Check it, check it, check it, it's a unique hustle. It's your boy, E-C-E-O, and I'm here with a lovely, amazing official, Ms. Jamaica. What's going on? No, no, Nino Madel, well, go on. I want y'all to stop what you're doing right now. Go like, subscribe, follow us on all social media platforms. I mean our Instagram, TikTok, Snapchat, Facebook, you name it. We're on it. But if you want to see all our visuals, you got to go tap into our YouTube channel. There you see all our exclusive content. But the only way you see exclusive content now is if you buy our memberships. How you find our membership is under each and every video in the description section below. There is a link that says join our membership. Click that and you'll see all you need to see to be entertained and informed. So thank you in advance for all the support and we love you. Hey man, listen man, these guys don't need no introduction. We down here in ATL, man, it's going down.  One, you know, you're going to be familiar with on the channel. My guy, Charlotte Lowe Jr. is in the building. Now this newcomer, this guy right here needs no introduction. It's one of the coldest niggas to do it. And he's saying something in the slogan. I'm going to let him tell you. I'm not going to tell you. Trial battle is in the building. Hey man, what's up man? It's your boy Trial Battle, man. The best actor in the mother world. See what I'm saying? I told you. I knew he was going to say it. That's what he did. He come right up on here and said it. That's your slogan. Hey look, man, look.  Like we the best actors in the world and we train with the best actors in the world and we're going to inspire the best actors in the world and we add value everywhere we go. So yo, the best actor in the world, man. You know what I'm saying? Somebody going to have to come check me on that. Man, you know, Charlotte Lowe Jr., man, I reposted your first video, man. That thing went crazy. I called you. Remember that? Yes, sir. I said nigga, I reposted that whole thing. They didn't feel me that first time but that's the second time. But everything you got right, did anybody ask you about that? Man, actually, like after you had posted it, man, I got so many people to DM me and hit me up like, hey Bruce, I just seen your boss talk interview and this and that and whoop, whoop, whoop, whoop, man. Your story is so unique and how do you do it? And this and that, man, my DMs was flooded. That's crazy. It was crazy after that. Because I basically just said, you know one day I don't know what made me do it. I'm going to put this thing back out because these niggas didn't hear me. I didn't think they needed a hero. But you know, what we did and it was dope. Everything you said, it was on point. Just your story is so dope. So I knew they were going, I knew they were going if they get, if I get the right title and the right thumbnail and the right situation, the universe going to lock it in, you feel me? And that's what happened. And I appreciate that too. Man, so you know, so what's been up, man? What's going on with the music, man? Drop some new music. The air is my new single that I'm pushing. It's out right now on all platforms. I actually just shot the video to it today before I got here. So I'm going to get to see that. We're going to go down through there. Exclusive. Exclusive. When is it coming out? I'm actually going to drop it on March 22nd, which is my father's birthday, which that's big. Give me that date again. So that's March 22nd is when we're going to drop the official video for the air. But also, you know, March 22nd, that's my dad's birthday, which I put together a whole week. It's called Down Flow Week, right? So that's where we celebrate my father's life, legacy, and his impact and everything that he stood for and what he did for the people and everything like that. So Down Flow Week going to be big, man. I'm going to tell you now. So March 21st, I was actually able to partner with Tip. So Tip is going to... Shout out to TI. Yeah, shout out to TI, man. He ain't been nothing but a real guy the time that I've got to meet him and talk to him and stuff like that. So hit him up. Well, actually, he came out to Down Flow Week last year. He came out showing love and everything. That was that. So this year, we're going to partner with him at the Trap Cafe. So we need everybody to be there. March 22nd, we're actually going to feed the homeless. And then we're going to be at Sweet Lounge. That night, so I was going to say after that Saturday, which is March 23rd, we have the Celebrity basketball game. And then we're going to be at the Bank Event Center. And then Sunday, we're going to kind of have a Sunday fund where we're going to go to the park. We're going to have a DJ and everything like that. We're going to have a water gun fight and a balloon fight. And y'all know Trouble who passed school. So he had the movement with the water guns up, guns down here. So, you know, I'm going to pay homage to him and everybody else that we lost to gun violence.    For sure. Who all was getting involved? What happened to that little youngest boy he used to, your baby brother? And I still talk to Dooley. Actually, me and Dooley was just texting earlier. You know, he asked me what I was doing and stuff like that. I told him. How does he know? He's about to be 11. Wow. So he was three when my boss passed. So you spend time with him? Of course. I go pick him up. I go to his games and stuff. He hoop. So, you know, I kick it with him. I take him out of stuff like that.  Man, I'm old. Fantastic. So I'm being honest with you. I'll be waiting on you to redo songs. I can't wait. You know what I'm saying? I'll be like, man, I know you're going to bring me something back. You know, you have remixes. You do something.  I'm an old nigga. When you say the, you can't even say remix, no more. Can you? Yeah. You can't. Okay. It's the same thing. They remix. You know what I'm saying? Come back and they will remix them in a minute. Yeah, man. You young niggas don't, y'all might be calling it the flip or something. I don't know. It's a remix. It's a remix. Yeah. Don't make us too old. Yeah, man. Don't make us too old. Yeah. So, what, what? Okay. So you, you'll be on the country Wayne skits. Yeah. So, um, so yeah. You know what I'm saying? Once again, my name is Trio Battle. Yeah. I am on the country Wayne series on Facebook, on YouTube. So, you know, y'all may have seen me on like 15 skits in. Now I'm a front runner on it now. So we got a lot, a lot of dope stuff coming out, man. If y'all ain't paid attention, y'all pay attention to the storylines, man. The storylines be deep, man. Storylines be deep, man. Y'all, y'all, y'all watch the country Wayne series, man. Y'all be on, y'all tap in. Sometimes we have time. It's a lot, it's a lot of content. I talk to that nigga, I talk to that nigga all the time, man. That's the homie. But Mike Bless is, is, is like a brother. I talked to him the day before yesterday. Yeah, that's a big homie. We, um, matter of fact, uh, yeah, he up, shout out to you up there in the LA. I know where you at, nigga, right now. Shout out to Mike Bless, shout out to Wayne, man. Shout out to you. So I think it's that to get an important, you know, to, to get an opportunity to work with those guys. I mean, it was huge, man. I, um, I came in, um, I came in, shout out to SK Cast. And I came in, um, through SK Cast and doing a background. And out of 100 people, they picked 10 of us to play back, background gangsters. When I got in there, um, Mike Bless, as soon as I walked in the door, everybody had on black, I had on all white, you know what I'm saying? Mike Bless asked me out top. He said, uh, bruh, uh, you know, what's your acting resume? I said, you know what I'm saying? I got seven movies on 2B. I got six movies from the drop before the end of the year. You know what I'm saying? I'm working, you know? And he, um, and I, you know, I greeted the people I knew in the room and he was like, I bet you've been a runner's next skit. So on that day, I shot like four skits and he put me at the front run on all the skits. And then he told the cast and director about two skits and he was like, oh, yo, he ours, now it's over with. You know what I'm saying? He ours, now she was like down. Like she, she was looking. She was like, yeah, I like what he did with the who. And they, they put me on, um, on that platform. And I already been working. I already been doing stuff or whatever, but it's always good to be in different rooms and get recognized by people of value. You know what I'm saying? So I appreciate that. I truly appreciate you for the opportunity. And since then, um, we've been, we've been working, you know what I'm saying? They got, they got some good plans, you know what I'm saying? For us moving forward and, and I'm just trying to add as much value as possible. That's the biggest thing, add as much value as possible. So I'm thankful for the opportunity and I just want to add as much value as possible for sure. Wow, you know, um, it, it skits go crazy. Skits go crazy. Keep redeveloping. They never stop. You know what I mean? Shout out to country Wayne. He figured it out. You know what I mean? So yeah.  For sure. Um, I appreciate my, that's for sure. And I appreciate my brother for even considering me when they asked for him to bring in somebody. So yes, I'm actually in two and one has already been put out. So it's like, yeah. So just came out yesterday. Yeah. Came out yesterday. And he's already. So just to really be on that platform with everything we've got going on, bringing in them type of views and a different, a whole another audience, audience, group of people. You know what I mean? So that's going to be big for everything that I got going on anyway, or we got going on. Wow. You guys, how did you guys end up meeting?  See, I'm, I'm, I'm going to go into that real quick segue. I just want to know like E like for real it is big being on that platform. Can they get 40 million views a week from Facebook, between Facebook and YouTube? They get 40 million views a week. I think Game of Thrones was probably the only people that got the most views in them. And that's over a season. But like they really do like big numbers and they really take care of their people. They're really good people over there.  But they, but like from a person coming in new, they do. But how many my brother met? I met through, well, I used to work with his dad doing casting. So when I was in college, I used to get him girls for video shoots and stuff. My brother GT fams, he shoot music videos for, um, he didn't shop for everybody in the city. But um, the Lucy 762 video, like videos like that, like, you know what I'm saying, he went crazy. And he put me on and he let me be a casting director for Lowe. And I came and I built a relationship with him. So when he passed, of course, like, you know, I was in the mix, I was able to build a relationship with Lowe, with Kwon Do, you know what I'm saying, his other brother and um, and like we just building a legacy, man. You know what I'm saying? I think that it's beautiful for a man. Cause one thing about Lowe, don't nobody have nothing bad to say God and thank God. Like, even if they did, it don't even, it don't even matter. It's just, it's just blessings. And I feel like as a man, when you leave, when you leave this earth, you want people to speak highly of you. That's real. You know what I'm saying? So, so to be able to meet, meet that person and then meet brothers. And we born on the same day, our birthday is June 3rd. We born on the same day, you know what I'm saying? So like, and then, and then Kwon Do, his other brother, you know what I'm saying? In my, in my first cut, in my other cousin, Ty Black, they born on the same day. So it was a connection already, you know what I'm saying? Like one of my other cousins was Whit Lowe. It was just so many areas that we were already connected that it's like, we're trying to carry on this legacy forever. You know what I'm saying? We're trying to leave, like, you know what I'm saying? Like leave giving the legacy, just like Lowe did. And I think that's the biggest thing that like brought us together.  I want him to be great. I want him to be a great man, a God, fair man, a person to do.  They're my brother for real. Man, that's hard, man. When you got somebody you can, you know, rock out with this, really trying to do something that's positive and do the same thing you're trying to do when family stands first, you know? Mr. Maker, what you think about these young men? Then Jesus is popping chain. He be over there with country one, you know? I'm breaking down to you real easy. Let me break it down to you real easy. Charlotte Lowe Jr., you know already what he do, man. Like he's one of these guys, man, that I'm never going to stop talking to him. We're going to always shop it up. I'm always trying to figure out what he got going.  I'm just chilling. He going to be real calm with it. You know what I'm saying?  Man, no, she just went over there. See that? That was acting. I just gave you a little bit, nigga. I gave you a little bit. I gave you a little bit. I made y'all a little bit. You made me. You made me. You made me. You made me. Everybody, everybody. You made me. You made me. You made me. You made me. You made me. You made me. That's what I'm telling you, nigga. I'm good. I need to be on the show or something. So, get me on. I didn't do a Tubi movie. You know what I'm saying? Don't sleep on the Tubi movies, man. I got seven of them out right now, you know what I'm saying? We got eight movies out, you know what I'm saying? Seven on Tubi, one of them on streaming platform. I'll do it besides the comedy, but like, we got seven of them that's like, that's out on Tubi right now, and we got six that's gonna drop for the end of the year.  This is where we at right now. You don't want me to do it because I got all countless stuff. It's easy. It's easy. You already got it. John got shot? You know, I just do like that. You know what I'm saying? Ah! That right too. You got to have, you got to be ready. For sure. Most niggas ain't ready. For sure. How much hard did it take when you first started out just doing it? Man, you know what? My same brother GT Phyllis, that got me the gig with Lo doing casting, bringing girls and stuff. He is the same person that put me in my first web series. And that web series was in 2015. It's called Live Wider, and me, Capri Carter, Holtz, Showtime, Showtime. He's a big A.D. in the city. He's at A.D.'s, everybody's movies. Like, it was all of us starting off. And that web series got me my first movie. And my first movie was with Trey Cheney from The Wire, who played Poop. Yeah. On Jamal Gravy-Willard, who played Big in the Tour. That's on me. That was my first movie in 2020. And that came off of me doing a web series. So I would say just keep on working. What was the name of the movie? Out on the Limb. Out on the Limb. That's my first movie. It's on Tubi right now, man. Out on the Limb. Y'all check that out, man. Shout out to director Ocarique. Like, you know what I'm saying? Shop to shop. My brother who pulled me in on the project. Man, it was- That's hard. That's really hard. Yeah, yeah, yeah. Man, like, it's definitely big. But acting is being yourself. It's being yourself inside of a character. They give you a script. You be yourself. And if they need something else different, you know what I'm saying? You follow the direction of the director. But like, initially, starting off off the mud. Like, how you just did it? Hey, look, shout it out. Hey, who was that right there? Woo! That's how clean I was? That's you. You got it. That's you, baby. That's you. You feeling me something. I thought I ain't gonna lie. I was- I was tuned in like a Tubi movie. Yeah. Yeah. Let me just- Yeah. When you went to this show- Straight up. Yeah. Because what- And she attested to this show. I was talking about the acting sometime, the lighting and different things, the way they're filming. You can tell that it's- You know, they're moving toward it, but it ain't right where it need to be. Just she had a lot of times on those Tubi movies, right? Mm-hmm. But they getting better. Production is getting better. Me and T- Brandon T. Jackson. He got a lot of them on there, too. That's the homie. He just left the show. Yeah, yeah, yeah. Now, Brandon T. Jackson, hard, man. He went through a whole journey and stuff. Like, you know what I'm saying? He went- Yeah, he went through a whole journey and it's so sweet. Well, let's talk about the journey that he went through. Yeah, I'll leave it here. Yeah, you know what I'm saying? Let's talk about you. You threw it out there. So, the journey that he went through, he came on here and said that he went and wore the dress. Mm-hmm. He took something away from it. Would you be willing to put that dress on? Nah, I ain't putting it on. Bro, what? I want- That's just acting. You know what? You know what? And I know it. And I know it.  I'm gonna say this. Salute to Brandon T. Jackson and salute to the brothers that had to put on dresses to go through the wisdom that you had to go through to end up saying that. Because everybody made mistakes. Everybody could have did something because they're like, hey, look, let me get on. Like, I need to do whatever I need to do to get on to get this look, to get whatever, you know what I'm saying? And whatever it may have been, you know what I'm saying? Even if it was funny.  Different jokes on there that may be like, bro, like, dude. And people think it's funny, you know what I'm saying? There might be some left field stuff or whatever. They think it's funny or whatever. So salute enough for their wisdom. But nah, I feel like, you know what I'm saying? Definitely for me as a person, that just ain't me. That ain't no type of thing I rock with. So like, you know what I'm saying? Nah, I ain't going for nothing. I bring you in the room. I got the chair.  And I say, we want to talk to you about you wearing this dress. I'm going to give you $20 million. See what I mean? Just think about it. Don't, don't listen. I want you to think about it. We just need you to wear this dress. What you doing? You see, I'm just easy to say it when there's no money on the table. Yeah, when you put that bread up on the table. Oh yeah. He's going to make you go back and thank you. You're going to say, man, let me holler back and don't take, don't just, just hold on. Man, look, I'm just, just hold on. Oh, you see, I got the word dress. Can I, can I pull it to the side a little bit? Is it a cute? You know what I mean? Nick, Nick, Nick trying to come in there. Nick trying to get that $20, Nick trying to get that $20 million. What type of dress is it? Is it a sun? See what I'm saying? It is. Is it tight? Is it? Nick is, Nick is really, yeah. Watch that $20 million on the table. Send me a picture of the dress. But I, I, I feel like this, man. You know, so I always have my mind on like, you know what I'm saying?  And I, and I feel like that's off of communication and your imagination. They really like takes you there. And, um, for, because it's not my brand, I would never, you know what I'm saying? Partaking it. That ain't, that ain't something that I ever do. I don't want that for my legacy.  And that's just a personal preference. You know what I'm saying? No disrespect to nobody who does it. Like that's a, like for real. Martin Lawrence, he does it. And, and, and Martin Lawrence is one of the greatest. Jamie Foxx, he done it. And look, look, and I, and I, and I, Eddie Murphy, he done it. But, but you heard what I said to the boys. You say I keep going. The wisdom. Them boys, get to them.  Kevin Hart, he's done it. And look, and look, and the thing. Um, you want me to keep going? You don't even got to keep going. There's a lot I'm doing. I respect the orders. I respect all of them. Mrs. Dubfire, by, so it ain't just the mic thing. I praise you to work with everybody who, who, who was able to do it, you know what I'm saying? That's just not my. Flip Wilson done it. That's just not my calling. She smart as you, man. I'm not trying to convince you of nothing, bro. I appreciate the, the, the, the proclamation that you're trying to make out. This motherfucker, the, the God, man. Trio, Trio is a different, Bun B is the first person in UGK. I seen used that word trio. You know that when I seen that head that's the first thing I thought about you know what I'm saying because I'm a big PFC fan And that trio that trio is something that them boy used to they'll say it boy They'll put it in a wrap in a minute. That's how we got down and on it. Yeah and stand on it So shot a little junior man like like when you when you think about just all the stuff that's going on You know a lot going on in that dang media man He did if it to go to the prison or either they gonna keep Mike on a marker out of it Meek meals, you know, and you don't have to speak on just let me talk me meals was laying there With his back now, but they try that they clipping in all kind of ways, bro And it's crazy like how careful are you? Not to get caught up in seeing I'm telling you because you don't need to get caught up in the doing things That may make you look you a certain way like when you look at Shannon Sharp He got out to car in that green But I think you were trolling because it was from his channel. It was his stuff and the way that looked was like You see that right? Yeah. Yeah. Yes. I see now. He's still that way But I love I ain't gonna lie. Okay. Well, you know, I don't know if he will be in funny or I don't I don't I don't know I don't know I definitely love I love anybody that looks like me this doing this here for so You know, but boy, I'm telling you they've been giving him the blues.  I mean you really can't avoid it, man You know people I feel like people gonna find a way to try to find something to talk about to make themselves relevant And they might use you to do that for them.  Oh, yeah Yeah, I know like people a lot of people into a lot of stuff that I don't talk about So I'd be like looking at like damn They got some views to talk about that and the reason I looked at that one because Joe Rogan He was number 59. He had 59 million views on it on a on an alien type set up feel but Shall I show I'm just passing with cat Williams.  Yeah cat Williams is Yeah, he ran a 40 or 440 man that man. No Hey I ain't going He wouldn't move.  They'll always show me take off Man see but don't people probably clip see but see but I think it will know how many times they don't ran that Like like we'll know how many times they don't ran it to what they know when to stop it and beg it Say for folks on yeah, I mean so it's like he probably take off and down did a couple time I would not so we got to start it right here. So when you get here and say this I don't believe he probably you know, you know, he could have just cheated up a little bit Yeah, that's what I'm saying cuz he don't look like he running no 40. I'm a little like about 10 y'all 15 y'all 20 y'all Because me a person who played football and ran track. I know how that Okay, it seemed like you kind of any of it So I want to go on it and just gonna give you the question of the day since you want to talk You want to run up on this? Okay, you keep talking about it. So I'm gonna go and give it to you Would you be willing to raise cat for so in a park? Yeah, you think you can be them? That's kept bruh, they're gonna have to show me man. Come on, man I ain't going man. Can you what man? You got to show me problem? Pull it up so I can do the same thing Do all that he got to show me. Yeah, you gotta make me Make me believe where going on So you and ti man, how did y'all even come together to say he gonna be a part of uh, um, he actually came out to down for a little week last year, you know, and um, and um, I ran into him a Couple of times and um, I was planning down for low week This year and um, I actually called up to the truck cafe because I know you tell he typically Be up there and I was able to talk to the person who um, who he has running it Bit Mike shout out to bit Mike Oh, so so I told bit Mike my plans and he got tip on the phone until like man. Yeah, no with it I'm gonna do whatever With whatever you need. I got to this dad or whatever.  He ain't he for right He tried to do the right thing man.  I remember him. He wasn't on that no more You know what I'm saying? So it's not something he just changed up after the fact that I can know Now you might know a little more about it didn't me but it seemed like You know the older we get man, you know, and it will get a little emotional I'm about to cry now.  I don't even drink and I just tears just start falling See women look at that. I'm lying.  You would put that whole out They say I got the Michael Jordan face. Y'all got me To be a cry for y'all to be meming me y'all got me bent. I'm not doing it. I'm not going You know, I'm not going so don't even look for that. I'm just kidding. My fans know that I'm standing up on business like king Man, so what is what is what do you guys think the the because the more stuff that you create the more that's why Contraway them do what they do and I told you that a long time ago Remember I always tell you like the content is so important man What are you going to do this year and content on your own pages on your own youtube? What are you going to do to try to make the thing jump numbers? Me personally I mean the only thing I can do is for me. I feel like I do have Personality that I don't necessarily share with the world like how plies is just naturally himself and and You know people like that like that works for them So that can keep them going even when they ain't dropping no music and doing that And I feel like I do have that type of personality I just don't show it to the world. It's for the people that I'm with that I'm around and I'm close with Yeah, I mean when I'm around new people or or I'm on camera and I'm out having the business is business Wow, you're going to show that to the world brother for sure for sure. We got to have that bro Like so what how can people get a hold of you if they try to link up with you? man, um Y'all can buy big money man. Y'all can follow me at mr. Clark for mr. C ar C ar k4 On instagram and y'all to go to my bio man my late tree got all my movies in there Got my country Wayne skits, you know, so they're gonna take you straight to my youtube link. I got a playlist They got all my skits on there on country Wayne So y'all can watch what I'm on and they can go catch up with story, you know saying because if it's a lot They drop like 92 episodes a day So, you know, um, I feel like it's just tapping in man. Y'all tapping with me I'm tapping with y'all and on to answer your question about How do we feel like, you know, I'm saying as far as content how we building like I said, I got I got, uh Eight movies out right now one on streaming platforms and seven movies on to be And then like I said go to my link tree it's gonna pull up And then uh, I got six by the drop for the end of the year And I would say for me I'm I'm training with the best acting coaches in the world this year That's my thing like, you know, I'm saying right now this year is really really training, you know, I'm saying to be ready for it So, uh, my first really training class was getting on country Wayne because this train actors On their like and they cold as so they give me a lot of pointers a lot of game And it's continued to train and continue to be better Continue to be a relationship and it's up Man, so What you think about a shuttle? Did he tell the truth then because I'm pretty solid Oh, yeah, man, you know, I'm pretty solid drill head on everything. He holding it down Solid definitely real man, you know, like me being trio been rocking out, you know, um I met him after my father passed and stuff like that, you know, he always been a good brother to me You know solid he been there, you know, as far as just like All around advice if I need some, you know, we Outside of us at then we got songs together You know, um, we do down for low wheat We do like both was born on the same day June 3rd, so we do a week for ourselves, you know And I got kids he got kids, you know, man, you know, we just try to keep it in the family You know, we network and we bring it back Wow, so we'll Real team in the real powerhouse. Oh man. So really just everything they said man, you know, he telling the truth very good brother Inspiring brother, you know, like he said earlier, you know, he'll talk about nobody He'll talk bad about nobody I ain't never heard him talk bad about nobody Even when we in a situation where you got every reason to say some to somebody wrong or bad I ain't seen them do it.  That's huge. Actually. I don't know any guy, bro Wow Wow Wow and you on that show we country rain again. Jesus is popping. You gotta see it like that Say man, I can get hold of you trying to love Julia Man, y'all know y'all can follow me on ig that's shout it low underscore junior.   So that's definitely In the works and in the mix right now. So i'm working on that So y'all gonna know some and see some within the next couple of months. That's hard Man, man. Thank you so much for coming on the show, man.  Would you y'all always be together anyway? Y'all coming to Dallas man. Look man, we coming to Dallas man.  We're gonna have some lights for y'all Do what y'all like to eat man. Y'all tell us y'all favorite restaurant and what y'all like to do, you know Say so we can have a whole man. Whatever you cook get mad. Whatever you get. We we cook. I cook That's a whole. I gotta come right now. Y'all ain't done with it. Come by there tomorrow. We grab the best chef side Let's cook some barbecue or something. Oh, yeah You get out man. Look man. Look man. Me and me and me and my dad We got a restaurant called big daddy reds. We do pop-ups, you know, so he's out in Dallas right now I'm in Atlanta or whatever. Yeah, like so so yeah, be there. We definitely we definitely sit there and um And set it up, but I do want to say man.  Thank y'all for welcoming me in first and foremost But then being in here and just I was able to see before I was able to you know, I'm saying be here President what you think? Man, it's just amazing.  Yeah, like, you know, I'm saying Nigga be talking But you know what I'm saying, but but but it's an honor to be on your platform I think my brother shot a little junior for for allowing me to you know, I'm saying to accompany him You don't seem to be able to you know, you're always welcome man. Listen, you're always welcome. Ain't no problem man Let me know what you're gonna be in texas nigga. I'm bringing in the stew, right? We're gonna bring in the place to be man. Let me know what y'all want to get on these movies man Because I got a relationship Damn, I was just kidding Cut y'all Cut the nigga. Hey, stop man. You don't do that. There is gonna be bad I love but I but I will say this man for any um, you know Why are you trying to pivot and trying to maneuver and stuff like that just some game Man for anybody who is really trying to get out there and like publicity Man acting is a great way to get free publicity or pay publicity When you getting paid to publicize yourself when people connect with you They able to tap in with your individual brand So I would encourage people to go into the field and she be creative continue to move forward Like and whatever you're doing like that's some real shit. Wow. Thank you guys for coming on the show, man It's been another great segment A boss talk 101 Where the bosses talk? I'm trying to say it slow. You ain't and I put the point at the camera They told me it's been another great segment. Yeah, you see what I'm saying It gives them more emphasis when you do that. You know what I'm saying the boss talk 101 man What a boss is talk, man.  Dang. I'm just going down juneteenth What you gonna be out there for performing at the white house at the white house? Who brought you drunk? Who brought you drunk? You got them titted shoes too? Nigga, what's going on? So listen, so I'm actually a part of um, I I met the guy um a couple years back, uh O.g. Bob, okay, and he's a part of the juneteenth committee.  Oh, yeah, so me and him have performed at shoot over friends But I ain't really know who he was when he had gone on like man I love your dad and I love your energy how you perform. You keep your dad next year live this now Like yeah, okay. Yeah, because I get it so much Yeah, I mean, I'm like, I appreciate it. Thank you or whatever For following me on IG, you know, I'm gone But it's been like a year and a half or almost two years and he back up like I got this going on and I want to Meet with you. So we went to go and sit down for lunch. You know, he was just like, man, you know I got this going on. We actually gonna have the juneteenth.  I'm like Oh, yeah, I'm just that fast And uh, he was like, yeah, man, you know, I just try to help anybody if I can help and come and Contact with man, you know God is real. You know, we got to sit together and help Right, right. You ain't saying that wrong man I'm like, I'm like, you know, how many people I know would done her to Perform at the White House Not many Not many not many it's going down Charlotte low jr. Will be performing at the White House Joe Biden hair going up right there when that nico get in that nico hair coming up right there It's gonna go up when you get there.  I wonder what what a boss is talking about. I look real quick, man Can we do one thing that ain't been done before? Can we pray real quick Yeah You want to leave or you want me to leave let me let me leave Okay, man, man, let the king leave You know I'm saying man, this is what realness is about man. God. Thank you for bringing us here down here in Atlanta God, we asked that you just watch over these brothers keep a hedge of protection over these brothers God watch over family. I watch over everybody that's At the sound of my voice everybody everybody that's god that's Worshiping and the ones that ain't worshiping they got it might be stuck up under a priest god Touch his heart as well. Oh, father.  We pray man Amen Hey listen, man, that's easy. That's easy right there. I thank you. Thank you


The Internet of Things, or IoT, is an increasing trend to take devices not normally thought of as computers and connect them to a network. A consequence of this connectivity is that the security of these devices becomes more important. If you do a Google search for phrases such as IoT hacks or IoT vulnerabilities, you can see there are plenty of people talking about this. One way that many of these attacks happen is that the attacker is able to pretend to be someone that they are not. Maybe I can convince your Internet light bulbs that I am the cloud service that is supposed to control them, or perhaps I can convince the cloud service that I am a legitimate user who should be able to control your lights. There are many aspects to security of IoT. Today I want to talk about identity and trust. Security isn't really a new problem for computers. In 1979, Kevin Mitnick accessed a debt computer system and was able to copy software that was being developed. A lot of work has been put into making computers more secure. If you are watching this video now on YouTube, all of the data between YouTube servers and your computer is encrypted and protected through a system known as TLS, or the Transport Layer Security. TLS goes back as far as 1994, where it was called SSL. In the many years since 1994, computers have gotten more powerful. My desktop computer has many gigabytes of RAM, and the processor runs at several gigahertz. IoT devices, on the other hand, are usually much less powerful. It is common to have maybe only a few hundred kilobytes of memory, and the processor that is running it may be a hundred megahertz. However, since these devices are now being connected to the Internet, security becomes that much more important. The core of much of what is done for security is cryptography. Wikipedia defines cryptography as the practice and study of techniques for secure communication in the presence of third parties called adversaries. Before we move on, though, let's make sure we understand this word, communication. It is sometimes easy to think of communication as a live thing, maybe talking on the phone or texting someone, but communication can also be something that is stored. You are watching this video sometime after I made it, and while you are watching it, I will be doing something else. Cryptographers really like Alice and Bob, but as humans it helps us to think about abstract things such as computers exchanging messages, instead as people with friendly names talking to each other. An easy way to think about security is to think about what things we would like to know are true. One thing would be that we would like it to be true that someone outside of Alice and Bob, we'll call her Eve here, won't be able to know what the messages that Alice and Bob are sending to each other are. Determining what Eve can do based on what messages she is able to see is the topic of threat modeling, which would make another good video topic. A less obvious thing we might want to be true is that Alice and Bob are actually talking to each other. Our friend Mallory might try to pretend to be Bob when talking to Alice, and might pretend to be Alice when talking with Bob. Alice and Bob might not even realize that Mallory is doing that. It's probably a little hard to imagine if you think of them as communicating, say, over the phone, but maybe they are writing letters and Mallory works at the post office, or they are sending emails and Mallory has broken into the mail server computer. How does cryptography solve these problems? It develops something known as a cryptographic protocol. Wikipedia defines this as an abstract or concrete protocol that performs a security-related function and applies cryptographic methods, often as sequences of cryptographic primitives. A protocol is simply a formal way of communicating. It defines the exact messages that each party can send and what must be in them. The protocols themselves are built around what is known as cryptographic primitives. These building blocks are built out of things such as hash functions and symmetric and asymmetric encryption. There are usually not a large number of these primitives, but they are really hard to come up with. Most of the primitives that are used now are developed over many years. Often as a contest with cryptographers scrutinizing each other's work, the end goal is to make sure that these operations have the desired security properties and that the implementations really do implement these operations. But the primitives themselves don't really give you security. That's why the protocol is so important. It tells you how to use them. If you look at the changes that have been made to something such as TLS, some of those changes are indeed due to weaknesses found in the primitives. But a lot of the changes come about because vulnerabilities were found in the protocols themselves. To wrap all of this up back to our topic, what is trust in regards to cryptography? Trust essentially means that a party will behave as it is expected to. If you look back to Alice and Bob, it means that Alice needs to be able to know that she's actually talking with Bob and that what she says is what Bob will get. Trust is usually implemented using digital signatures. In my previous video, I covered some basic concepts and definitions concerning the use of cryptography as it relates to IoT devices. Before diving further into how this applies to IoT devices, I want to spend a little time discussing digital signatures themselves. Before we even get into digital signatures, let's take a few minutes and think about where the term comes from, signatures. In this instance, Alice is signing her name on a contract. And what this signature means is something along the lines of her indicating that she agrees with the document. Other times the signer of a document is indicating their approval for what is described in the document. Think of somebody writing a check. The meaning of the signature has a lot to do with the contents of the document itself, with the signature being a kind of testament that the person signing it approves of or agrees with the document. Unfortunately, paper signatures aren't very robust. It isn't that difficult of a skill to learn to forge someone's signature. Their signature is also not really related to the document contents. The document can be modified. The signature stays the same. From this, we can see two important principles that digital signatures will need to have. First, they need to be difficult to forge. And second, they need to be based on the contents of the document being signed. Of these two requirements, let's address the second one first. In cryptography, we have something known as a hash function. Two important properties of these hash functions are they take an arbitrary size document as input, and with that input they produce a fixed-sized output. Often the size of the output is right in the name of the hash function, for example, SHA-256 outputs 256 bits. These properties allow us to build our digital signature off of something fixed in size. In order for the hash function to be useful to us, it needs a few more properties, though. One, it must be difficult to forge. If I'm given the output of a hash function, it should not be feasible for me to come up with a document that generated that hash. To see why this is so important, even though our whole document will be visible, we have to consider the compression aspect, the large input, fixed output. The nature of this compression means that there will also be multiple documents that can produce the same output. If it's easy to come up with a document that generates a given hash, it would be easy to come up with a second document that produced the same hash. This aspect of collision avoidance is also a requirement of itself. The details aren't that important now, but there are cryptographic attacks on hash functions that often find generating two documents that have the same hash. The older MD5 hash function is no longer used, because algorithms have been found that can quickly modify a second document so that its hash matches the first document. This would be the equivalent of modifying the document that somebody placed a physical signature on. A common hash function these days is SHA-256. Some of the older functions such as SHA-1 and MD5 are now considered weak and shouldn't be used in new designs. Hash functions are one part making digital signatures. The other is what is known as a digital signature algorithm. Digital signatures use something known as asymmetric keys. Now, asymmetric keys are used for both signing as well as encryption, but we'll just be looking at the signing. We begin by generating what is known as a key pair. The key generator takes pseudo-random numbers from a source of entropy and produces two keys. The structure and the format of the keys depends on the algorithm, which we'll get to after we go over the process in general. One of these will be referred to as a private key and the other is a public key. The names are descriptive. The private key is something that the owner of the key needs to keep private. For example, on a device it should be protected from being read out, and the public key is just that. It can be known by anyone. With these two parts of the key, we can make a digital signature. The digital signature algorithm takes the private key and the hash of the message that we described earlier and produces a signature. The signature is also a small message. The other important part of a digital signature scheme is to verify that it is correct. The verify operation takes the digital signature generated before, the public key, and the digest of the message and tells us simply if the signature is correct or not. If any part of this were tampered with, the signature check would fail. For example, if the message were tampered with, the recipient would get a different hash, and the signature check would fail. What I haven't explained is how the recipient knows that the public key is the right one. An attacker might be able to change the message, but also substitute a different public key. Ensuring that the right public key is used will be the topic of the fourth video in this series. For now, let's just assume we have a way to ensure this public key is correct. Until now, I've shown the aspect of the algorithms abstractly. There are several commonly used digital signature algorithms, and each has some details and even caveats that are important to know. Now, the oldest commonly used digital signature algorithm is based on RSA. RSA, which are the initials of its inventors, Rivest, Shamir, and Adelman, is a relatively simple algorithm, but it's important to be careful when using it. An RSA private key, explained simply, is just two large prime numbers. For 2048-bit RSA, a commonly used size, these values, typically called P and Q, would be 1024-bit prime numbers. Their product is the 2048-bit public key. Choosing the two prime numbers has to be done carefully, or the keys are vulnerable. And if the same prime number is ever used to generate two different public keys, all of the public keys based on that can be easily computed. It's important to use established and well-tested implementations, and it's crucial to have a good random number generator to avoid these problems. Although RSA is able to sign small messages, meaning it would be possible to directly use RSA to sign the hash, there are numerous weaknesses with this approach. Instead, a scheme known as RSA-PSS, RSA Probabilistic Signature Scheme, is used. There is an older signature scheme, usually just called version 1.5, that although it's still used, shouldn't be designed into anything new. To summarize RSA-PSS, the keys are difficult to make, requiring quite a bit of CPU time, and care needs to be taken. Also the keys and the signatures are fairly large. For RSA 2048, a public key may be about 300 bytes, whereas the private key can be much larger, perhaps 1200 bytes. Signatures will be 256 bytes. RSA has the advantage of being fairly fast. Another commonly used digital signature algorithm is ECDSA. ECDSA is based on Elliptic Curve Cryptography known as ECC, which I'm not going to try to explain in this video. The algorithm tends to be more complex than RSA, as well as slower. However, there are some distinct advantages over RSA. First, both keys and signatures in Elliptic Curves are much smaller, typically an eighth or a quarter the size of an RSA key with similar security. It's also much easier to generate private keys, typically this is done by selecting some number of random bits and performing a simple sanity test. Rather than most random choices being rejected like RSA, most of the choices end up being fine as a key. One bit of complexity with ECDSA and Elliptic Curves in general is that it is necessary to choose the curve to use. The choice of the curve has a lot of impact on the security of the algorithms using it, and there are a lot of choices. NIST publishes a set of recommended curves, and a common choice is to use one known as NIST P256 or also SECP256R1. Like RSA, there are some caveats when using ECDSA. The signing algorithm itself requires some random bits to produce a number known as K. If the same value of K is ever used to sign two different messages, the private key can be calculated. It's therefore crucial that any application that generates signatures, meaning any part of the communication that possesses a private key, have a good, unpredictable source of random numbers. I'd also like to speak of another specific variant of digital signatures using Elliptic Curves, a signature algorithm known as ED25519. This is a signature algorithm like ECDSA, that also defines other aspects of the system as well. It is specified for a single elliptic curve, known as Curve 25519. This curve was designed to be easier to implement correctly and in a way that doesn't have side channels. Because the curve is specified and was chosen to be easy to implement, the implementations tend to be faster than ECDSA for other curves. There are even implementations that are faster than RSA. Although these tend to require a lot of code space for pre-computed tables. One thing about ECDSA that's different from the other signature algorithms is that it takes the entire message rather than just the hash of the message. It still ends up doing the operation on a hash of the message, but it prefixes the message with some secret data to reduce the likelihood of certain attacks on the hash function being able to weaken signatures made using that hash. It's still possible to give the signature scheme a hash of the message, but this advantage will then be given up. Given these choices then, how do we choose which digital signature scheme we should use for an application? There are several things to consider such as code size and performance. There are also considerations of long-term security and how the algorithms might be resistant to future advances in quantum computing. This overview of digital signatures has shown how digital signatures can be used, like a physical signature, to convey some type of assurance to a particular message. In the next video, we will look into the practical aspects of how digital signatures are used within IoT devices. Last time, we talked about digital signatures and how they can be used to convey some type of assurance about a particular message. I've decided to split the next topic into two parts. Today, we will cover how these signatures are used to protect firmware. In the second part, we'll cover how signatures can be used to protect the external network communication of the device. Before getting too far into how signatures help firmware, it's probably a good idea to make sure we have a good understanding of what firmware is. With a conventional PC, firmware is a fairly small amount of code, usually referred to as the BIOS. Incorrectly these days, I might add. This code is responsible for initializing the hardware on the computer and then loading the first part of the operating system that will run. Most of the code that you interact with on the computer comes from files on some kind of disk. These typical computers have several kinds of memory. I won't go into details about caches and such, but it is helpful to understand that the main memory of the computer, what someone is referring to when they say their computer has 16 gigabytes of RAM, is a type of memory that can be randomly accessed as well as randomly read. This memory is also fairly fast. The computer will also have a larger amount of secondary storage, often called disk, even when it's not. This might be a terabyte or more in a modern computer. Traditional disks are just that. A metal or glass disk with an oxide coating on them stores data through changing magnetic fields, quite literally spinning rust. More and more, these spinning disks are being replaced with flash memory, which has no moving parts. Data is stored by an effective charge within a transistor, designed in such a way that the charge largely remains present even when power is removed. These large devices are often implemented with a flash technology called NAND. NAND allows for great storage density, but it's fairly complex to use. It generally has to be read and written in particular ways. The system will have a flash controller that tries to make the flash device look more like a hard disk with fixed size sectors that can be read and written. An older form of flash memory, known as NOR, is what is typically used to hold firmware. The densities are much lower, and a device may have a few megabytes of NOR flash, contrasted with the hundreds or thousands of megabytes of NAND. NOR has the advantage that it can be memory mapped, and the processor is able to execute instructions directly out of NOR flash. This distinguishes it from most other code that has to be copied from disk into RAM in order to be executed. I'm oversimplifying things a little here, and there's some diversity in how real devices work. The flash memory though for NOR is still somewhat complicated to write, but this is usually managed in software. All of this introduction to memory types leads us to what I consider the primary distinction of firmware, that its code runs directly out of flash memory instead of being loaded into RAM. No smaller IoT devices do not have disks in them, and not usually even NAND flash that acts like a disk. The systems that do have NAND are usually managed similar to how a desktop computer would be. But for a smaller device, it's possible that the code has to fit into this one or two megabytes of NOR flash. Because software generally has bugs waiting to be found, it is important to be able to update these programs. Being able to do this upgrade reliably, for example so that it doesn't break the device if power fails in the middle of an update, is the job of the bootloader. I'm not going to talk today about how the bootloader does these updates safely, but instead about how it knows that the new image is coming in, or even the one that it finds in flash, is valid. Now before that you might ask, how do we know that the bootloader itself is the correct code? This is a very good question. Usually the bootloader has to be stored in the device in a way that keeps it from being modified. Sometimes this is done through a write once memory, other times NOR flash will have the ability to set protections on part of the memory that will allow it to behave as if it were write once. If we divide the memory addresses of NOR flash into several partitions, and put the bootloader itself into one of these, that we are able to protect, we can then divide the rest of the flash into two areas of memory. We'll call slots. This can be configured in several ways, but let's assume that each slot can potentially contain a run-in-place version of the application. It's important that it be difficult for an attacker to replace or just modify this image. There have been real attacks on IoT devices that were possible because their bootloader was willing to run whatever code the attacker wanted it to. To make this secure, each of these images will have a digital signature attached to it. The public key used for this signature will be stored on this unchangeable part of the bootloader itself. The manufacturer will have the private key and use it to sign the image before sending it to the device. This way the bootloader can decide if the image is valid, or if it's been tampered with. Before we wrap this up, I want to make sure we understand the uniqueness in this whole approach. We said before that the public key will be embedded right in the bootloader. This means that it can't ever be changed. If the manufacturer were to either lose the private key, or if that private key got out becoming a not-very private key, they might be unable to update the firmware, or unauthorized users might be able to update the firmware. There are some things that can be done about this, and in an upcoming video we will discuss how certificates might be helpful in managing at least some of this problem. For now, however, hopefully we have a better understanding of how digital signatures can be used to protect the firmware running in the device, a combination of hardware protecting the bootloader itself, and the use of digital signatures can make sure that the rest of the firmware image is valid and untampered with. Previously, we covered the use of digital signatures in IoT devices as it relates to the firmware of the device. I want to also cover how the device can use digital signatures to ensure that network communications that it makes can also be trusted. Let's start with what is probably the most familiar network application, the web browser. When you type the address of a website into your browser, generally one of two protocols will be used. The more basic of these, HTTP, creates an unencrypted connection to the server, and the request and web pages are sent back to you in plain text, free for anyone to observe, and even tamper with. The other, HTTPS uses Transport Layer Security or TLS to establish an encrypted connection to the server. The same data will be sent back and forth, but it is encrypted and protected by the TLS protocol. In just a few years the internet has gone from where most requests were unencrypted to now where a large majority of internet traffic is encrypted. If you remember back to Mallory however, someone intercepting this communication is still a possibility. I may think I'm connecting to www.mybank.com but I in fact am connecting to Mallory who then makes a connection to my bank for me. Everything I send he decrypts, observes, and then re-encrypts with the connection to the bank. Likewise, he will decrypt the data coming back from the bank and re-encrypt it for my browser, and I would be none the wiser. In watching, he both learns about my accounts, probably sees my login and password, and might even be able to modify the requests to redirect money to someone else. Of course, real banking doesn't normally work this way. So what mechanisms are in place to stop it? Essentially, my browser and the bank use digital signatures to ensure that they are talking to each other without another party involved. Let's assume for a minute that we have some way of knowing what the public key for the bank is. As part of the initial communication with TLS, the bank will sign part of the message with their private key. My browser can verify this signature to then be able to tell that the message came from the bank without modification. We'll cover how we can know we have the right public key a bit later. But for now, just know that it is through a system called public key infrastructure. Normal web traffic only has an assurance in one direction. The public key infrastructure helps my browser know that it is talking to the legitimate server for the bank. But the bank doesn't have any assurance about me. Rather than have the users have to manage public and private keys, users tend to just remember passwords, which they also tend to do poorly. When the connection is established, I as the bank customer have an assurance that I'm communicating with the right server for my bank.  Since the TLS connection is established symmetrically, the bank is at least assured that whatever party sent the passwords, meaning my browser, is the same party that the rest of the communication is with. How does all of this work with IoT? IoT devices will still need a protocol to communicate. TLS is still a good choice. For a protocol based on UDP, there is a variant known as DTLS. It can be possible for the IoT device to just have a secret password that it sends after the connection is established. It's also possible for the IoT device to have a private key. If the server has the public key, the device can sign a message as part of the protocol and use this to assure that it is a legitimate device. If it just used a secret password, the server would also have to store this password or something derived from it. Since back into password leaks seem to be occasionally making the news, we can have more security by only storing the public key on the server. There does need to be a mechanism for the server. One way to do this is to install the private key during some kind of factory provisioning operation and export a list of the public keys from the factory. As we will see in an upcoming video, we can also use something like the public key infrastructure to manage these secrets as well. There is one other area where IoT devices can make use of digital signatures. Something known as attestation. With the above use of signatures and a protocol such as TLS, the device and the cloud server can have some confidence that both parties are legitimate. However, an attacker may be able to modify the code running on the IoT device. Although it was a legitimate device earlier, it may now do illegitimate things such as forward sensor data, generate invalid user requests, many other types of attacks. One way to help mitigate this is for the device to gather what are known as measurements. These can be things such as hashes of the software running on the device and other information about the boot process. This attestation message is then signed with a private key or the public key is shared with the server using a similar mechanism we saw before with authentication. It turns out that this is really hard to do. It's just done in software on the device. The attacker can merely replace the code that hashes the image with one that just uses a predetermined hash. To make this effective, the attestation itself needs to be done and signed by a separate piece of hardware such as a TPM or by software that is protected from the rest of the system such as Trustzone. Done correctly, however, this can give an increased assurance that the software running on the device has not been tampered with. In the next video, we'll finally get to the topic of how public keys are managed which gets us into certificates and x.509. Up until now, whenever we've encountered a use of digital signatures, we've made an assumption that the party verifying the signature had the proper public key as well as an assurance that they had the right key.  There are several aspects of managing these public keys that we need to cover in order to understand how it is possible for various parties to trust public keys and to be able to associate them with a particular identity. As I mentioned before, one possible way of doing this is to communicate the public key through some channel that itself can be trusted. For securing a firmware image, the signing public key can be embedded directly into the bootloader in the factory, since firmware upgrades are relatively rare compared to transferring something like sensor data and are likely to always going to be generated by the same party, this approach works reasonably well. In fact, this is currently the only method supported by MCU boot. This can also work to some measure for the device identity key. The key can be installed in the factory, and the public key communicated via some out-of-band mechanism, say writing it to a secure device and delivering that by carrier. Even when a more complex approach is needed, there will still usually be a need to have an initial key that is stored this way in order to establish the beginning of the trust of these keys. When things get more complicated than this, say when there's multiple parties participating where one party may want to delegate this trust, we need a more complex mechanism. And this is where what are known as certificates come in. It will start by going over the concept of a certificate in general, and then we'll look at some of the specifics of X.509, the most commonly used certificate format. After this, we'll discuss the infrastructure built around X.509 certificates and some other mechanisms that can be used. Recalling back when we cover digital signatures, each key pair is made up of two parts, a public key and a private key. Each of these is encoded as a small block of data. The private key must be kept as a secret to the party that is signing the messages. The other can be, and in fact needs to be somewhat public. But these keys are just numbers, and there's nothing inherent about a given key to associate it with a given party. What a certificate does is that it bundles a public key together with a block of identifying data, and then that whole message is signed with the digital signature. In the simple case, a certificate can be what is known as a self signed certificate. Here the private key associated with the attached public key is used to sign the message. Since anyone can generate a key pair, attach whatever data they wish to it and sign it, it might be hard to see what the value is in this kind of signature. Indeed, there isn't much value in this except that it provides a convenient way to associate the identifying information with the given public key. Generally these self signed certificates are delivered through and out of band manner, similar to what I described earlier is just storing a public key. This helps identify at least who the key belongs to, as long as it actually came from a trusted source. When these certificates become powerful, is when the signature associated with a given key is signed with a different key pair than the one contained within the signature. This allows the party owning the self signed certificate to vouch for this additional certificate. Now this chain can be arbitrarily long, although it's generally kept to just one or two levels beyond this trust gets kind of complicated to reason about and the keys are easier to mismanage. So what this certificate chain allows for, for example, is that the device only needs to store a small number of these so called root certificates in the device itself. As long as the certificate chain sent during the handshake is ultimately signed by one of these trusted root certificates the device is able to trust the key at the other end of the chain. Now I don't have time here to go into all of the details of X509 itself other than some key points. Essentially X509 defines a specific format and an encoding of the information in the certificate, which includes the public key, the identity of the certificate owner in a format known as a distinguished name, and attributes on how the key in the certificate can be used such as whether it's allowed to sign other certificates. Over the years that X509 has been around numerous extensions have been defined, some made mandatory to allow keys to be associated with host names, IP addresses, email addresses and other things like this. The certificate including this signature is encoded using a format known as ASN1, specifically with its distinguished encoding rules, which ensures that the given data will always be encoded the same way. An advantage of using X509 is that there are several implementations of it available that address a lot of the difficulties of implementing it securely, such as all the rules necessary to determine if a certificate chain is valid. The format itself is somewhat archaic and although there have been some efforts to make something more modern none of really gained much traction. I think one of the reasons for X509's persistence is because it is used in what is known as the public key infrastructure. When you connect to a website using your browser, the website will send your browser a certificate chain. The browser has a small list of certificates owned by trusted parties that it requires these certificate chains to ultimately be signed by. As such to be able to have an HTTPS website, you have to go through one of these trusted parties. Small plug for let's encrypt by the way, they're one of the trusted parties in most browsers and have an automated mechanism that allows you to generate certificates for websites all without charge. This has been a large part of why so much of the web is now accessible via HTTPS. It's possible to use certificates and certificate chains without using this primary PKI. Doing this will generally save money, sometimes a considerable amount. But it does require that the entity running their own PKI establish and maintain the necessary trust. If this is entirely within a single organization this is certainly possible. But when multiple parties become involved these external trust vendors generally provide a useful service. So we've covered certificates and X509 but really only related them to such uses as secured websites. In the final part I'll cover how certificates can be used within IoT devices. So far we've covered digital signatures how these fit in with IoT devices and then certificates and how they can be used to make an association between public keys and particular identities. I want to try and wrap this up by tying some of these things together and discuss how certificates specifically X509 certificates fit within IoT devices. One of the more obvious complaints about X509 is that it is complex and requires quite a bit of code to process. This is indeed true. However, X509 support is needed for TLS and DTLS and a lot of these devices are able to use these protocols. Adding X509 support for other uses generally doesn't add that much code to the system. Smaller devices where TLS and DTLS might not be practical are also probably not talking directly to the internet but going through some kind of gateway. Generally there will need to be some kind of pairing between the device and this gateway and this pairing usually involves shared secrets. The gateway will be a more powerful system that is able to use TLS and any necessary certificates. Another aspect of using X509 specifically the public key infrastructure is the size of the root certificate list. As of the 2020.2.40 version of the commonly used CA certificates list there are 306 certificates which when encoded in the most compact form are 224,389 bytes. Although this size isn't too significant compared to a modern web browser it would be a significant amount of space for an IOT device where the code is often smaller than this. Fortunately, this isn't usually a difficult problem to solve. IOT devices don't generally connect to arbitrary internet sites. If the server or cloud service is known that service can restrict itself to a smaller number of root certificates maybe even one and that certificate instead can be installed within the application or device. One thing that is often overlooked with these certificates is that certificates expire. Part of the block of data associated with a certificate is a validity period. When a certificate expires it shouldn't be used anymore. In order to handle this the device will need to be able to periodically update the certificate list. If the list is hard coded into the application the application itself will need to be updated. Certificate expiration dates are often on the order of many months or years so this is usually not a significant problem. On the other hand if certificates are used to protect firmware these will either need to not expire or have extremely long expiration times. By its nature the bootloader needs to be difficult or impossible to update. It would be possible to store the root certificate somewhere else that could be updated later but this becomes a fairly easy attack vector. An attacker that is able to update the root certificate can replace it with one that they have a private key to which will allow them to sign whatever firmware images they wished. Normally certificates are made to expire to reduce risk from private keys that leak. In this case however adding an expiration to the certificate would probably result in a less secure system. The last thing I want to cover is the idea of provisioning the devices. This is really a topic for another presentation but I will cover it a little bit here. It will generally be necessary to get some initial private key into the device through an out of band mechanism. For example it could be written in the factory and the certificate or public key stored on an external device which is then delivered to the OEM. This is an area that is right for attack where a single point of attack can compromise a large number of devices. As long as the implementation is careful to never allow the private key to leave the device or even a protected area of the device the best an attacker should be able to do is get a list of public keys or certificates for these devices. There may be some loss of privacy here but it shouldn't be usable to compromise the security of the devices themselves. Beyond that there are some ways of adding new keys to a device. One way of doing this is to have the device generate its own key pair internally. It then uses this to generate what is known as a certificate signing request. This bundles the information that will appear in a certificate together but instead of it being directly signed by a trusted entity, it's self signed. It could also be signed by an existing trusted key or communicated over a channel secured by one of these keys. A trusted entity would then make a signed certificate out of this information and deliver it back to the device. It's also possible to generate the private key off device although there is an increased risk of the key being accessed in the process. In conclusion, making IoT devices both self secure and secure in their networking communication requires the use of digital signatures. Using certificates can help manage public and private keys but often trade-offs have to be made especially with lower powered devices. Okay I've been told that I'm muted hopefully this is better now. I was just mentioning that after this Q&A time here I also should be available throughout the day on the Slack channel, the track internet of things. Let's just get right to the first question. Someone asks are you seeing any common protocols for over-the-air updates? I'm familiar with suit and uptane but they are both nascent. Unfortunately, no, not really that well. I know of one in the Zephyr tree that's called Update Hub. It's an open source implementation. They also provide the hosting for the service. As far as that, I'm not actually aware of anything else that isn't also just something that's in development. Let me know if you have any more questions about that. I don't know if I do something to make these questions go away after I've answered them. Feel free to ask any other questions. I did notice listening to the talk that there's occasional little mistakes in there. I will be posting the slides that go with this talk to the schedule and what time do we have? We still have about four minutes. If there's not any other questions I can try to ask my own questions. I did, if anyone is interested please let me know. I did do some benchmarking specifically of the different signature algorithms and I have some results on a particular platform with RSA being the fastest and some examples of code size with that. The ED25519 is quite interesting because there are several implementations that differ drastically in code size from one known as Tweet Nackle that's like couple kilobytes to or Tweet Salt I guess it would be called or the Salt reference implementation which is about 130 kilobytes of code which is larger than the memory in a lot of these devices. The reference implementation is significantly faster than even RSA. In the MCU Boot project we did find one that's even kind of a medium size. It's about 10 kilobytes of code and it's nearly as fast so if anyone's interested in that I do have some references to that. I think that's all that I have for questions here. We do have a couple minutes left. Feel free to oh, I need to scroll down. What are your thoughts on browser moves to limit accepted certs to those with one year max expiration? I don't know if I really have solid thoughts on that question. It is kind of a trend. It's a trade-off. The let's encrypt only issue certificates with a 90-day expiration. I think for IOT use especially for bootloader certificates you definitely need longer expiration dates when there has to be some kind of thing that doesn't ever expire. All right, next question. How do you feel about external crypto providers like the ATCC 608 and such? I don't know enough about them to really comment on it so I guess I don't really know how to answer the question. I can look into it more if you're interested. Another question says near the end you mentioned self-signed for the bootloader. So I guess I'm not sure exactly how to answer that. The bootloader is generally would be self-signed or just not signed at all since the signature is embedded in the bootloader itself. Someone asks, are you aware of any solutions for platforms without secure environments? Well, we kind of have this already with MCU boot. There's still kind of a requirement to be able to protect the bootloader itself but we are able to verify signatures. It's about trade-offs and security. If you don't have a secure environment there isn't a place to store things so you may have to hard code them into the the bootloader for example may need to be hard coded. One more question and we're getting low on time here. The question asks is that, oh so this is the second part of the self-signed bootloader. Is that a typical situation? I struggle with how to manage keys for secure boot, etc. Other than saying yeah I feel the pain I think the key management is something that's not very well solved for these situations and it's something that we need to work on. I mean with MCU boot we have a Python script that manages the signatures that just live in files and the typical kind of device you would probably want to have an HSM that manages your keys. And I don't know if that quite answers the question but I think I'm out of time I believe it we're at the end. So thank you all for joining. As I mentioned I will be on the Slack channel if you have any additional questions. Thank you all very much.


It is the touchline here on Y244 Roba Rosoro is my name, I'm still having fun. This is our last segment and we'll be talking about everything that we are going to expect from the Tokyo 2020 Olympics being another Olympics that is being played under closed doors and this time round it is because of the coronavirus, the COVID-19 pandemic that struck us in the year 2019 and now we are still one year, seven months on to it and it's still ravaging. All people in the world, also an Olympics where, when Olympics was cancelled we have to go back to the world war two and also in 19, world war one back in the 1918-20 there and this has to be the third Olympics, no the first Olympics being played during a pandemic considering the other ones were cancelled and were never played before. Teras Wayake is here with me in this segment, we'll be talking all about the Olympics and also Sami Gitae here. We'll just throw it in. Tokyo Olympics is here, 2020, everybody thought this games are going to be cancelled but at the end of the day the International Olympic Committee stood their ground and let's talk about it. What do you actually expect from these years Olympic Games? Remember that they've also said officially the organisers of this event that it's not 100% guaranteed that the Olympics will run its full cost, it could be cancelled at some point because of we have no control of what's going on, we're smack bang in the middle of a pandemic but obviously you keep your fingers crossed and hope that it will run its full cost. What do I expect? I expect a lot of dominance from some of the world's most industrialised nations, spots and money go hand in hand, they are like a clenched fist, they are tight. So obviously the United States, China already are running away with it, the big countries Australia, the countries that have established themselves in the events that we countries like Kenya could have actually competed toe-to-toe with them but because of poverty, not just of the poverty of the mind, we like growing, we've got like Victoria here, we've got Indian Ocean here, we've got like Turkana here, we should be participating and competing toe-to-toe with these big nations in events like growing but we don't, we just hold those kind of events during cultural festivities that are normally held towards the end of the year you hear those Busea County cultural festival and there was rowing and you actually see footage of it and people cheer, that's an Olympic discipline so you see where our poverty of the mind lags us behind, we would be competing with these big nations so I'm expecting to see that dominance from the big nations in some fields that we ourselves could be dominating with them it is good that you have brought in the Indian Ocean because one of the new events that has come into this year's Olympics, surfing is going to be there, skateboarding is going to be there, karate climbing is going to be there also some of the sports coming back to this time, this year's Olympic Games we've got baseball, softball, 303 basketball and BMX bicycle freestyle, what do you make of that? Muscle surfing but for me one that goes with Kenyans at the moment because I usually see them during the weekends has got to be the street skateboarding it's an exciting time for those guys who take part in those games because probably thought they would never get their chance but they found it but for me actually the ones that stands out is that for baseball and softball, they are really popular sports in Japan and I guess that's the reason why they've been incorporated this time round, it's good to see them actually get new sports in there but again talking about the whole organization of the tournament, for me I wasn't just pleased about it I didn't think they had the best preparation, looking at how the countries came in, how they've handled the COVID-19 situation the cases are still rising in the Olympic villages, it looks like a disorganized tournament to me but I hope that it's going to live up the hype we have already seen the opening ceremony, it was quite vibrant, we saw even the lighting of the torch by Nomi Osaka from Japan I hope that it's going to be finished because they said that probably they are looking at ways where if they are not going to finish they could suspend it again so I just hope the situation will be okay for the people out there and it's not good because I've been seeing many negative stories from the athletes I've seen it from an athlete from the United States of America who is deaf and blind and she was talking about the provisions that are in that Olympics village that she can't carry her own personal care assistant and then we've had other instances of teams pulling out from the tournament we had Djibouti I guess who pulled out from the tournament, I just hope it's going to be incredible but for me the levels are still low we are out there and you are a fan of these new games, it's talked about baseball, softball, they'll be there and you'll be enjoying them but some of the games that we play here on Kenya like back, some time back when I was in primary school coming on to high school 33 basketball was a big thing, it was posted by Sprite, do you remember that one? I remember Yeah it was a big tournament here in Kenya and that is one where our teams can get onto it you are a fan of bicycle riding and you can do freestyle, BMX freestyle is going to be there and it's usually a fun game, if you watch those extreme sports BMX freestyle is one that you can go on and enjoy and for the people who enjoy skateboarding judgment usually comes down to how do you complete the stairs, handrails, benches and walls and if you are good at that no matter what you usually see here on the street something also you can train on and actually get onto the Olympics but for surfing we live to the people in the West and the South Americas but now let's bring it back home Yasami, we've got our team lioness there, the rugby ladies, we've got the boys there in rugby what do you expect from our teams from Kenya that have made it onto the Olympics? Well the good thing about those teams that maybe they'll be thinking of tomorrow I guess in the rugby tournaments they've been there, they've seen the competition that can be posed by the likes of Fiji and Tongas and Samoas and so I believe that they have learnt their lesson and I believe they are better prepared they jetted in quite early enough, the logistics were quite good as compared to the Brazil we had in 2016 and the team should be ready, I just hope that they are going to learn the lessons that they learnt before and they are going to make adjustments and probably stand the world because that's what we expect from these nations even if you're not going to win the whole tournament you're still going to have some standard guys as we've been talking about that lady from Zambia in Babra Bandas you're always going to find some new talent that are going to spring up and going to be hot property in the rest of the years and the Shujaa they'll be kicking out with a team they have usually played with win here, win there, lose there, win there they'll be kicking out of where the United States of America and then they'll be playing, that one will be on Monday at 5.30 in the morning then at 1pm they'll be playing South Africa then on Tuesday at 5am again in the morning they'll be playing Ireland let's talk about Shujaa, USA, South Africa, Ireland Familiar territory, this is not a culture shock for them is all the years of the seven circuits and that kind of thing have prepared them for this event but obviously now it's different in the sense that you're playing for Olympic glory you're playing to make history so the stakes might be a bit higher the whole world is focused on you even the guys that don't normally sit up to watch the seven circuits all across the world will now be focused on you so maybe there's added impetus, maybe there's more pressure and it shouldn't really matter do what you've been doing go out there and put in your best effort put in all your effort that's all you need to do and then the rest works itself out gradually don't go with the pressure don't go with any other egos if you have to keep off social media if you have to keep off mainstream media focus on the assignment ahead so if it's US, focus on US, finish with that and move on to the next assignment earlier on when we were talking about the afro basketball qualifiers you talked about COVID-19 and one of its advantages for Team Kenya was that they went in early and there were no spectators so they were concentrating soul on the game and the field of play when you look at the rugby teams and Team Kenya now in that bubble, the Olympic bubble and how they are going to play inside there will it play to the advantage? probably it should because it works differently for different players even in the basketball championships with a young group of players they worked well in behind closed doors so probably it could be the case and the good thing about that is that they are coming in and they think 5 days earlier it gives them a bit of a window to try and do the drills but for the rugby team I guess they went there quite early now and so they might have built up everything that they want to do and communication is usually easier when you are playing behind closed doors especially for the coaches they can be able to shout instructions whenever they want to and having a group of players that have played even in the worst of adversities when we used to have crowds in the stadiums I guess it's going to work up well for them well, the lionesses also their games they will be playing on Thursday for them they will be kicking off on Thursday 29 July and their first game will be 5.30 am in the morning again at New Zealand and then at 1 pm they will be playing Russia and then on Friday at 5 in the morning they will be playing Great Britain big thing that will be coming out of the Olympics big matches that also are coming out from there the Olympics usually football is not a mega event but for Africans football in the Olympics is big one for us because we've got two countries from Africa that are actually going ahead to win the Olympic gold medal Nigeria in 1996 and Cameroon at the year 2000 can that fit be repeated near time soon I don't think during this particular Olympics and if you allow me I'll just confine myself to this particular Olympics I was part of the contingent that analysed the Africa Cup of Nations under 23 and the top three teams from that tournament are the ones that qualified for this Olympics and when I look at what they have on offer our teams from Africa it's beautiful football no doubt about it but if you look at the current state of Soka vis-a-vis our African teams globally I don't think this particular tournament has a gold medal in store for us we would do well to clinch bronze there's no doubt about it and I'll be cheerfully happy with that I'll be content with that Gold would be a bit of a tall order a bit of a surprise it's welcome if we win it football is a game of surprises I doubt it but if we win it I'll buy you a pint the three teams in the Tokyo Olympics from Africa at Ivory Coast and they won their first match against Saudi Arabia by 2 goals to 1 Egypt managed that draw against Spain of 0-0 and then South Africa lost to Japan by 2 goals to 1 and the Brazilians had gone to Brazil versus Germany as they won by 4 goals to 2 and Rechales on the Brazilians scored a hat-trick in that game Rechales seemed to have enjoyed that game he did he scored it in 29 minutes so it was a very good game for him but I guess the highlight of that game was definitely Danilo Alves who made his appearance at that 8 years old as a right back positioning it doesn't look young it was actually fast you look at some of the balls that he was whipping in from the right hand side he looked better than those young players in that team and for Brazil them being the defending champions of course they won it in 2016 it's going to take something to beat those lads because they were so good against Germany which looked a little bit petrified they looked shocked almost people probably villain of the game so it was a lot to handle playing against Mathias Kunia whom we have seen already at Harter Ballin performing very well against the likes of Paulinho Fobal and then Rechales on who came in straight from the Copa America that was something good that the coach did for Brazil bringing in Rechales on straight in from the Copa America and then he comes in banks a hat-trick in the first 30 minutes to win the game Brazil are going to be the favourites definitely for this championship even more as these games go ahead at this time the women's football tournament New Zealand the United States is actually leading New Zealand by one goal to nil at the moment and at tennis the men's singles first round Novak Djokovic has managed to win against Dylan in 6-2 in the first round of the men's singles in the tennis tournament so far and currently the men's road rest final has come to an end with a goal going to Raul sorry for a moment just gone to Raul Karapaz of Ikwado who has won the men's road rest cycling there in a time of 6 hours 5 minutes and 26 seconds and then one avat of Belgium has come second there to clinch silver in that road rest in 6 hours 6 minutes and then Slovenia's TL Polka has also come with bronze in 6 minutes 6 hours 6 minutes and 33 seconds those are some of the completed results from the Tokyo Olympics as they are coming your way so far we'll be giving all those updates as we are talking about the Olympics is one event that we wait for because it gives us everything that comes on my director is telling me that my time is up but you've got to say that Oleguna Soldiers finally got a contract extension and finally has got Sancho to Manchester United Ya he expected that he made a post in March 26 that he would get a contract extension we've all seen the progress that he can make at Man United probably fans feel better right now that in a good position to win games you're playing attractive football under him and him getting there on Sancho you're getting in as a Bundesliga fan I've seen him play and I've seen him play on the left hand side on the right hand side and then England lost to Italy in the Eurofinals that was to be expected that was to be expected that was to be expected that was to be expected you look at the quality of Italian football at that tournament they were playing like the best Italian sides we've seen throughout history England were also doing well I've not seen such a polished English side since the 1990s the Glen Holdle team called France 98 to be precise but this was and they had the home advantage goodness I've never seen England so united behind a cause they almost deserved to win it but no with 76% possession during open play from the Italians you can say they were worthy winners and it ended one-one full time then it went to extra time then it went to extra time penalties because still at the end of extra time it was one-one and Italians won it on penalties it's sad that there was racism involved after such a beautiful tournament people hurling abuse at the three English players who were black that lost out on their penalty shootouts but all in all it was a beautiful tournament the best team won Sami, I know this is not your favourite conversation I will just give you you give me just a good that can make you happy Hamilton winning the grand play after getting a 10 second penalty I was really delighted for him because you would have lost a huge margin if probably Stappen would have won it and again I'm sad again that racism got its way into Louis Hamilton this time round it was a really feisty competition Stappen and Louis Hamilton going into the first few corners and a collision of sorts in the first 10 corners I think it was in 2010 we got that collision from and there's been lots of ritual on Louis Hamilton the expenses that Red Bull have suffered $1.8 million for the car that Red Bull now have to pay for I'm happy for Louis Hamilton that he can come back from those conditions he can get the penalty and come back and win the race at his home ground in Silverstone for the eighth consecutive time happy for him and I think the title challenge is on that is where we come to the end of the touch right here on Y254 Big thank you my titers guitar here was my co-host and also a fan favorite Sami Gitae who also came here for all the discussions about basketball and the olympics enjoy the best of your broadcast here on Y254