So the recording has started, I have a couple of short announcements to make before we have Kalea present on the flavors, VC flavors. One, we are bound by the Linux Foundation and Active Policy, so that's one of the requirements that all of the attendees have to agree to that. The second one is the Code of Conduct from the Linux Foundation, which says that essentially that you have to be, you know, when you, even when you disagree with people, you cannot be disagreeable, that is the first thing. Second is, permit everyone to talk, no rudeness, which is pretty straightforward. Anyway, so I think we have about 10 people right now and Kalea is going to present on a verifiable credential flavors, which is the various ways in which it can be presented and held and issued and so on. Everyone knows Kalea, that is what I've learned, and she's quickly becoming a legend. And without any further hesitation, I'm handing it out over to Kalea to begin the presentation. And mute. Thanks, Vipin. Good morning, everyone, or evening, depending on where you are in the world. So this is, I'll, I'm going to share a slide presentation version of the paper that was published last week by the COVID Credentials Initiative on our Linux Foundation Public Health, but before I, I just wanted to set some context, which is that I'm the Ecosystems Director and I work on COVID Credentials Initiative part time along with Lucy and John. We were founded last April and there are over 400 participants from around the world who are looking at standardizing productizing VCs and really focusing on addressing COVID use cases. And we joined Linux Foundation Public Health in December 2020. This is a really good match for us because Linux Foundation Public Health has been working on open source software with public health authorities and specifically the proximity detection applications. They host code bases for several applications that have millions of users around the world. At CCI, we have three different work, three different groups doing work right now. Use cases, implementation work stream, rules and governance and the vaccine credentials focus group and we're very keen on both open standards and open source development. This is more details about the specifics of our work stream and work products that we've already developed. And then in terms of open standard, that's one of the places that I've been really active in for, you know, decades, but really focused here on seeing how we can align the standards around fair product credentials and the exchange protocols. And we are also exploring the opportunities to take in different code bases and sort of provide core open source tools to enable the vision that we're articulating. And if you want to get involved in our community, these are all the places you can do so and these slides will be shared after we'll put a link to them in the show notes basically and I'll post them on slide share. So this is getting to the main agenda item, which is this paper. I was, I've been paying attention to these differences in verifiable credentials for quite a while and was noticing that some were dismissing the real technical differences as instead of understanding them as substantive and meaningful, we're dismissing them as tribal and petty. So the purpose of this paper was to really get clear these different technical choices underlying different flavors of verifiable credentials. So at its heart of verifiable, the verifiable credential standard is a data model. It's a universal data format that lets any entity express anything about another entity and provides a common mechanism for, for understanding that they're cryptographically secure tamper evidence and if you do it right, they can also be privacy respecting and they're all machine readable. So this is the core architecture that we're talking about. And within this, this is what we'll be going into detail on. There's a Jason LD family of data presentation along with LD signatures or with a new emerging signature format with BBS signatures that enable zero knowledge proof. There's Jason, which is can be signed with Jason Web tokens. And then there's the ZKP, Kemenish, Laskaya signatures or ZKP CL. This just since this is a hyper ledger focused group, this last ZKP CL is the type of signatures and data that is, is sort of the predominant form in areas, although there's new work bringing in the Jason LD, BBS plus work. So this is a verifiable credential. And there are two data formats and the signing mechanisms for claims that are articulated in the specification. So this is Jason. It's JavaScript object notation and it's open standard for object and document format that's usable for interchange and it's human readable and it consists of. Attribute value pairs and you can see a real world example of Jason on the right. And examples of the different types of values that are acceptable within this format. So there's numbers, there's strings. So the first name John is string. There is Boolean values of true or false. There's also you can leave, leave fields empty and they are null. And you can have an array, which is an ordered list of zero or more values, which may be of any type. So in this example, you see an array of different types of phone numbers, a home phone number and an office phone number. JWT claim is sort of leveraging this suite of signing capabilities and the current way that you find out what the meaning of the different terms are in Jason is looking them up in the IANA registry for different the meaning of things like name and phone number. And so there is this one registry and if the terms you want to use are not in the registry, you can use them, but it's really ambiguous what the meaning is. And when I've talked to large technology companies who implement this form and say, hey, how do you find out the meaning? They're like, well, I guess they guess. OK, so next we and then this is what it looks like when you sort of a very high level zoomed out graphic version of a verifiable credential in Jason. There's a persistent decentralized identifier for it. It has a set of name value pairs and those are signed using JWT using the private key of the issuer associated with the public key and the did document. For that issuer. Next, we have decent LD, which is JavaScript object notation linked data. So decent LD supports an additional layer of context to map the name part of the name value pair into an RDF ontology. So what is an RDF ontology? It's basically a way that to find out the meaning of particular terms, a large repository of RDF ontologies is found at schema.org. And this happens to be following the schema.org contact type of type for movie. So if you go and you look it up and schema.org, you can see what name, director, genre and trailer actually mean so you can do disambiguation when you're looking at two different credentials from two different sources and trying to understand whether they mean the same thing or not. And if they're both pointing at the same RDF ontology, they do mean the same thing. And if they're pointing at different ones, they may or may not, but you can do the machine parsing to figure it out. Additional features that Jason LD introduces on top of Jason is a universal identifier mechanism for Jason objects via the use of IRIs, way to disambiguate keys shared among different Jason documents by mapping IRIs in context. You're able to, this is really, really valuable. Animate strings within other languages. So for example, a real world example is the DIVAC code base that India's developed to roll out its vaccine is using Jason LD because they have 22 official languages, actually the total number of languages in India's over 700, but there's 22 official languages so they can have the schema for the credential and translate it into all those languages and be able to present it to folks. There's a way to associate data types with values such as dates and times and a facility to express one or more directed graphs such as a social network and a single document. So Jason LD also canonicalizes the attribute value pairs in a predictable way based on the information model being processed so based on the RDF. So this is what it looks like on a high level simplified graphic version. You have a persistent decentralized identifier that the credentials anchored to the context points outside of itself to a URL where the RDF can be looked up and it's signed using link data signatures with the private key of the issuer associated with the public key in the did document of the issuer. So neither of these formats easily supports selective disclosure and ZKPs, but both claim they can. If an issuer puts an attribute into its own separate VC, this is possible. So I could get a verifiable credential from, say, if this ever happened, the state of California that was associated with my driver's license. But instead of putting my birthday on it, they just say over 21 in the in a separate VC that I could use just to to sort of hack selective disclosure by having credentials that already are sort of pre-prepared to address various needs. It's not possible for a holder to separate different verifiable credential claims when they're all bundled together in one VC and both Jason JWT credentials and Jason LD, LD signature credentials require that the holder show the whole credential with verifiers. There's no partial share or show. And this makes it much harder to support selective disclosure. So this is a quote from one of the community members, Ori Steele. JWT is part of the Jose family framework and provides no means to support semantic disambiguation, but has the benefit of being simpler for assertion format implementation. So they is the rice and beans of Christyre who standards. It's got everything you need to survive and it's easy to make, but it's extensibility model guarantees you will be eating rice, base 64 URLs and beans, Jason forever.  On the other hand, link data proofs as seen in verifiable credentials and verifiable presentations are like the pharmaceutical drug. Really hard to build, but capable of solving all kinds of problems that formerly described by an information theoretic model where that molecular formula approximates RDF, link data proofs are capable of working with other bases, other structured data formats and extensibility model is anything that you can model in RDF. Context determines the relevance of either model. Most people don't go to pharmaceutical lab to make lunch, but most people who make drugs in their kitchen eventually end up sick. So now we get to the presentation side of things. So this is again, this high level graphical attempt I have at sort of encapsulating what's true for both Jason and Jason L.D. is that you're sending the assigned version of the whole verifiable credential to the verifier. And it contains a nonce that's from the verifier so that the presentation of that credential can't be replayed. So this is a strong security feature, but you can't selectively disclose. So now let's move on to the understanding ZKPCL. So schemas are defined in a document that's written to an indie ledger so that they can't be stained and to update the schema a new version must be created and written to the ledger for future use. And so this is, I kind of want to let me go. So this you can see the schema definition is here being posted to to the ledger. The other thing that's different about these credentials is that they're anchored to a link secret known only to the holder and stored in the holder software. And this has been described to me as somewhat of a like a watermark. So it's really specific to the holder and it is like a number hidden within a number that you can prove that the whole that all of the credentials and a particular holders while it were issued to the same person and using that same wallet. And this is a positive thing in terms of, you know, a difference is that the ZKP methods don't use persistent dids to anchor the credentials to and creates a privacy problem when you share your credentials if they're all linked to the same identifier. So this is and each of the each of the messages in the credential has its own separate signature and it's through this mechanism that when you get to the verifiable presentation that the holder can choose to share some of those statements and not all of them. And the verifier can still do the calculations they need to get the proof that the statements haven't been altered and that they indeed came from the issuer. So. Hey, clear. Thanks. So I get with this C.L. signature that you could determine the authenticity of it. But how do you tell if they're manipulated? There's usually a hash or some sort of checksum or something. So how do you determine, as you just said, that they weren't manipulated? How do you determine? In other words, if your name is signed, you can look at the signature to see that it's authentic, that, you know, the right. I think you're going to have to ask him more areas per specific. OK. Person this question. I am doing my best to provide technically accurate yet simplified information. No, you're doing I just I. Yeah, it can you answer that question? Is there any. No, oh, there. OK, this is this is a public key signatures. It's so so there's public and private keys. And when you make a credential, you actually when you make a credential definition, you write to the ledger public keys corresponding to each one of those fields and you keep private keys in your wallet.  And and so it is unique to the item and to your public key that you published on the ledger so you can verify the the origin because you go out to ledger and you get that public key for that particular item and you authenticate the data that it's unadulterated at the same time. But it's yeah. Anyways, it's it's signed by the issuer's keys. Right. It's kind of a a subkey system. So when you write, that's the whole purpose of the credential definition. Do you write to the ledger is that you are writing in that credential definition? You're writing subkeys for each one of those fields that are public, private key pairs. That does I explain it OK? I don't know if that's true, but I'll go with it. I didn't understand that every single field in a in a in a in a ZKPCL has a separate set of keys to sign it. Yeah, it's it's a it's a subkey, but yes, it does. You can look on the ledger, you can see them. Wow. OK, so this is why people say this is really heavy. OK, and then. There is a new emerging. It's now, I guess, it's getting to be almost a year old that this was put forward into the community, which is sort of combining the best of Jason LD with the opportunity to provide selective disclosure. And so they leverage Jason LD. So the meaning of the fields can be looked up in the same way that you do with Jason LD. And then each of the statements is signed separately with the issue or private key associated with the public keys in their did document. And you can either use the same mechanism that has been innovated for the ZKPCL to do a link secret or an alternative way, which is BLS SIG, which is less cryptographically heavy and is based on more widely spread cryptographic. Tooling. And then this is the sort of my high level articulation of the verifiable presentation where the the holder can decide which ones of the statements they want to share with the verifier and the verifier does their checks to check the veracity in this, you know, in the same way. So I feel like I missed a slide. I'm going to go back. Ah, we didn't miss a slide. So this Jason LD ZKP with BBS Plus is based on the usage of Jason these signatures and a sub. Which is a sub Jason BBS Plus Jason LD signature is a subclass of LD signatures. And it's used in common with combination with the Jason LD credential schema. It is a multi-messenger signature scheme. So that's where each of the statements is signed separately. And you can because of this, you can break up the claims into their fundamental attributes. And the benefit of this approach is that it provides interoperability with existing schema technologies and credentials using Jason LD and by extension. And it's fully compliant with the verifiable verifiable credential specification as it exists today. And by leveraging the technology of Jason LD with the specific set of cryptographic keys types and algorithms, the mechanism is able to produce a VC that can generate a proof of presentations and ZKP is the selectively disclosed attributes of a credential. So with that, that is all of the slides I have. And we can open it up for questions and discussion. Can you give examples? I'm of course familiar with the Hyperledger Indy. Can you give examples of where the other flavors are being used, what blockchains? So the blockchains, the least important part about verifiable credentials. Right, okay. They become very important in Indy because you have to go get the schemas, right? So let's just say like what other folks are using. So the Jason LD work is being used a lot in supply chain stuff because steel and pallets of microwaves don't need privacy. And so that's, and so the Silicon Valley Innovation Program has been really focused on Jason LD. So companies engaged there are using that. The Jason JWT is being sort of Microsoft's go-to and Workday has also adopted it. So, yeah. Thanks. Oh, and consensus. I have a question. Thank you for the presentation. Yeah. We know that verifiable credentials schemas quite generally need and it allows many different options, at least theoretically the models quite open. And for instance, it allows for the subject to be distinct from the holder, which is the most typical case indeed. In the normal case, we are thinking of the holder of a verifiable credential being the subject as well of the credential. Yeah. So that he's able to prove that he has proved a possession of the credential. Nevertheless, the specification as far as I understand are more open than that and they allow for different models where the holder is not the subject. The point is, I'm not aware in fact of any implementation in the present state of the art, dealing with subject different from the holder. Do you know of some of this implementation? Can you point to some examples? That might be relevant for some use cases we're considering. Yeah. Well, the subject of a credential about steel imports is the steel. Yeah. Okay. So all of those use cases that are around. Things. Are that. And the implementation supporting this concept. Yeah. Okay. The one which I know for more closely, namely hyper ledger areas. I have the impression that do not support this model. Oh, they must. I mean, there's a whole guardianship working group out of sovereign. And they've been working on this type of use case since the very beginning. Okay. So that, that should be possible. Yeah. Thank you. Thank you. So delegation and guardianship. Have been. Worked on. Like. Colleases. From. And stuff. And I, you know, as far as implementations go, we have to defer to the. People who know more about that. If Calias says there are. We assume there are. The, you know, we, we probably could question the identity working group implementers were, you know, identity implementers working group, which is kind of a sister group of this group. But I'm not sure whether such implementation fixed, because you are obviously interested in. Actual implementations because you're working on some kind of a delegation or. Guardianship. Use case. Yes, that's exactly the point. Thank you. Thank you. Thank you. Thank you. Ruben anything more to add on this because you. Mentioned that you. Use. Or anybody else for that matter. No, I just, I think maybe. We, when we started, we. I thought the. The tooling wasn't quite there yet. So we use JOT in the beginning, but we are now also going to add support for Jason. Because we believe that Jason, that he was BPS plus seems to be really good compromise to chief. A lot of the interoperability plus the security. So I think. That's our direction. And BBS plus work. Was done. Which is also a. Project. It started off as a lab. But now it's. Project. I think Mike Loder. Worked on it. He has a pretty. I'm safe explanation of. BBS plus. On the matter website. If anybody's interested. Not too much. Not too much. Not too much. Mathematic. Anyway. Yeah. And I think just to add on the previous point. There isn't an interesting. White paper developed by. IOTA. And how are they seeing. IIT devices using self-sovereign identity. Let me post that white paper link in the chat box. In case if that sounds interesting for someone. Yeah. Thanks. So I'll put the link to the paper in the. Chat. This is really. This was a very, I went by faster than I. This is my first presentation about it. So one by faster than I thought. But you definitely need to read the paper. If you want to actually understand all the things I said. Yeah. So the paper link is also being provided in the wiki page. And probably we'll have this. The slides also on the wiki page of. Our wiki page. In addition to the. The recording of the video. Which should give more. Exposure. To different people. I'm more interested in this. Because of the. Operability implications. Especially. In other space. Like, for example. Let's say you're doing financial transactions. And how can you. Create interoperability in that situation. Using. Identity as a pivot. And. So I, you know. Maybe I'll be looking more into that. And I think the CCI. Work is very interesting. We started off. Our year last year in April with. Basically. Explanation of the. Apple and Google schemes. To do. Exposure. Tracking. And now we have come to this. To the other side of things where we are. We have a vaccine. And I think.  Pretty extensive. Sort of. On it. Today's words, I think. At the WHO, right? Isn't that correct? Okay. You just went from like gain API. To WHO. I'm very confused. What are you asking? I'm not asking. I'm basically asking. I'm not asking. I'm basically trying to. Say that you had several. On this CCI initiative. And this paper is developed as part of that. That's, that's all I was saying. Anyway, I think we have come to the end of this. Presentation. And so. Unless somebody else has. Questions, we can close. I'm not asking. I'm basically trying to. Say that you had several. Questions. We can close. Or as fast. Sorry. It's okay. You know. We, we learned something. Unless anyone else or Calia herself has. Some things to say about this. The topic. So see you next time. Next time it's going to be drumming talking about his new book. That he's written. So that's. Two weeks from now. At noon. Thank you for attending. Thanks. Bye.


So we're just up on time but I just want to take a couple of moments to thank our panelists here, super engaging Q&A, definitely very on point remarks there I would say. I'd like to thank all of our speakers today as well, we had a broad range of topics and they were very engaging, so thank you to those. I'd like to thank the CDF for the opportunity to facilitate today, which was a fantastic experience, it all worked technically, thank you guys at the back as well. And just wishing you all a great week ahead, just saying for the summer, I hope you get a lot of benefit out of it and hope you enjoy your time here in Bilbao. Thank you very much.


Hello again. If you have heard my last talk, in my last talk I talked about how you can construct complete leakage models and in most of the existing tools they are very far from complete leakage model. So in this talk I'm going to talk about how you can reverse engineering the micro-architecture features from Cortex M3 core and make your leakage model a bit better, a bit more complete compared to all the existing tools. So this is the speaker is still me, Siko, and this is still my drone work with Elizabeth, but this time I also got my previous colleague from Bristol then on board to guide us through all the micro-architecture mysteries. All right, so we already talked about leakage simulators from my last talk. If you miss it, then leakage simulator are some early-stage feedback tools which can help the developer avoid using a real-life source as well or waiting for the response of certification centers. They can right after they've finished their code writing, they can check whether their implementation is okay, and this will also tell you exactly what caused a problem and how we can fix it. So although this is a really enchanting, favorable idea, most of the current simulator actually takes two different routes. One is taking the query box routes where you often see lists on ARM processors. For example, the ELMO family, whether you are using original ELMO, the extended ELMO called ELMO Star, you are both targeting the Cortex M0. So both, well, the entire ELMO family will always rely on the instruction simulator code and the simulator, which emulate the family instructions. So everything, all the knowledge are actually based on this. And your leakage model is trained from the profoundly trace you got from the M0 core you have. And most specifically, your model will focus on the ALU leakage from the STM32F0. And if there are a few extensions exist, for example, there are extensions on leakage on the memory bus. There are extensions extend this to another version of M0, for example, the M0 Manifact by NXP. And there are also extensions that extend this to the Cortex M3. You can also take the white box route. For example, what was laid out in MAPS in 2018 is taking the academic version of RTL code. So in this case, you actually know what's happening in the micro-architecture. You know everything. But they also actually choose not to include everything in their model. They actually choose to only focus on the register bit flips in their model. They only capture the register having distance. The good thing of all this is you don't need to guess about the micro-architecture. You know everything and you don't really need any measurements here. But a bit recap from my last talk when you are, well, verifying those models, both of them are really far from what's observed on the trace. So both of them are really far from I do. And the reason for that is both the models are quite, well, relatively simple. If you think about ELMO, ELMO Star, they actually focus on the ALU part. The ALU lies in, for three-stage pipelines for like Cortex M0 or Cortex M3, the ALU actually lies in only one of them. It's the esq. stage or the other stage, the two-stage, basically ignored. And also the model built is only for the ALU buses. I mark them as logitech lines here. Both of them are not actually in architecture level. They're both lies in the micro-architecture. That means you might not really know what's happening on those buses. For example, if we have this add instruction, add R0 to R1, you don't necessarily know which one will go to R0, goes to busway, or R0 goes to bus B. So what's happening in ELMO represents the ulcers, or we say more specifically, David's guess. And in maps, the situation is quite different. So maps have access to the white box code, so the RTL code. So there's no guessing involved. But the question would be like, is it really the same as the product on the market? So you don't necessarily know whether on provide us the same version, the academic version and the industrial version are they exactly the same, or whether the manufacturer might make their own revision. So there is some previous work working out in this direction and finding out their leakage behavior is not entirely the same. So we don't really know exactly why, but there are some difference. And also stated in our original map sweeper, they already said the leakage trace trace only the registers. So they only care about the registers. If you've got some leakage, not from the registers, for example, from the ALU, then that's not covered. So if you listen to my last talk, sorry about this, this is not exactly the same as W multiplication. This is another version. We actually work on several versions of SW modifications here. But this one actually helps us to explain what's happening in all those existing tools and what layer show comes. So this is another version written in pharma simply is still and the realistic one will be tested on ARM Cortex-M3 from the XP and with ELMO, I have extended it to the M3 model. So if you look at this, this is still 10 cycles, 10 instructions, but here we got two cycles being leaked, one in the second line and cycle 15, this is the realistic device results. We don't really know why, but if you take a look at ELMO results, ELMO miss both of the leaks. And for ELMO star, not only miss both of the leaks, you also provide and produce the false positive here. For maps, you capture one of them, but the other one is missing. And you might wondering why. So in general, that means your leakage model is overly simplified. It doesn't really capture everything, especially micro architecture features in your circuit, in your realistic core. This motivated for reverse engineering, the micro architecture features. By reverse engineering, I would like to mention this is a leakage-wise reverse engineering. That is, we only care about the micro architecture features that affects the leakage and can be observed from the leakage. So if it's not really leakage relevant, we don't care about it. And this is clearly not the same fine-grained analysis as binary code disassembly reverse engineering. And our final goal is building a micro architecture enhanced leakage simulator. Okay, let's start our reverse engineering journey now. So our starting point will, of course, be the public information from ARM. We know Cortex-M3 is a three-stage pipeline core. The three-stage usually called fetch, decode, and execute as this figure shows. And the only thing very interesting in this figure is in the decode stage, here it says not only doing the instruction decode, but also doing registry. This means the decode stage will not only do the instruction decoding, but also prefetch the necessary operand for the seal stage. This also means because there are pipeline registers between pipelines, then you need some register temporarily storing the prefetched operands. So at least there are two of them because most of the instructions have at least two operands. And also for the registry fail, because you need to simultaneously fetch at least two operands, you need at least two reading ports. And let's now take three-stage pipeline one by one. So first off, fetch stage, fetch stage fetching instructions from your memory to your instruction register. The entire stage is driven by PC, PC providing the instruction addresses. But if you take a look at this picture, most of the wires, the buses here, we know what's happening on them. We know the value on them. And perhaps more importantly, most of them are not even data dependent. So we only care about data dependency. If it's not really data dependent, it's branch-related issues. I personally believe there are better solutions for it. We don't really have to do this with leakage analysis. And for the decode stage, everything before the register fail, they are still not data dependent. But after the register fail, we got several reading ports here. And the obvious question is which operand for each instruction, which operand goes to which reading port, which will further affect what kind of leakage one might see. For this question, we have to test it because there's no way we can get it from the assembly code. So we test this customized code, where it's quite simple. The first XOR, we send A and B to the microarchitecture. And then in the next target instruction, I said, I send B, C and D. And then I would like to observe whether I can see an interaction, or you say bit flip between A and C, or between B and C, we find something between A and C, probably means A and C share the same reading port. Or we find something B and C, that means B and C share the same reading port. So in those four, below we have like four graphs, each of them, if you find something above the dash line here, that means we have observed a significant contribution of this interaction, whether it's A, C or B, D, A, C is the blue line, B, D is the red line here. So for both two operand addition and multiplication, we have seen both A, C and B, D, that's quite normal. And if you have only one operand addition, so for example, with one intermediate number, then you will only see A, C, there's no B, D. But if you have like three register instructions, such as list additions, then what we find is all three of them well below it, but only B, D is a clear interaction. So in this case, we can't necessarily know which one goes through each, we assume A and E share the same port. And there's still something need to be fetched from another port. So we assume there is a third port. This might not be correct, this might be something caused by physical effects such as glitches, but this is the best guess we can get. There are also some instructions don't load anything. For example, there's load instructions. In our test, it just don't have any interactions because it actually doesn't really load any operand. Okay, so the next step from decode to execute, we know that after pre-fetching the operand, we will send the operand to the pipeline registers. So we assume there are two pipeline registers here are say RS1 and RS2. The next question will be, first of all, which operand goes where? So you can still from here to here or from here to here. So you can still go other way. Or then there is also as because we are attacking while we're targeting registers here. The control signal can tell you tell the register saying, please don't update your value. Please reject whatever comes to your door and remains your previous value. So this is not possible with buses, but this is possible with registers. So we also like to know whether RS1 and RS2 will be updated or not. So I'll skip all the technical details, but directly telling you our results. So this is our previous results with which data goes to which reading port and this is our current results on which data enters which register. So a signal like signs like this means it will not be updated. The register will remain their previous value. And the last part of our analysis is the memory subsystem, which is kind of a headache. This is actually what this part is often ignored by most existing tools, but actually for a fair reason. So if you think about it, the memory system, although it contributes a lot to the leakage, actually lies a bit far away from the core. So this is graph from ARM. So our everything we analyzed actually lies within this blue blocks. So it's only a part of this blocks and this is the core. And where is the memory? The memory is not this memory protection unit. The memory is usually connected through here, something like this. So the memory actually lies far away from the core. And to make it worse, the memory is kind of self-timed. So it's not like the core telling you, please fetch me this operand. The memory will respond in a constant time. So the memory can say, sorry, please wait for me. And that means the memory, how the memory will respond, cannot be predicted by a simple instruction emulator. You might also need a memory emulator to know what's actually happening there. So this might be a problem for our completeness test because our completeness test is actually synchronizing what's happening on your trace and was actually executing in your micro-architecture. So if it's impossible to synchronizing the timing of it, if the memory can say, wait for me one cycle of scale and wait me five cycles there, then it will be an obvious problem. So here we didn't do what our euro thing did. Well, pretty much what the previous works has been doing, relying on the existing knowledge. For example, the memory assesses always work-wise, like I said in my last talk, and some specifications saying perhaps there is one data bus which is shared between read and write, and there is a shared address bus, and there is also an additional write buffer. So this is of course far from my do. And now let's see whether we can, how should we build the leakage models. We already know how the data flows in the micro-architecture. So first of all, how should we generally build leakage models for circuit. So in circuit, we have several components. For example, we have buses and registers. Previously, we usually assume buses, leaks is currently the value. So usually we assume it's hamming weight. And when they have bit flips, we assume it might also have hammy distance leakage, especially like registers we always believe it has, when it flips, it costs hammy distance leakage. So here what's happening here in the graph is if we, previous value is a prime, and now we have a new value a, then we assume the leakage can be a prime flip to a. And we take some conservative approach, assuming a prime and a will leak jointly. So it will leak both of them, it can include any sort of interaction, including the hammy distance, but not really restricted to the hammy distance. So for any bus or a register, we always assume that the leakage is the previous value times the current value. So jointly leaking. But for conventional, conventional logic, this is much more complicated because you have multiple inputs. And this will also create all sorts of glitches, which is quite difficult to predict. We also go through the conservative modeling, and we assume the leakage will be both all of its previous inputs times the current inputs, all of them will be jointly leaking. And again, for fetch, we already said all everything here is not really data dependent, so ignore it. But for the code after here, after the registers fail, everything is data dependent. So we have to consider it. And we already know what's on D.5 to D.7. So for all of them are three buses. So we just say each of them previous value times the current value jointly leaking. And for the excuse stage, we know everything here is a big combined tonal circuit. So no way to restrict it, what the leakage might look like. So we just allow all the previous input times the current input. And the memory, there are three buses, address buses, read buses, and the other is the buffer, so additional white buffer. So we assume jointly leaking on their own. So the address bus, the read write bus, and the write buffer. And all together, we add all three of them together. And we assume this is our overall model and verify the quality of that in our complete test in my last talk. So we have six instructions here. We can say most of them, if something is above the dash line, that means you're missing something. And for most instructions, we got something okay. But for the specific addition instructions, we are missing something. I will skip all the technical details here directly and tell you this is what I would call a glitchy register as it means the glitch is in your decoder will causes an incorrect register as we shouldn't really happen according to your functionality. But it happens and causes some leakage. So if you add this in, you will have find this line below the stretch hold. All right, let's now go back to our example in the beginning. Now we have reverse engineered all how the micro architecture flows in your core and how the leakage behaves. So let's now go back to our beginning example to say with C9C15, why is it leaking and why ELMO or MAPs fails in one of the models of them. So for C9, our explanation for this will be the C9 is leaking the ALU outputs hamming distance. So this is a bus hamming distance. It's not really a register. Of course, MAPs won't find this because MAPs doesn't really care about buses. For ELMO, because ELMO's model only takes the two operand bus, the input operand bus, and there's no ALU output operand bus. So this is also not in ELMO. For C15, this is register pipeline registers hamming distance, as we said before, MAPs takes care of all the pipeline registers. So of course, you MAPs find this, but ELMO couldn't. Okay, so let's shortly briefly summarize what we have achieved in this paper. So we have successfully reverse engineered the micro architecture of an M3 core. Again, this is a leakage-wise equipment version. It's not really comparable to any binary code on that list with a reverse engineered core. We built a micro architecture intense leakage model and show its impact on various masking implementations. We only talk about one of them, but there are more in our paper. And currently there are a few things we haven't, well, we haven't worked through. A few things we have touched, but not really in a mature stage. So for example, the cycle accurate memory emulator, we hope maybe the memory manufacturer can help us with this. And we can use the information, the reverse engineering, reverse engineering information to exploit more subtle micro architecture leaks, the system ongoing work. And I have done some higher-order testing, but not really in a mature stage. We, most of the experiments of all of the experience in this talk is basically first out there. And we are working on some flexible framework that works not only for the architecture, but also for perhaps in the future, RISV architecture. And last but not least, the leakage model we get here works not only for leakage detection, but also for more verification, but we haven't really gone very far in that direction. All right, that concludes my talk. If you have any questions, please ask me during the Eurocrypt live session. Thank you. Thank you for listening.


Hair up a little bit. Hey everybody, Charles Eisenstein here with my dear friend Becca Young Allen. Rebecca, I always call her Becca. She's the Executive Director of the Andes Amazon Conservancy, which is doing incredible work in, well, the Andes Amazon Transition Zone, where there are crucial wildlife corridors that are being threatened. But maybe I should let Becca talk about that. But I guess I'll just say that this project has really inspired me because it works on so many levels at the same time, ecological, cultural, dare I say it, spiritual. And it's the, you know, none of these, we tend to silo these things off in separate domains. But ultimately they cannot be separated, just like the Andes and the Amazon cannot be separated. Just like if two organs of your body were separated, they would each begin to wither. And so we have that, you know, in our society that when we divide up life into separate realms, each begins to wither. So anyway, Becca, do you want to have eyes so far given a accurate description of the work of the AAC? You made a beautiful start there, Charles. Thank you so much. And thank you so much for taking the time with me today to be able to tell this story a little bit. I'm really grateful. You know, actually, before I even get into the big picture of what we're doing here, I think I want to start with a story of one of our collaborators, Tsunkki Kahake, who is a shwar gentleman who has been a part of this program from the beginning. It's been about five years. He's one of the early collaborators. And Tsunkki remembers he's, he's a, I don't know, he's in his 60s now. And when he was a young man, he was living in the rainforest at the base of the Andes Mountains in the traditional ways. This was before development had moved in. And he tells the story of what it felt like to the people when the first road was cut through the land. Just that first cut. And they felt it physically in their bodies as if their own body had been cut. He said it was like a knife through our hearts when the land was severed in this first way. And that's just a very small example of the ways that the being body of the Amazon basin has been cut many, many times. And so I think I want to now like roll back a hundred million years because the Amazon forest is purported to be about a hundred million years old, which I can't even conceive of as a northerner where, you know, all of our landscapes were scraped down to bear rock 10,000 years ago, the last glacial cycle, you know, for life to be able to be in a state of constant generation for a hundred million years is extraordinary. It's just extraordinary. And so over those hundred million years, there have been long scale cycles when the glaciers move into the Andes Mountains. Over thousands of years, whole forest communities from the tiniest being to the largest creature slowly move and migrate down into the foothills and out into the Amazon basin where it's warmer and there's no ice. And then again, when the ice recedes 15 to 50,000 years later, over thousands of years, those same forested communities will then migrate towards the foothills of the Andes where the cooler microclimates exist at the base of the Andes. So it's this long scale cycle of flow between the Andes Mountains and the Amazon basin that has been a part of what is generating the astonishing biodiversity of this region. It's so beyond human comprehension. They did studies and found 100,000 species of insects in one hectare. It's so beyond this mind's understanding. And so what the highest level work that the Andes Amazon Conservancy is doing is to maintain pathways for connection that will allow these ancient evolutionary processes to continue as best they can within the context of everything that is happening on the planet. Mm-hmm. Right. And so what you've told me, excuse me, what you've told me before is how there's like a 2,000 mile long development corridor that's almost severed as the Andes and Amazon, but there's this couple hundred mile intact connector. And that's where the focus of your work is. That's correct. Yeah. So, and really, you know, the story I told about Sunki in the beginning was the beginning of that severing. About 60 years ago, the development began because it's just beautiful areas. So, of course, the humans want to be there. And so if you look at a large satellite map of South America, you can see this giant wall of development that goes from the Caribbean all the way down to the northern part of Peru. And it is very, very wide in some places and narrower in other places. But there is one place in Ecuador that is still open. I wish it was 100 miles. It's not 100 miles wide. It's really more like 10 miles wide. So it's very small. Wow. This is the strategic, very, it's like the acupuncture point that we're targeting for our work. And it's this location that is so key to keep open and maintain that connectivity. And so in that area, you know, there's the capitalistic economy has come in. And, you know, it's really devastated so much of the land and the culture already. So there's other strategies that are in play there. We have two primary strategies that we're using. One of them doesn't sound very sexy, but it's conservation land use planning and this allowing the communities. And I just want to stay first off that this entire program is being run by currently 75 indigenous communities that live in Ecuador, across four indigenous nations. So these are the quichua, the sapata, the shiviar, and the shuar nations. These are the nations that we're working with currently. And it's their program. It's their project. It's their land. And they are really guiding this. We're just providing the ideas and the tools. And then everything is being led and facilitated by the indigenous people. So conservation land use planning is preparing for a hundred years of population growth because we can't just plan for now. We have to plan for the future because it's going to, you know, populations are going to grow and expand. And so, you know, a lot of times in I'll call it 20th century conservation, we think about protecting an area and I'm using air quotes around that protecting because what that means is we wall it off, kick out all the people, and then say, there we go, the land is safe, even though it might be surrounded by development on all sides. But we know, based on connectivity principles, like if that land isn't connected to other land, it will wither just like as you say, like if one organ is disconnected from another organ in the body, both will wither.  But, you know, that's not true of the schwar and the others that you named. They were living there for, you know, thousands and thousands of years, and we're a blessing to the land. And so, so yeah, that's that's some so now we're not but you're doing 21st century conservation. It's correct. Yeah. Yeah. So it's not about walling it off, kicking the people out. No, the people are essential, because they are the stewards of the land. And, you know, you know, there's there's, I was read a really interesting science article a while back talking about that the Amazon rainforest is essentially a giant garden that has been propagated by human beings over thousands and thousands of years that so many of the species that are there are there as a result of this reciprocal relationship between the humans and the land over time. So no, we the humans are are we have a we have our our purpose on the planet, we do and our planet is to is to love and steward the land that we, you know, the gift of the land. And so rather what conservation land use planning is doing is rather than having isolated areas of protected land with development around it, it flips it upside down. And it says the human development will stay in isolated islands and the and then everything in between will remain open and flowing. And so that is what is happening on a fractal scale from over 75 communities. And so each of those 75 communities is agreeing to maintain their population human activities within a 12 square kilometer zone roughly, which accounts for 15 fold population growth and the amount, you know, a land needed for agriculture as well. And and then everything in between is considered a protected watershed or biodiversity reserve. Some areas have hunting allowed, some areas have hunting that's not allowed. And so these these knit together over vast distances and great acreage to create a network of what we're calling eco cultural quarters. And we're creating a new term here, the posted bio quarter, which is a very familiar term to the conservation world. But we're using eco cultural quarter to really center the fact that the humans, the culture is woven into the process and not separated from the process. So there's a network of eco cultural quarters that when complete will stretch for 175 miles and will comprise six six to eight million acres of land. And this honestly Charles is just a tiny drop in the bucket. I mean, it's like it's it's so insufficient. And it's necessary. Yeah. You know, the story that you started with the man who described the road is feeling like a knife cutting, cutting through himself. Like, you know, we could talk science. I know that, like, Adam on your team is, is, you know, deeply versed in the science of of bio corridors. And, and, you know, you spoke with some of the function, excuse me, the function of that area in terms in times of climatic shifts, and, and, you know, the number of species and stuff. And, you know, I kind of, it brings up to me the question of how, how shall we be guided and who do we listen to and how do we listen? Yeah. And, you know, I kind of, when you told me that story, that was kind of all I needed to know. You know, and I wonder, yeah, then when we speak of the, you know, actual science that coincides with that man's perception. It is maybe it's affirming, you know, to the other part of me that is conditioned in a scientific way of thinking.  And like, where do you begin?  And sometimes, you know, honestly, leave more harm than good in their wake. And so, so how do you like, I guess I'm asking many things at once. One of them is how do you build trust?  Yeah. You know, and, and, and how, how are you different from NGOs that come in there and here's the science and here's what we have to do. And well, you know, this indigenous people are very in the way, or, or maybe we have to pay lip service to them or like, like what's different about what you're doing? Yeah. Yeah. Well, there's very few newcomers that are a part of the organization. There's really very few. It's, it's, so for instance, a lot of, a lot of beautiful questions weaving in their trials. How do we build trust? We begin with the fact that for every indigenous nation that we're working with, we have a traveling team, a male female traveling team that is from the communities. They are the emissaries. They are the ones bringing the word. They are the ones that are going from village to village and talking to people. So, you know, and in the times that I've traveled along the river and gone down with Adam and some of the other northern team, you know, how we build trust is through music. Yeah. We go and, and we partake in the community's rituals. One of the most important one is the drinking of chicha and the passing of chicha with, which is a fermented yucca beverage. And so we, we sit and drink chicha for a really long time and share songs back and forth with the people. So that's one of the ways. And how do we listen? What do we listen to? One of the first things Adam does when he goes into a community, and this is Adam Jeb, who is our founder, is he talks to the elders and the hunters. And he asks what they've noticed about their wildlife populations over the years? And do they remember the time when there was giant wildlife populations migrating up and down the rivers?  So those are, those are confirmed. And when we're working with a community, what happens is that each community elects a small committee, a small selective group that represents the will of the village because the consensus decision making processes of each community are really essential. And those, the consensus decision making is what guides every choice that's made. And so we have this select committee. And one of the things that we added in this last year, which is really, really key is our grandmother program. And so we, we compensate a grandmother to be a part of the committee to help guide what is usually younger people that are part of this process. But as we bring different conservation decisions to the committee ideas for them to consider and play with, then they'll bring those ideas back to the larger community for the consensus process, which is long.  And then what they agree upon is what is enacted in the process. So it is not fast. This is a slow process. And the indigenous consensus governance model is at the center of it pretty much at every level that we work on. So yeah, we build trust really slowly. And it's not linear. I can tell you that it's not linear. Sometimes, you know, fear will come through a community and they'll say, we don't want to work with you anymore. And we'll say, okay, that's fine. And we just wait. We just wait. And it's, you know, in the beginning, when I first started this job, I would get really anxious about that. I'm like, Oh no, they're leaving. That's terrible. And then I've just learned by watching that you just wait. And then, and then the fear passes and they draw, you know, sustenance from the other communities around because that's that's so grassroots. This is spread from community community because communities speak of the trust that they've developed with us. And the communities share with their neighbors why they want to work with us. And so it just spreads organically. And now we have a waiting list. We can't actually service all of the communities that want to participate. And we have another indigenous nation that wants to participate. And we just have to kind of tell them we're not we're not there yet. We can't do it. But it's your role, you know, in this. So it's very grassroots, but you the northern team, you're playing an important function, you're kind of bringing information in that's necessary for them to interface with the legal system, you know, with with the government with funders abroad, right? There's all kinds of because because also you are funding some of these grassroots activists. Absolutely, like every single committee is funded. And so we're funding over, I think it's like probably about 180 people right now across the communities, just in the communities, including grandmothers in their each community. Is that where most of your budget is going? Well, that's a giant question of the budget. There's a lot of budget that goes into travel because majority of our communities are 100 miles past the last road, which means that every trip out requires a small plane trip with a little grass airstrip. So yeah, the back and forth there, that's that's that and funding our team. And we have a we have a indigenous team of 25, the leadership team in Ecuador. And there's only two white people, everybody else, everybody else is from the area. So yeah, the majority is going to human beings, it's going to the humans. And then, you know, food and, you know, we bring gifts to the community, which is really important to give that kind of funding because, you know, one of the ways that development encroaches is people, you know, need money, you know, as the economy becomes more monetized as traditional lifeways are eroded through many means through, you know, the loss of habitat that supports traditional lifeways through schooling, which separates people from subsistence ways, like all those things come in and, you know, all of a sudden people need money. And the only way to get it normally is to join in the development process and and contribute to the further erosion of the basis of those lifeways. So if you're coming in with an alternative, it doesn't even have to be that much money. Like I was really impressed with the amount, like the the the territory, the number of hectares that you have protected, you know, per dollar. I mean, it's like 10 or 100 times more than what a lot of NGOs do. Yes, you're meaning cheaper, less expensive. Yes. Yes. Oh no, it's it's very, it's very cost effective. I mean, this is the thing, Charles, like this, this model is a fractal model that is both scalable and replicable and can and should be applied all around the Amazon and all around the world in any places of global hot spots of biodiversity that we really want to keep from crashing. So it's it's it's it's really a great model. I'm excited about, you know, the world getting to give it a run. It really works. So you said there's two things. One was conservation, land planning and what was the second one? Okay, so the second one is really that's perfect because it really ties on to the more of the economic challenges. So out in the deep, deep rainforest, the cash economy hasn't really impacted people out there. There's nothing really to spend money on except gasoline, which is like gold for sure, because you know, they need gas to run the powder canoes that go up and down the rivers. That's their roadways. But at the base of the Andes, the development has been much more impacted. And the cash economy has just devastated the communities. There's so many people that are no longer speaking their native language. It's just it's it's heartbreaking. And in this area, the rainforest has also been really fragmented. And so our strategy here is edible forest planting. And so this is covering a lot of things at once. Number one, it's reintroducing over 20 indigenous species that used to be widespread, but have been over harvested and taken out. So we're reintroducing these trees. Now these fruit and nut trees like the Morete Palm, when mature can produce between two and 400 pounds of nuts per tree. This is a very, very culturally important tree because of the fact that it produces so much food. It's incredible. And so what we're doing with the edible forest initiative is very strategically planting in areas to create reconnection between rainforest that has been fragmented from itself. And so we plant in the areas that have been fragmented. And then this is providing number one, economic opportunity for the people that are planting and tending and doing all of the work of the nurseries. And number two, it's creating in, I mean, cheese, everything grows so fast down there. It's between five to seven years that trees will reach a level of maturity that they can really be producing food. This is producing food not just for the humans, but for the wildlife that is migrating along these eco-cultural corridors. But then is also the abundance that will be created will feed the humans and also, you know, if whatever is not eaten by either human or animals can then be brought to market. So that's the longer term plan on the Edible Forest Initiative. And yeah, it's beautiful. We've got two nurseries and just gorgeous trees growing. And right now they're being, our first crop of trees is being planted. And they're being planted along the waterways because the waterways, the rivers and the stream beds are the channels of migration for wildlife. So these are the areas that are getting reforested. In 35 meter swaths. And then once we get the first 35 meter swath planted, then we'll move out and we'll just keep planting outward from the waterways. So it's a dual strategy of the Edible Forest combined with conservation land use planning. So we're planning for future population growth. We're planning for agricultural needs and then planting where we need to do repair. Yeah. Do you have any, yeah, so I get the big picture here and I think it's pretty clear. And I wonder if there is, if there are any like stories you could share that by giving us the little picture actually help us understand the big picture, you know, like something that kind of sums it all up or something, maybe that it doesn't sum it all up, but it feels like this is close to the heart of what you're doing. Yeah, definitely. Yeah. So like I said, this is a fractal process. The same process is applied at the micro level as applied at the macro level. And the smallest fractal of this is the population growth area. So that's a 12 square kilometer zone where human habitat is going to stay. Now within that, when our indigenous leaders go into the communities, they'll ask the communities, are there things that you want to conserve within this area? And for instance, animal salt licks are really important or the streams and waterways within that area or a wetland zone. And we'll sort of send in some maybe northern numbers, like, well, for instance, a good stream setback might be considered 50 meters here. And what we find is that the communities want to go to the highest bar possible for conservation. So instead of saying, well, we want to have 50 meter conservation, they say we want to have 300 meter conservation. And that's the bar that they want to go to in their heart. It's like, oh, no, no, no. If we want to have clean water for the future generations, then we need to make sure that this is utterly protected. And so just this idea, just this concept that when the people determine what they want for their own land, they choose the highest bar possible for conservation, so that within that 12 square kilometer population area, then there's all of these mini and micro quarters that are created for wildlife migration within that. So again, super fractal from the micro to the macro, guided by the people and the heart of the people, what they want is they want the highest level of conservation possible for the land.  So often environmental controversy, environmental conflict is basically global forces versus local forces. It's the local people who are opposed to an incinerator or a whole bunch of wind turbines or a strip mine, because people naturally fall in love with the places where they live. And unless we're cut off from those places, I mean, now a lot of people are cut off by technology and can move from one place to another with actually zero impact on their day to day lives. But when people are in daily communication with the plants and animals around them and the rivers and are directly dependent on them in ways that they can see, then they naturally fall into the role of the defenders of those places, unless they are cut off or so so pressured economically that they have to ignore that their heart's calling to take care of their place. And that's really what's happened at the base of the Andes, because the people are really forced to deforest.  And over time, you watch the size of those logs get smaller and smaller, because they've harvested the big trees. And now they're coming down to the smaller trees and coming down to the smaller trees. But if the cash economy has invaded, there's no other options, because wildlife has already been so deeply impacted in this area, they can't live off the land in the same way that they used to 60 years ago, when the land provided all of it for all of their needs. And there was absolutely no need whatsoever for anything to do with something called money. But that's changed now. And that's why the edible forest is so critical. And again, it's like necessary, but insufficient, you know? And so, yeah, that's why it's so vital to be doing this in a much wider way, in a much, much wider way. So now you are raising funds not only to continue doing this work, but you said you're going to expand to another nation? Or like, what are some of, like, what's the big vision if there is one? Yeah. Well, the big vision is connecting between two major national parks, one in the Andes, Sangai National Park and Yasuni National Park in the Amazon, on the border of Peru. And so the big vision for Ecuador is connecting between these two national parks, 175 miles. The larger vision is that this is actually a pilot program, and that we can then take all of the principles and processes that we've learned through hard knocks, figuring it out as we go here, that we can bring it to other locations. And in terms of expansion, like, again, it's a network of connected ecocultural corridors. And so we can expand as far as we want to go in Ecuador, for sure. And then over the border into Peru would be phenomenal. And yeah, it's, I'm going to say funding is challenging because we are kind of flying in the face of standard practices, conservation practices. It's like new paradigm, big time. And so it's a little confusing for people. And it's absolutely essential. And, you know, in so many ways, I feel heartbroken that we are wedded to the current, like, paradigm of philanthropy, which has got so many problems woven in throughout it. But we are, like, we're bridging, we're bridging between stories, right, Charles, between the beautiful new story. And so in that bridging process, we are beholden to the philanthropic model. And so, yeah, I'm my prayer, and I do hold this as a prayer, is that when people hear the call, hear this call, they'll feel it in their bodies. They'll feel it as sort of a whatever, that beautiful worm sensation of like, oh, yes, like, you know, this has been funded right now because of two people that really felt and heard the call, in addition to other foundations and things that we've applied for grants for. But, you know, to be able to bring these resources directly into the communities, I mean, one of the things that we hear when we go into the communities, first of all, don't abandon us. That is literally the first thing that they'll say is don't abandon us, because it happens all the time.  And that's a legit reality, like that, that can happen, you know, you run out of your funding, and what are you going to do? Like, there's no other resources for that. So that's kind of my, like, the thing that I hold in my heart when I'm doing all of the development work is like, don't abandon us, like, no, I do not want to abandon you. I want to make sure that we have, I mean, come on, the resources on the planet, we know how inappropriately everything is skewed right now, it's just so out of control.  I know there's like, literally billions going into climate change philanthropy. Yes. And, and, you know, excuse me, gosh, the, the, so there's billions going into climate change philanthropy, and it's very based on metrics, you know, like how many, you know, megatons of, of, of greenhouse gas emissions is just going to lower, you know, it's very, because, and I can understand why, you know, they want to make sure the money's well spent, you need some kind of objective measure of it. But what gets left out of those metrics are things like the necessity of, of healthy migration patterns of wildlife to distribute nutrients and, and keep the forest healthy. Like it's really hard to say, okay, well, how many tons of CO2 sequester does that translate into? Like you can't actually see it through that lens. You can't see the, the, the importance of living networks, unless you're looking at Earth as a living being. Yes. And, and measuring, and measuring, if you can measure at all, measuring its health by something other than the quantity of a single substance. It's a completely different mindset. And that, that mindset, that holistic mindset that, that is not just ecological, but cultural too, that holistic mindset is, is very, it's, it's, it's, you know, kind of cutting edge and, and unfamiliar to traditional philanthropy. But I think that there are, there is an awakening, you know, among, in, in philanthropy, just like anywhere else, like every institution of our culture is having an awakening from within. And so I do think that there are philanthropists and funders who are, like in, like this kind of understanding and, and wanting to put their resources, you know, in places that, that, like the kind of things that you're doing that are tapping into a holistic understanding. And so I don't know if there's any of you listening to this. I'd love to put you in touch with, with Becca and the Amazon, the Andes Amazon Conservancy. Yeah. I don't know, do you have anything, any comment on that, Becca? Well, you know, I'm, what, what came back to mind was this idea of how much billions of dollars are going into climate philanthropy right now. And I, I honestly cannot think of anything more important than the protecting the resilience of the Western Amazon for the planet right now for the whole, for the whole planet. Like the Eastern Amazon, we know is in dire, dire trouble from deforestation and drying incredible drought that's happening there. We know what that does to the water cycles. So protecting and the resilience, this, this is the most resilient landscape, maybe in the world. And so, so holding dear in our hearts, this most resilient landscape, this jewel of the planet, I believe is the most important climate action we can take right now. And so, again, it's like, but which lens are we going to look through? We can look through the lens of, of carbon sequestration. But, but the problem is that the way that is generally measured right now is if there's imminent deforestation at hand. And so this, we're protecting this from this deforestation. But what if we're just protecting it, period? Like, we're not worrying about deforestation in the deep rainforest at the moment because the people are living in right relationship and they don't need to deforest. Right? So it's like, again, all of the rules are slightly skewed. And I know they're working on biodiversity credits and all of these stewardship credits. And there's, there's new mechanisms that play. And those are the ones that I have my heart set on because of course, it's not going to happen fast enough for us because we need resources now. But, but I do believe that this work is honestly the most important work in service to the, in service to creating resilient climate, which we desperately need to support. And, and I think that your whole book, Charles, that you wrote on climate really affirms that, you know, if we're just taking care of the water, for instance, let's just take care of the water. Yeah, I said if we're going to focus on one substance as a measure of Earth's health, it should be water. Exactly. And not carbon. Not carbon is not important, but water is life, as they say. Water is life indeed. And another thing that I think I wrote about in that book is the idea that the deep Amazon, it's like, if you can preserve the deep Amazon in health, then there will always be like a reservoir of health, like a, an example of health, like, like a place where Earth remembers what it is like to be healthy. And if you can preserve that, there will always be hope because it can radiate its health back out to the rest of the planet. But if you destroy that, the heart of the planet, then where on Earth does Earth remember what it is like to be healthy? Exactly. Yeah. And you're working right in that, that deepest, deepest heart. Yes. Of the planet. Yes. Exactly. Exactly. And like just circling back to what I started with a hundred million year old forest, right, because life's, you know, Mother Earth's natural functioning is over a very long cycle of time.  And yet, if we can stop causing harm, just stop causing harm. She'll rebound. She's incredible. Just stop causing harm. And so that's what this work is doing is just, it's, it's halting human impact. And again, very, it's very natural for communities to want to spread up and down rivers with development. That's very natural. It's like, we would want to spread up and down a road here. Like the rivers are their roads. But so for the communities themselves to say, we will constrain ourselves to this area and not do it as easy and convenient by developing and moving our expanding along the rivers. Like that is what is going to maintain the resilience of the forest. That's so inspiring. Like these, these are people who, you know, own very little and face a lot of hardship. And for them to say, nonetheless, we will restrain our development. It kind of puts the question to us, you know, like, what kind of restraint are we willing to exercise here? If they're going to do it, you know, it kind of, it's like, well, maybe we could consider doing that as well. Yeah, exactly. You know, and as I've said, there's a waiting list. We have a waiting list of communities that want to join. And we have a waiting, we have another Indigenous nation that wants to join. And, you know, right now we have to say no. And it's just because of financial resources.  Or is it more like you're, like, how do, if, yeah, like who are we speaking to now, if we're talking about funding? Yeah, so we're, you know, all, every, every size of offering is so welcome.  And so I want to say that, you know, every dollar that someone feels to divert from some other, you know, avenue into this is so, so, so welcome. And, you know, our very stripped down, like super lean, don't expand, just maintain right now budget is about $75,000 a month. And that it takes a lot of $10,000 grants, which is what I'm writing right now. Right. We get to that. It's kind of, it's kind of ridiculous. So every amount is welcome. And what we really need are to find the people for whom resources, large scale resources are nothing, you know, like, okay, we, yeah, maybe a hundred thousand. That's, that's like breakfast money for me, you know, because we know that those people, we know that the way the resources are getting concentrated in the hands of the few, that those few that, that have the concentrated resources and are really hearing the call, hearing the prayer, hearing the song of this new paradigm of conservation of this. Okay. It just strikes me though, the people who will actually do that are not the people who will see it as, oh, this is breakfast money for me. There are people who are holding their money so sacred that they want to use it in the most beautiful way that they can. I love that. And so it's not like, oh, this is kind of throw away money. I might as well give it to the AC. It's people who are holding their money in sacred trust, you know, and maybe they've inherited it from their, their families, you know, their ancestors, maybe they've inherited it from an earlier time of their life when they were doing something with their, their gifts that brought a lot of money. And, and, you know, either way, they have it now and they recognize that, that through fortune, through the gifts that they have been given, through, through, you know, whatever has brought them this, that, that, like, wow, you know, what do I do with this to, to that, that, that matches my sense that this is sacred, you know, like, and that's why I wrote the book sacred economics. I was like, like, why is money less sacred than everything else? Right. You know, like, why have we divided the world into the profane and the sacred? And, and how can we reclaim the profane for the sacred? And so one of the ways to do that is actually to hold money as sacred. Because what it is actually, it is the means by which you can coordinate human activity and direct collective resources. It's like a powerful magical implement. It is indeed. And so the, there are people who recognize that and who will, who will, yeah, who will recognize the resonance between what you're doing and their own feeling that their money is actually sacred, you know, too sacred to buy, to spend on a yacht. You know what I mean? Yeah. Yeah. It's not that, that there, it's not even necessarily restraint, you know, it's more of a recognition of what this is for. Yeah.  Right. But people who, because there are many, like, I think it's, it's also a sacred use of money to provide for your family. Of course. But there are people who have, have, have more than is necessary to provide for their families. And then like, that's the real question. What do you do with it then? You know, like, and, and it's tough, like, you know, I know philanthropists who are, who recognize the limitations of philanthropy and how, how, and the whole culture of philanthropy and the tax laws and all of these different forces that kind of channel it into things that are still kind of part of the old story, you know. And, and so I think that those who are feeling the limitations of that and, you know, and really ready for a different, excuse me, a different paradigm will feel a natural resonance to the AC. And that's, I guess, those are the ones that I really would like to connect with, connect with your work. Thank you, Charles. And you know, it really brings back to mind our very first, our fund, our founding funder, who made a lot of money in Bitcoin and said, well, what is this for? This isn't for me, clearly. And he was deeply involved in medicine communities, people working with medicine plants. And when he connected to the spirit of the medicine plant, she said, this is, this is where this needs to go. This goes to the Amazon. This is where I was born, and this is where I need to be protected and saved. And, and, and so that was how this all really got rolling was one funder really hearing the call. And that's, that's been true with, with another funder that we have that has really heard the call.   And she said, this is the first time that I feel like after all of those years of all of those actions, this is the first time I feel like my resources are going towards something that's going to actually, that actually can do something that can actually work. And so yeah, it's really like, again, do you feel the call? Do you hear the song? Do you feel it in your heart when you hear these stories? And if so, I'm here and so excited to have, I'm happy to do presentations for anyone that would like to hear the whole story.  And you can make a donation there. And on that donation page, it has a link to my email. So if you want to reach out to me directly, you've got a larger contribution to make and you want to have a conversation and reach out to me directly there. Yeah, yeah, like, like Becca has actually a very professional set of materials and everything. Yeah, kind of not my style to like go through with, you know, that slideshow. But, but yeah, you're, it's really impressive actually what you guys have, have created, you know, from so little. Yeah.   You're like, oh, this is different. This is different. How can I help? And at that time, we were operating in what we call stealth mode, which was, we were just trying to be so quiet about what we were doing because we, you know, we knew that it was really, really effective and we didn't want to agitate any of the systems to come in and create a response to us. And, you know, my prayer over the last couple of years is let us sink our roots as deeply as possible, so that when the winds blow, we are rooted in solid and we can handle the blowing winds. And it is only recently that, and this has really been guided again by our Indigenous team of 25, it's been 100% led by them. And they have recently, you know, expanded on what they're willing and allowing me to share. And so now our website for so long really didn't show much of anything because I couldn't show anything because it just feel safe to people. And now they've given their permission. So now there's pictures of our team and they made a beautiful video and they're just, they're, they're really excited now to share with the world what we're doing.  And again, it's beautiful. It's really beautiful, which doesn't mean it's easy. Okay. It's also really, really hard, but that's okay. All, all good things are a good challenge. Yeah. Yeah. Yeah, great. Well, yeah, thank you. Thank you for sharing, sharing about it, you know, and I hope that good things come from our conversation. And yeah, and I really, I guess one of those good things might be, and some other people falling in love with what you're doing. Yeah. You know, and, and new relationships being formed. Yes. Yeah, grows and expands this beautiful web of connection of all of these people across the planet that are really in service to that new story and, and wanna, wanna birth it in all of the places. And this is our, our small contribution to that new story. Yeah. Thank you so much, Charles brother. I'm just so grateful to you for your support these years and for your willingness to share. Yeah, I really care about it.  All right. Thanks Becca. Thank you so much, Charles. All right.


Live from Las Vegas, it's theCUBE. Covering NetApp Insight 2018. Brought to you by NetApp. Welcome back to theCUBE, continuing coverage of the third annual NetApp Insight with customers, partners, about 5,000 plus people here. Lisa Martin with Stu Miniman, and very excited to welcome to theCUBE for the first time, George Curie, and the CEO of NetApp. George, thanks so much for stopping by. Of course, thank you for having me. Really enjoyed your keynote this morning. First of all, it was standing room only. There was about 5,000 plus people here. Gene English, your CMO, mentioned to us a few hours ago that this is the biggest collaboration of your partners and customers under one roof. The momentum is palpable, the messages are palpable, and I really enjoyed some of the messages that you delivered in your keynote. One, I'd love to get your perspective on the data authority and how NetApp itself has transformed in recent years to become that data authority. What does that mean from your C-level perspective? You know, we've always been in the business of helping our customers help make their businesses better with data. We used to do it strictly in the form of storage systems, but over the last few years, we have built a much more robust portfolio of capabilities, both technological as well as partnerships to enable customers to use our technology wherever their data sets, whether it's in the edge of the enterprise or in the heart of the biggest cloud providers in the world. And we believe that the world will be a hybrid, multi-cloud world because of the need for speed and efficiency in how IT delivers support to digital businesses. And our idea is to help our customers by using our tools to integrate all of their data for business advantage. So we see ourselves as someone who is really knowledgeable about being managing customers' data in a hybrid cloud world. That's what we call data authority for the hybrid cloud. And you talked about this morning too, kind of early in your keynote, it sounds like you were addressing, NetApp has a massive install base, helping those customers understand those that weren't born in the digital age. They have to be there now to be relevant, to compete, to identify new service models. So I thought that was a very poignant message. But something that Stu and I were talking about is the four pillars of digital transformation. Walk us through, for those that didn't have a chance to see your keynote, walk us through those four pillars, how NetApp is enabling customers to utilize them. Absolutely, we talk to our customers about if you're not a born digital business, you need to transform yourself, especially using your data to compete with these born digital companies. And there are four ideas that we shared with customers that are the cornerstones of such a transformation. The first is that digital transformation requires IT transformation, business as usual in IT wouldn't cut it for the digital era. The second is an idea that was created by the Boston Consulting Group, which is that speed is the new scale. It's the hallmark of competitive differentiation and advantage in the digital world. I was talking about the fact that Fortnite, a game that was created just a year ago, has now got 125 million customers or players. That wouldn't happen in the physical world. And the third is that because of the need for speed, you need to be able to take advantage of innovation sources anywhere, which creates the necessity to operate in a hybrid, multi-cloud world, where IT is enabling the business to access innovation everywhere. And finally, that while you're doing it, you need to think about your data, the critical asset that you have that the born digital companies don't, and how to use that, and you need to build a data strategy, which requires you to move from thinking about data centers to data fabrics. And so those were four key principles that we are sharing with our customers. George, I think that's a great way to measure what's happening with digital transformation. I wonder if you can help us take a lens at NetApp itself. So when you talk about speed, NetApp has 26 years of experience. You've got over 10,000 employees. A company of this size and this heritage, you have some girl's strengths, but you're competing against some of those cloud native players. Cloud is the bar which we are all measured, as someone said on the keynote this morning. I believe it was you. Can you speak especially to the speed aspect, how you look internally, what has to change culturally? I know Gene talked to us this morning. Operationally, there were changes made that's your background. Absolutely. I think that we are an example of a company that is using data to accelerate our business in multiple ways. The first was in product development, we have used a lot of information about how customers use our systems, how the support organization reacts to customer situations, and have accelerated cycle times for software development. It was 20 months when I joined, it's now six months on our hardware platforms, and on the cloud we are releasing new capabilities every two weeks. So we've really become a cloud native development organization, and it required a lot of changes. I would just tell you that getting the engineers through to the other side of it has been extraordinary. They love the new world. They would never want to go back to the old world. Another place is around our customer interface where we've invested a lot more in digital marketing capabilities. Our CMO Gene English is an expert in that world, and so we have had new discussions with cloud-only customers entirely electronically. And on the back end, in terms of support, we have amassed a lot of information about our customer systems, and now we're using artificial intelligence through a capability called ActiveIQ to tell them proactively what they can do to benchmark themselves against the best. So we say, listen Stu, we think your system, which is operating an exactly similar environment to Lisa's system, is not working as well because you've done these five things. And so there's a lot of ways where we are trying to progress our own transformation. I would tell you that the secret, there are two important lessons learned. One was we started with business-led initiatives rather than an end-to-end transformation of the business. And the second is we structured a transformation program led by the Chief Transformation Officer so that it would become the day-to-day reality of our business, not the afterthought of the normal course of business. And so those are two key practical tips that we would share with our customers about transformation. George, NetApp has a strong history with partnerships. When I think about channel-led, NetApp has always been there. From a technology standpoint, NetApp has negotiated some challenging waters. I think specifically VMware was a big wave, of course, acquired by EMC, but NetApp did better in VMware environments than it did in the market as a whole. Today VMware is still a very important piece of the marketplace, but Amazon's another one that is a challenging company to partner with. Everybody's always worried, okay, how long do you partner with them before they take over? How do you look at that? What are the most important partnerships from a NetApp standpoint and how do you face those today? We've always kept the customer at the center of a partnership. I think that the secret to our success has always been that we keep the customer interest paramount, and it allows us to partner with companies who may be part of some of our competitors. I think today if I look at it, clearly in terms of the customer lens, we have a lot of work going on with the big cloud providers, both in North America as well as overseas, to help customers architect a truly hybrid multi-cloud. We showed some really exciting work that we've done over the last year to make that a lot more tangible and real, and it's the result of deep engineer-to-engineer collaboration with them. I think the second area that we're making investments in are really to build the foundation for using data alongside artificial intelligence and machine learning, specifically with training and inference models, and there we've been fortunate to be able to collaborate with the leader, NVIDIA, in that market, and it's about focusing on what we bring and keeping the customer at the center of the conversation. In terms of the go-to-market side of things, we've also done work, for example, with Lenovo, where we are bringing complementary skill sets into the market. They're bringing computing skills, we're bringing storage and data management skills. They have strength in certain geographies, and so we feel like it's a really complementary relationship, and we respect there, all of our partners, what they bring to the market, and we're excited and honored to work with them, to be honest. So one of the things that I've read recently, and it was apparent in a lot of the messaging today, is the evolution of the data fabric. It's moved, it's transformed from a vision to a legitimate architecture. Talk to us about some of the evolution in the last 12 months and how your customers have helped be able to really make that real. We've learned a lot about real use cases of the data fabric. Today we have hundreds of customers deployed and in production with it, and we've been fortunate to be able to iterate at cloud speed on the new capabilities. It is real today. We allow you to have data management services integrated across all of your environments in your data center with the world's best flash. We've connected and we're very excited to connect our enterprise-grade HCI solution to it, and of course a catalog of consistent data services that cross enterprise cloud with our HCI and the biggest public clouds. We have taken advantage of new container technology and capabilities that Kubernetes and Istio bring to the market to build a really good control plane for all of this. We've innovated around data insights using foundational technology from on-command insight that gives you now visibility into where all of your data sits. And you'll see us continue to bring out really exciting innovations in the data fabric. The reason that the data fabric is resonating with customers is because it helps you build a consistent set of data services in a hybrid multi-cloud world and use your data for business advantage. That's why it's resonating. George, NetApp has gone through some ups and downs over the 26 years. In many ways, it's been closer. People have said it's been on the brink of being gone and it's remade itself. How has NetApp continued to do this? And why should people believe that NetApp is in the position to execute best for the future? I think we've always been resilient at looking at things that could have been threats and making them opportunities. Throughout the generations, there was the transition from the internet computing, the dot-com bus that affected everybody. Virtualization was supposed to kill storage. The cloud was supposed to kill storage. And through every one of those transitions, we have looked carefully at how could we take what could be a threat and make it an opportunity. And make it an opportunity by serving our customers best through those technology moves. And I think that's the core to our success. I would say that what we have done over the last few years is massively up the game on execution. We laid out the data fabric strategy four years ago as a vision and four years later, we've got customers, we've got the biggest cloud providers, we've integrated it with the world's best Flash and the world's best HCI. And we are delivering roadmaps. So I think that's really the promise of the new NetApp. We are really, really focused on execution. Another thing, sorry, Sue, that we've heard along those lines in terms of NetApp's evolution and staying continuing to stay relevant is that the NetApp on NetApp story is one that NetAppians are proud of and should be. But it's also seeming like, is that a differentiator? When you're talking with customers who have so much choice, that NetApp on NetApp story, that authentic, this is how we pivoted over the last 26 years to stay relevant, to compete. Tell us a little bit about how you're, as the CEO when you're meeting with customers, how does that story resonate with them? Our transformation story is a topic of conversation with all C-level executives. Everything we talked about with our customers today, we are an example of. So for example, we did not take on an end-to-end IT re-architecture. We prioritized the digital business initiatives in the company and said, what are the barriers in our own IT that preclude that? And so we prioritized IT initiatives to support the digital business transformation of the company. We have created two data hubs in the company as we have progressed those initiatives. One, a product data hub through our auto support mechanism which is now integrated into every technology that we sell to customers, both in the data centers of our customers and on the cloud. And on the customer-facing side, we've evolved to a customer hub. So I think that there are examples that we share both in terms of leadership, people change management, transformation of IT that are extraordinarily relevant. And I think that one of the things that we are open about sharing is the mistakes we've made. I think that brings an honesty and a transparency to our relationships with our customers and they trust us because of that. All right, George, it's been really interesting.  If you look at all of the big waves right now, data's at the center of all of it. What I want you to help us understand is connect the dots for us because NetApp, most of the customers I talk to here, the first thing they'll think about is, well, NetApp's my storage company. Storage versus the data and how I get value out of that. Help us connect the dots as to how I go from being a storage supplier to helping customers become data visionaries, as you say. I think one of the really important discussions we have with customers is data is the foundation of a digital business. It's sort of the oil of the digital business and software is the engine, right? It operates on the data to make the business go better. The challenge that most business leaders have as they think about digitizing their businesses is that they have fragmented their data across systems and silos that were the prevailing norm in IT. Not only did it fragment the data, but it made operating IT much more complicated. And so two long held paradigms that we have shared are finally coming to reality, right? NetApp has always been a simplify your data center unlike our competitors. And that's coming through for the needs of simplification. And the second is while you're doing it, build a platform that can integrate all of your data so that you can accelerate your transformation. And I think we're well positioned for that. I think there are customers here who have never met us in the storage systems world that have joined us on the cloud like Booksy Nexcode, the genomics company that never buys a piece of equipment from NetApp. So we're really excited about an enormous number of those new faces that we're seeing. And then there are customers that started with us as a storage system supplier that we are bringing to the cloud. And so we're going to keep pushing forward. Yeah, just quick follow up on that. It was really opened my eyes.  You'll think of us just as a software company. What's that up at the future? We will offer our intellectual property in a broad range of ways, right? I think we'll still be offering systems, but I think the brains of those systems will really be super smart software, software that's digitally enhanced and software that's enhanced with machine learning capabilities. I think we'll offer them also as cloud services. And we're really going to be focused on helping our customers with their data problems. We think that's an extraordinarily rich landscape. And we think that it has the opportunity to propel our business to achieve everything we've wanted to achieve. So we're excited about the momentum. We are, you know, honored to have so many customers, partners, and technologists here. And I think this is the best insight in the three years that I've been CEO and I'm looking forward to having an even better one next year. Excellent, keep moving that bar, George. Thanks so much for stopping by theCUBE. You're now an alumnus. I'm going to give you a sticker so you brand yourself. Stu and I really appreciate you sharing your insights and your time with us. Thank you so much. It's been an honor to be here. We want to thank you for watching theCUBE. We are live from NetApp Insight 2018 in Las Vegas. I'm Lisa Martin for Stu Miniman. Stick around. We'll be back with our next guest shortly.