, output is zero whenever the output is zero on the Z circuit. Because that would mean that the simulator would be able to distinguish. This is a general structure of the argument to show that this particular class F is unobfuscatable. And now of course, it just remains to find a definition of C and Z so that the adversary can tell the difference, but the simulator cannot. And that's what I will do now. So starting with C, each circuit of this type is defined for the parameters alpha and beta. And it's defined for three different cases determined by the first digit of the input. So if you give it input one, the function returns a fixed encryption of alpha. And this encryption is homomorphic, which means that anyone, even if they don't know the secret key, can turn the encryption of some value Y into an encryption of F of Y for any F of that choice. They do need to know the public key for this, which is why that is also returned upon input one. That's the PK. On inputs two comma X for some X, the function returns beta if and only if the other input X was equal to alpha. This is called a point function. It is zero everywhere except at the point alpha where it outputs beta. And on input three comma X, the function tests whether this other input X decrypts to beta. If it does, it returns one and otherwise it returns zero. This type of function is known as a compute and compare function. It computes a function on the input, in this case, the decryption function, and it compares the result with a target value, in this case, beta. Now, notice that if you have access to this functionality through an obfuscation of C alpha beta, you could first request an encryption of alpha, then turn that encryption of alpha into an encryption of beta by homomorphic evaluation of the second line of C and then input that resulting encryption into the third line to observe the output one. And for the homomorphic evaluation, it's crucial that you have access to the obfuscation for C, not just an oracle, because you want to run the homomorphic versions of each gate in that obfuscation. So you need to be able to see those gates, like break the obfuscation up into its individual gates, see those gates and run the homomorphic version of them. And if you do this on this circuit C, you will get output one out of the last line. Okay, now for the second type of circuit, Z, this circuit is identical to C, except for the second line. There, instead of a point function, it just always outputs zero. And what this means in particular is that since there is no connection between the alpha and the beta anymore, if you try the same tactic as before, your third line will always end up in the otherwise case. So outputting zero. You will not be able to recover an valid encryption of beta if you have access to the Z functionality, not even if you have a physical obfuscation in your hand. And what I've argued here is that an adversary, given obfuscation of either C or Z, can tell the difference. There is a way to make the C circuit always output one, and the Z circuit always output zero. And to complete the impossibility argument from the previous slide, you would have to still argue that a simulator cannot tell the difference between these two types of circuits if they're given only oracle access to them. I will not go into this during this talk, but essentially you can argue that a simulator would have to guess the plain text value of alpha and thereby it would have to break the encryption in order to tell the difference by querying the second line. Okay, so we established that classical circuits cannot be obfuscated into classical circuits, or you could even generalize these arguments and say that they cannot be obfuscated into any classical objects. But what about obfuscating classical circuits into quantum states? This is a potential way around the impossibility result from 2001, and it was already observed quite soon after that appeared and posed as one of the 10 semi-grant challenges in quantum computing theory by Scott Aronson already in 2005. It was only in 2016 that a luggage and featherman made some progress in adapting the classical proof, and they were able to show that classical circuits could not be obfuscated into something they call reusable quantum objects, such as quantum circuits. But the full general result of quantum states turned out to require some tools that we didn't even have back then. And then in this talk, I will complete their argument and show that obfuscating classical circuits into quantum states is also not possible. Our result generalizes this classical impossibility result, but it only holds under the variant of the learning with error assumption. The classical proof doesn't immediately work in the quantum setting anymore, and that's mainly for two reasons. First, the homomorphic evaluation. A quantum obfuscation would not be a classical circuit anymore. So we cannot just straight forward, we break it up into gates that we can homomorphically evaluate. It's not even a quantum circuit necessarily, it can be a quantum state. So how do you break it up into individual gates? For this problem, there's a pretty straightforward solution. And the reason is that I already slightly adapted the classical impossibility proof when I presented it to you by assuming that fully homomorphic encryption exists. At the time that the original proof appeared, this was not just established. So if you go and look at the original paper, you will find that C and Z were defined somewhat differently. However, with this current formulation, we can simply say, well, the obfuscation may not be a circuit that we can run homomorphically, but the interpreter algorithm is. The interpreter may be a quantum circuit though. So we do require quantum homomorphic encryption. The second problem is a little bit bigger and we call it reusability. So in the classical proof, we run this obfuscated circuit several times. First to retrieve an encryption of alpha, then homomorphically, and finally for the computing comparative encryption. If the obfuscation is classical, that's all fine, but if the obfuscation is a quantum state, it's not so clear that it's possible to just reuse it many times. For example, maybe the interpreter algorithm is supposed to measure the obfuscation state in some way or do other stuff that destroys the state during the computation. And to solve this, we do two things. First, we note that if the output one of those steps is classical and deterministic, we can just safely measure it without disturbing the state and then revert to the interpreter to retrieve the original obfuscation, which can then be used again. So for example, after we run the first line to obtain the encryption of alpha, that's always just the same fixed encryption. We can just measure it, then reverse the computation and we will get our obfuscation back. And the same thing holds for the third line where the output is always deterministically zero or one depending on your input. Of course, this doesn't work if the output is mixed, which it could be after the homomorphic evaluation of line two because then the output may be a superposition of ciphertexts. Maybe there's a superposition of all for the same value, beta, but still measuring that ciphertext before reverting may collapse the superposition over the different ciphertext and then disturb the obfuscation. And to get around this problem, we have to reshuffle the circuit C a bit to make the homomorphic evaluation step occur last. The change to the circuits C and Z that we make will be in the last line. So instead of it being a computer compare function itself on the input X, we let it return a fixed classical obfuscation of that computing compare function. So I haven't changed anything about the function within the brackets here. It's just that the circuit C doesn't compute that function itself, but it statically returns an obfuscation and this O sub CC stands for a classical obfuscator for the class of computing compare functions. This is a subclass for which obfuscation is not impossible and it does exist under some variant of the learning with errors assumption and it's secure as long as beta is sufficiently random. And the adversary can do almost the same tactic now and still distinguish between an obfuscation of C where it will get output one and an obfuscation of Z where it will get output zero. The only thing is that the order in which the adversary has two things is slightly different. As it starts again with running the first line to retrieve an encryption of one which is a deterministic action and then reverts. And then instead of running the second line homomorphically which could destroy the obfuscation state it runs the third line to retrieve the obfuscation of the computer compare function which again yields a fixed deterministic result so that too can be just safely reverted. And it just remembers the encryption of alpha and the obfuscation of this computer compare function and only then the adversary runs the second line to either get an encryption of beta if the obfuscation was of the circuit C or an encryption of zero if the obfuscation was of the other type of circuit Z. This action may destroy the state but that's okay because the only thing left to do now is to use the already retrieved information in the second step about the computer compare obfuscation to distinguish between the two types of circuits. And note that this small change to the circuits although it made a lot of difference for the visibility of the adversary strategy doesn't help the simulator at all. A simulator would still not be able to tell the difference between a C or a Z circuit. All right, so those were the two main changes we made to the classical proof running the interpreter homomorphically using quantum homomorphic encryption scheme and solving this reusability problem by introducing an obfuscation of a computer compare functionality so that we could change the order in which the adversary run the circuit. But if you were paying close attention you may have noticed some problem already in the way I presented the classical impossibility proof. So recall that the first line of C it returns among other things the public evaluation key for the encryption. Of course, if this key is longer the size of the total circuit C grows as well. And since we need to evaluate C homomorphically in one of the steps that means that the depth of that evaluation also increases and that requires more key again. And one solution to this kind of loop problem is to assume a circular security of the homomorphic encryption so that the length of the public key does not have to depend on the depth of the homomorphic evaluation then we can break this loop. But we get around this problem in a different way namely by slightly adapting the circuit C again. We define the notion of decomposable public keys and have the circuit C return small blocks of the decomposed key at a time. These blocks can be generated efficiently and their size is independent of the evaluation depth. The user can reassemble the blocks again into the original public key after requesting sufficiently many blocks and the blocks do not reveal any additional information. And in the proof there are some subtleties to consider. At the point in time where we have to fix the circuit class the size of the interpreter algorithm is not yet fixed. So we don't know an upper bound to the number of blocks that we'll need. And in the end we have to really carefully work around the quantifiers and construct a circuit class so that for any poly-sized interpreter there is some circuit in the class that reveals sufficiently many blocks. And this is still sufficient to show impossibility of quantum black box virtual black box obfuscation because there are circuits in the class for which the adversary will succeed but the simulator will not. Okay, to just summarize, it will compare a construction to the two earlier works on impossibility of obfuscating classical circuits, the classical Barok et al result and the quantum obfuscation paper by a luggage and peppermint. So the circuit class that we proved to be unobfuscatable is the class of classical circuits. 2016 results, the circuit class contained a quantum homomorphic evaluation step making the unobfuscatable class quantum. This is a broader class and therefore the resulting impossibility theorem was somewhat weaker. The type of obfuscation that is shown to be impossible is improved from classical circuits or classical strings in 2001 to reusable quantum states in 2016 and to the most general case of quantum states in our work. And the compromise that we have to make for this is that our assumptions are stronger than what was needed before. In the earlier works, they only needed to assume that one-way functions exist or quantum secure one-way functions in the 2016 paper. Whereas for our result, we need a quantum fully homomorphic encryption and on top of that, we also need the compute and compare obfuscation. And for those two ingredients, we require the assumption that a variant of the learning with errors problem is hard for quantum computers. We were able to get rid of the additional assumption that homomorphic encryption would need to be circularly secure, however. So in summary, we strengthened the impossibility result by showing that an even smaller class is unobfuscatable even if the obfuscation could be a quantum state. But we do that at the expense of a stronger but still standard assumption. I also want to mention some concurrent work by Rolando and La Placa who made essentially the same construction as ours in the context of secure software leasing. Their goal is slightly harder because for secure software leasing, they need to exhibit a circuit class where the adversary cannot just tell the difference between C and Z but can extract some meaningful information from the obfuscation enough to produce a copy of the functionality. So in that sense, the result that they achieve is stronger and more general. They do use a circular security assumption but we believe that it could be removed from their construction using our techniques. And to end this talk, I will give a bit of an outlook on possible future work. The first one is a bit fake but it may be possible actually to get rid of the LWE assumption that we based our result on. And to do this, you would have to do two things. You would first have to find an alternative for the quantum fully homomorphic encryption maybe moving some classical part of it back into the circuit so that it doesn't rely on the learning with errors assumption anymore. And second, you would also have to get rid of this compute and compare obfuscation finding a different solution for the fact that the obfuscated state may be destroyed after homomorphic evaluation or showing that it's actually not really destroyed. And on the possibility side, a weaker notion of quantum obfuscation might still be possible. So for example, indistinguishability obfuscation is not ruled out for impossibility result. And it is getting a lot of attention in the classical crypto world and lately also in the quantum crypto world. So maybe possible to quantum obfuscate classical or quantum functionalities in this weaker sense. That's all for now. I hope you enjoyed watching this video and I wish you a great rest of the conference.


Hello, I'm Andrew Kongs, and I'm going to be talking about a project I've been working on for about a year, and the title of our presentation is Training the Next Generation of Hardware Hackers. What we've been developing is a set of tools and documentation to help people understand computer organization and assembly language. The goals of our project when we started out were to help people specifically undergraduates in electrical engineering, computer science, understand more about what was going on at the chip level, and that kind of thing, so that they aren't just blindly compiling code and not understanding what it's doing. And it evolved to where, well, we're obviously releasing this to the public, and we want anyone to use this who wants it and just want to help people learn. It took about a year to develop the things we've got to present today, including the hardware, and we have an assembler that we've built, and we have already taught this as a university course one semester, and we'll be doing it again at least twice in the near future. And again, we want to spread this, so the documentation that we're releasing online is free, and feel free to go do anything you want with it, try to learn. Assembly language itself, a lot of times can be a whole lot more difficult to use than something like C, if you want to get something done quickly, or just program a microcontroller. I can get something done in C in 10 minutes in assembly language, it may take me an hour. But the point is that you're learning it so that you can understand what's going on, and you don't necessarily have to always use this, but it's a good way to understand and then do it in a smarter manner, and you can go back and debug it as a disassembled code or something like that. So how are we going to help people learn assembly language in computer organization? Well, we developed an embedded system kit that we've got, and we wanted to put it in the hands of every one of the students taking our courses, so we had to make it cheap. One of the other problems is the embedded development software is really hard to use if you've never done it before, and people who use it all the time may look at me and say it's not that bad, but the truth is, if you've never seen it before, it can be really hard to use. If anybody's played with code warrior, it's not the friendliest thing on the planet compared to something like Java, but we wanted to give them a free, easy to use tool chain so that they could learn assembly language. To get the learning curve down, we actually had to write our own assembler, and that's the better set of tools that we're going to be talking about. Talk about the development board before I talk about the assembler. The development board is pretty small. In fact, I'm going to have to show you videos of it because I don't think you even want to be able to see it, but it's based on a pretty simple free scale chip similar to the chip that was used on the badge a couple years ago. There's only one chip on the development board, and you can load code on it over USB still using that chip. It's a pretty unique device, so we decided to build our kit around that. You only have 10 general purpose IOPNs, but for a learning tool, we thought that was enough, and it's, again, dirt cheap. We made 25 of them, or, I'm sorry, 50 of them for $25 each. We were doing this, we had to make a lot of decisions about what to use, and a lot of the textbooks for computer organization use MIPS, and we kind of abandoned that and went with what we knew and what we knew would be more difficult to teach, but we give people a better understanding of assembly language. The instruction set for HCS08, which is the processor on the development board we built, is a little more complicated than something like MIPS assembler, but it's more similar to X86 or something. It's got a lot of instructions and a lot of addressing modes, and of course, again, the design decision came back to the chip that we've got is ridiculously cheap, it's almost disposable. We were expecting students to fry the chip and need a replacement, and it's still be cheap to fix. The assembler we've written is written in Python, and you can download it off the website, it's on the conference CD, and it's pretty simple. You just run the Python file with an ASM file, which is just assembly instructions, and it generates the S19, which is the binary that you upload to the board later. And the assembler also spits out what's called a listing file, which is the assembled binary right next to the code so you can see what it looks like. And our assembler actually implements a couple of things that Dr. Jerry Cain came up with that we don't think are in any other assembler ever, but they're kind of hard to describe, so I'll direct you to the website if you want to play with any of that kind of stuff. We did not develop an IDE specifically because we wanted to make it simple, so it's just a command line application. And we also wanted to make sure that incoming engineers knew how to use the command line instead of have a point and click interface for everything, so that was another reason we used that. The bootloader that is on the device is not something we wrote. It is something that Freescale wrote that we are actually planning to replace because we don't like it as much as our ideas for what we could do with something. There's no device specific program where you don't need to go buy a specific tap or pod to reprogram it. Anybody can just, if you've got the board and a computer, you can reprogram it. So the idea was most computer science and electrical engineering kids have a laptop, so as long as they've got a laptop, they can program the dev board. And being able to program a real device instead of run code and simulator, we felt was an incredibly valuable experience compared to reading about in a book or running in a simulator. The bootloader that Freescale has only runs on Windows, and we're planning on rewriting the bootloader. We don't have it done yet, but right now it only runs on Windows, and the only problem with that is that we don't have it working on 64-bit Windows. I haven't talked to anybody at Freescale about that in a while, but it's kind of buggy, and we really don't like it, which is why we're going to write it. The kit itself contains the development board, which is tiny, and a solderless breadboard. I don't know if anyone can see this, but we just give them a little breadboard so they can hook up accessories that we've built, or LEDs, or anything that they've got. We put it in a 6x8 static bag. And the reason being that most people don't know about properly handling electronics. So putting a static bag and explaining static safety is part of the curriculum we developed, and we kind of discovered that there are some problems with static safety unless you beat them over the head about it. So we'll talk about that again in a minute. But we've also got a bunch of accessories. I'll show you a demo video here in a little bit, but we've spent a lot of development time on building things to plug straight into it so you don't have to wire it up yourself. That is a picture of the board. And as you can see, it is positively tiny. I built 25 of those by hand, and that's what the first semester was done with. There were 17 kids, and one of them was a computer scientist, but that's just how it came out. There were four projects where they were given a board and asked to write code and actually provide a working project. It was an on or off type of thing. If they got it working, they got a good grade. If they didn't get it working, they didn't get any credit for it. There was part of their final exam that was done the same way, and it worked really well. We had about half the kids do incredibly well. And between the remaining students, there were some that just didn't do well, but I don't think that was the fault of the course. We spent around $1,000 developing all this, and almost the entire dollar volume was spent building printed circuit boards. We've got a bunch of documentation online about the kit. We are not releasing a lot of example codes, specifically because we're teaching a course, and the problem with that is that if we release a lot of example code, then they can just program it and change a few things and turn it in. But the point is this is supposed to be simple and easy to use, and we've got a lot of helpful information online. This is some of the documentation we've developed, or an example of it, which is a state machine diagram for one of the accessory boards we've built, and this is simply emulating traffic light. And this is essentially to teach how a state machine works, but as you can see, it's just four states, and the code for this project is incredibly simple, but that's one of the things we're doing is building some of these diagrams. This is some of the real-world things we've included in the documentation, and this is called Contact Bounce, or Jitter. And this is one of the things we hope to show students is that it's not all theory. There are some real-world problems with developing hardware and software, and this is one of the things we've made them deal with last semester. The first generation of projects, the first one we had them do was we had them simply plinking LED, which is showing that they can plug the thing into their computer and get it working, which is not too hard. We then moved on to things like LED patterns, and I've got an example of, or a video of the accessory we built for that. One of them is a traffic light, and one of them is a little more entertaining. We have a small display that is an LED matrix where you no longer have enough general-purpose IO pins to just run the LEDs directly. You have to do some programming and clever tricks and interface with an external chip to be able to actually use the device. The piece de resistance of our semester last year was we built a vending machine that vended crayons, and that is my professor's choice, not mine. But it had motors and a bunch of storage areas where the device would actually have to bend a crayon to the professor before they were given a grade. A lot of things we learned the first time around when we taught this is, again, static safety. Students don't understand what that is, and a lot of people don't understand what that is. So we tried to enforce that by putting everything in a static bag and telling them these things are fragile and you should handle it by the edges and so on. And a reason we want to be careful about static is I spent about 40 hours replacing dead chips on these boards last time around, which was not fun, and since lead is poisonous, I really don't like replacing chips. We also learned that the bootloader, which we thought was wonderful at first, and after using it hundreds and hundreds of times, it just wasn't cutting it. So we're gonna re-implement that eventually. That's one of the things we wanna do in the future. Another one is we actually are going to put up some example code, but they will not be projects related to the course we're teaching. We also would like to build an inexpensive in-circuit emulator, and that's a device where you can step through each instruction one at a time and then see the real world changes that the processor is making. I think I'm about, okay, the documentation is available on my website, and I hope my little web server can survive, all the people going to it, but there's some PDFs and videos and a couple other things on the website explaining how you can get one of these boards. We've also got the Gerber files, which are the source code for the CAD drawings for the circuit board so that you can make one yourself or have someone make one for you. This is completely open. We are not, the only thing that is under the GPL is the source code because we used a couple, the source code for the assembler because we used a few libraries that are themselves GPL, but the rest of it is free, just take it. The parts list is online so that if you can have a blank PCB, you can put this together and start playing with it. And we want other people to use this. We want hopefully other schools or other organizations or electronics clubs to get together and build these kind of devices and play with them and just help teach others about low level hardware and playing with embedded systems. And now I've got some videos of the demos. The only reason they're videos is they're just too small, I can't hold it up and show it to you. And if you want to see these, I've got these things that I'm showing you videos of in my hand, actually. Plug in the device and this is actually kind of hard to say on the video, but it says DC-18 for DEFCON-18. That's the LED matrix I was talking about. And on the back is the IC, which is a 16 bit shift register. And again, you can come see this if you want. It's pretty simple. The next one is this, which is my favorite accessory. It's called the Baby Cylon. And although it's not red, it does scan back and forth, just like the sci-fi creature. And one of the projects we made them do was code this in assembly. And it's pretty straightforward, but again, this was like the week two project. This is the state machine diagram I showed you running. And it's a board we built that simulates a traffic light. And again, this is not a supposed to be an impressive example, but it's a kit we've built so that you can do this and understand the code easily.  Otherwise, it functions like a normal traffic light. And I wanted to thank the University of Tulsa's Institute for Information Security. It would not have been possible for me to get here without their funding help. It actually cost more to get me here to talk about this than to build the whole project. So thank you to them. I'm gonna hold questions in the little side room in a little bit, but I guess I have a little bit of time. So if anybody has any questions while we're still in here. Oh, and thank you to the local Apple store. I left my power adapter and they gave me a free one. They were kind of awesome. Any questions? Most of them liked it. Or the question was how the students reacted to the class. Most of them liked it. They liked being able to connect up the board and see what their code was actually doing in real life. And they couldn't imagine how you would have done it any other way. And all the people we talked to that took the previous version where it was just all theory, really wish they could have taken it this way. So, well, right now we only have one computer science guy take the course, but the main difference was that they had already had some coding experience, or the computer scientists have had some coding experience where the double E's. This was their first opportunity. So it was a little different for them. But next semester it's going to be almost the opposite. It's going to be 35 computer scientists and one double E. So I'll be able to answer that question better in a few months. It's a 2000 level, so second semester or third semester depending on which major you're in. Okay, and I will be in the track five question and answer room if anybody has any questions.