Hi, I'm Lior and I will talk about the Decisional Algebraic Group Model or Algebraic Distinguishers from discrete logarithms to Decisional Uber Assumptions. This is joint work with Gil Segev. The starting point for this talk is the Generic Group Model. This is a very useful idealized model aimed for capturing computations in cyclic groups. Roughly speaking, the Generic Group Model captures algorithms which do not exploit a representation of group elements in any way. This is typically captured by withholding the elements representation from algorithms and somehow restricting their access to the group to performing the abstract group operation and to checking equalities between pairs of group elements. For example, in Schup's Model, this is achieved by replacing the representation of group elements with random encodings and outsourcing the group operation to a dedicated oracle. Over the years, the Generic Group Model has proven to be a very useful one with several important benefits. It captures a natural and wide class of algorithms, and indeed many known algorithms fit within this model. Concretely, the best known algorithms for solving discrete logarithm-like problems in elite to curve groups are generic. More generally speaking, the Generic Group Model enables one to derive very neat information theoretic lower bounds, and in some cases, this is also the only proof of security that we know of. On the other hand, the Generic Group Model is not without its limitations. First, it does not naturally establish any sort of hierarchy of hardness assumptions, since any assumption in this model either holds information theoretically or is false. Secondly, we do know of very important algorithms which are non-generic for very basic and fundamental tasks. And more generally, it seems that withholding the representation of group elements from the adversary is a somewhat unrealistic scenario. With these limitations of the Generic Group Model in mind, Fuchs-Bauer-Kilten-Loss put forth the Algebraic Group Model, or the AGM for short. This model lies between the Standard Model and the Generic Group Model. That is, it is more restrictive from the Standard Model, but it assumes far less than the Generic Group Model. The main idea behind the AGM is to distill one key feature of generic algorithms, which already allows for meaningful reductions between computational problems, while at the same time significantly weakening the other restrictions of the Generic Group Model. Concretely, unlike in the Generic Group Model, algebraic algorithms do receive the representation of group elements and may use it as they wish. The restriction is that whenever an algebraic algorithm outputs a group element, it must produce alongside it an algebraic explanation, so to speak, explaining how this group element was computed. In more detail, let G be a group of prime-order P, and consider an algebraic algorithm A. A receives L group elements, X1 through XL as input, and then it outputs a group element Y. Alongside its output, A also outputs a vector W of L integers in Zp. This vector W serves as an algebraic explanation for how A came up with the element Y. Concretely, W is the representation of Y in the basis of X1 through XL. That is, Y is equal to the product of each Xi raised to the power of WY, where WY is the ith entry of W. It should be mentioned that the model of Fuchsbauer et al is inspired by previous works which considered different variants of algebraic reductions, rather than algebraic adversaries. Ok, so let's see an example of how the AGM might be used. Consider the computational Diffie-Hellman problem, or CDH for short, in which the adversary is given a generator G for the group, along with two group elements, G to DX and G to the Y, for randomly chosen integers X and Y in Zp, and the adversary needs to compute G to DXY. Fuchsbauer Kielsen-Loss showed that breaking CDH algebraically is equivalent to breaking the discrete logarithm assumption in the group. It is straightforward that breaking discrete log enables one to algebraically break CDH. As for the other direction, assume an algebraic adversary A, which receives G, G to DX, denoted by capital X, and G to the Y denoted by capital Y. The adversary A outputs a group element Z, along with an explanation vector W. By the definition of the AGM, W must satisfy that Z is equal to G raised to the power of W1, times X raised to the power of W2, times Y raised to the power of W3. The idea is then to have the reduction, which is trying to break discrete log, plant the secret exponent of the discrete log instance instead of either of the exponents X and Y. I will not get into further details at this point, but we will see an extension of this idea later in this talk. Now let's see what happens if we try to apply the AGM in order to deduce something about the hardness of the decision if you have a problem. In this problem, the adversary receives as input a generator G, two group elements G to DX and G to the Y as before, and an additional group element Z. The adversary has to distinguish between the case in which Z is G to DXY, and the case in which Z is a randomly chosen group element. The output of the adversary is a bit B, indicating its decision regarding the distribution from which the input was drawn. Observe that in this problem, the distinguisher A outputs only a single bit and no group elements. Hence, in this case, the algebraic group model of Fuchsbauer et al coincides with the standard model. Namely, if we want to reduce the hardness of the DGH problem to the hardness of a different problem in the group, then the model of Fuchsbauer et al does not provide any additional power for doing so beyond that of the standard model. It is not hard to see that this is true for any problem in which the adversary does not output group elements, which includes in particular all non-interactive decision problems. That is, all problems in which the adversary has to distinguish between two a priori fixed distributions. Fuchsbauer et al mentioned this limitation of their model in their paper and explicitly leave it as an important open question to generalize the algebraic group model to enable reasoning about decisional problems as well. With this in mind, we present the decisional algebraic group model or the DAGM for short. This model is a generalization of DAGM and it allows to reason about algebraic distinguishes, which output only a decision bit and no group elements. Though our model generalizes DAGM, I would still argue that this is a reasonable strengthening of the model. The DAGM still lies between the generic group model and the standard model. That is, it assumes considerably less than the generic group model. In particular, it still allows the adversaries to use the representation of group elements in any way they see fit. In the paper, we also consider extensions of the DAGM to groups equipped with a multilinear map, but I will not have the time to cover these extensions in this talk and you can see the paper for details. We then turn to show that our model is indeed useful for reasoning about decisional problems. Within our model, we prove the equivalence of strong decisional problems and the discrete logarithm problem are a simple variant thereof. Concretely, we show that the decisional Diffie-Hummond problem for algebraic distinguishes is equivalent to the discrete logarithm problem. We then generalize this result to show that in fact, the decisional K-linear problem introduced by Schacham is equivalent within our model to the discrete logarithm problem even in groups with a K-linear map. Finally, we show that the decisional Uber problem in bilinear groups presented by Bonnet, Boyen and Go is equivalent in our model to the QD log problem which is a parameterized higher-order version of the discrete logarithm problem. Due to time restrictions, I will not be able to talk about these last two results in this talk, but I encourage you to see the paper for details. Before presenting our model, I want to quickly talk about some related work. Fuchsbauer-Kilten-Loss do consider in their work some kind of an algebraic distinguisher. Concretely, they show that the CCA1 security of Al-Gamal encryption is algebraically equivalent within their model to a parameterized variant of DDH. However, their reduction crucially relies on the fact that the Al-Gamal adversary issues queries which are composed of group elements, and hence their model can be used in order to extract some form of algebraic knowledge from these queries. They do not extract any sort of algebraic knowledge directly from the advantage of the adversary in the CCA1 security game, and hence the reduction is to another decisional problem. As we will see, our model does enable to extract algebraic knowledge from the distinguishing advantage of algebraic distinguishers, and to relate the hardness of decisional problems, such as DDH, to the hardness of computational problems, such as discrete log. Bauer-Fuchsbauer-Loss also recently reduced the uber problem of Bonnet-Boyen and Go in bilinear groups to the QD log problem. Our result differs in that it considers the decisional variant of the uber problem, whereas their work considers the computational variant. However, the techniques used in both works, though similar in spirit, are not identical, and the reduction of Bauer et al is tighter. Finally, Boulans and we presented the knowledge of orthogonality assumption. You can see the paper for a detailed comparison of our model and their assumption, but I will say that our model is somehow similar in spirit to their assumption, but our model is much more general and is aimed to capture arbitrary assumptions, whereas their assumption is more specifically tailored for their needs. Okay, so the rest of this talk is organized as follows. We will start by presenting the decisional algebraic group model, or the DAGM. Then we will see an informal explanation as to why generic distinguishers are also algebraic, meaning that the DAGM is indeed less restrictive than the generic group model. We will continue to show a reduction from algebraically breaking the DH to breaking the discrete log, as an example of how the DAGM might be used. Finally, we would conclude with some closing remarks. So let's start with presenting our model, but before that, let's see together what it is that we want the model to satisfy. On the one hand, in order to keep with the spirit of the algebraic group model, we would like our model to be a weakening of the generic group model, and concretely to allow adversaries to receive the explicit representation of group elements. On the other hand, of course, we would like the model to be stronger than the standard model. That is, we would like it to enable meaningful reductions beyond those known in the standard model. The way in which Fuchsbauer et al. achieved these goals in their algebraic group model is by requiring that the adversary provides an algebraic explanation for how it computes its output. As we've seen, in the case of the DAGM, this explanation is a vector, describing how the output group elements are computed from previously received group elements. An important property of this algebraic explanation is that it is indeed extractable from generic algorithms, and hence the model induced by requiring this explanation is less restrictive than the generic group model. With this in mind, our goal is to extend this rationale to distinguishers whose outputs are decision bits and are not comprised of group elements. As a first attempt to define the decisional algebraic group model, consider the following requirement. Whenever an algebraic distinguisher accepts by outputting the bit 1, it must also output, as its algebraic explanation, a zero test which is passed by the provided input. So if the input to an algebraic distinguisher a is x1 through xl, and a outputs 1 as its decision bit, it must also output a vector w of integers in zp. This vector w induces a linear zero test in the exponent and this zero test should be satisfied by the input elements x1 through xl. That is, the product of the xi's raised to the corresponding entries of w, wy, should be equal to the identity element of the group. On the face of it, this definition already captures the fact that the only information available to a generic algorithm about the input group elements is the equality pattern among them and among the elements which it computes via the group operation. Any such equality naturally corresponds to a linear zero test in the exponent and we will get back to this point in more detail in a few slides. The first problem that comes to mind when seeing this definition is that it is too weak. The adversary can always output a vector w which is the all zeros vector. Such a vector will severely satisfy the condition required by the definition that we just saw, but obviously does not reflect any sort of algebraic knowledge learned by the adversary regarding the input. A naive fix for this issue is to simply require that whenever the adversary accepts the explanation vector w must also be non-trivial. That is, it must contain at least one non-zero entry. However, this requirement is now too strong as it is not descriptive of generic group algorithms. A generic algorithm can always accept without so to speak, having knowledge of a non-trivial vector w such that the product of X1 to W1 through XL to WL is the identity element. Consider now a more subtle definition which requires that if an algebraic algorithm A distinguishes between two distributions D0 and D1 with advantage epsilon then there exists some bit B such that when A is executed on an input drawn from Db it outputs a non-trivial vector w satisfying the multiplicative condition from before with probability at least epsilon. This definition already suffices for some applications and as we will see later this definition is indeed the weakening of the generic group model. However, note that even if W is non-trivial it can still be a bad explanation for the decision of an algebraic distinguisher. Consider for example the DDH problem in which the adversary has to distinguish between D0 and D1 for uniformly random X, Y and Z and consider a vector w which is not the all-zero vector but has a zero entry in one of its last three entries. In this case, when we project D0 onto the support of W meaning we ignore the group elements which correspond to zero entries of W we get exactly the same distribution that we would get if we project D1 onto the support of W. Intuitively, this means that the zero test associated with the vector w cannot be used to distinguish between the two distributions. This situation also makes the definition inapplicable for some of our applications. This leads us to our full-fledged definition of algebraic distinguishers. To this end, we first present the notion of good vectors. Consider an algorithm A which receives as input L group elements and outputs a decision bit along with a vector w of integers in Zp. For a distribution D over L tuples of group elements we denote by D sub sub w the distribution obtained from D by restricting it to the support of W meaning the process of sampling from this distribution is defined by first sampling from D and replacing all group elements whose corresponding entry of W is zero with some unique erasure symbol. We say that a vector w is good for a pair D0, D1 of distributions over L tuples of group elements if the distribution D0 restricted to the support of W is distinct from the distribution D1 restricted to the support of W. Equipped with the definition of good vectors we can now define our notion of algebraic distinguishers. As before consider an algorithm A which receives as input L group elements and outputs a decision bit along with a vector w of integers in Zp. We say that A is algebraic if two requirements hold. First it should always be the case that the product of X1 raised to the power of W1 through XL raised to the power of WL is equal to the identity. Second for any two distributions D0 and D1 over L tuples of group elements if A distinguishes between them with advantage epsilon and in time at most T then there must be a bit B for which the following holds. When A is invoked on an input sampled according to dB the probability that it outputs a vector W which is good for the pair D0 and D1 is at least epsilon over T squared. In other words with probability at least epsilon over T squared the vector W is such that if we restrict D0 and D1 to the support of W we get two different distributions where the probability is over the sampling of the input from dB and the randomness of A. At the moment it might be unclear where the term T squared comes from but hopefully this will become clear in the coming slides. In the paper we consider extended versions of this definition. So first of all we define the DAGM for general interactive games in which adversaries can receive multiple messages from the challenger and moreover these messages may contain additional information other than just group elements. Secondly we also consider possible strengthening of the requirement that W is good with probability at least epsilon over T squared. These strengthening are justifiable in our view since they still significantly weaken the generic group model but we do not need them for the applications that we consider in this work. Let's now see why generic distinguishers are also algebraic according to our definition. So here's the claim for every generic algorithm A there is an algebraic algorithm B where algebraic is according to our definition from previous slides such that the advantage of B in distinguishing between any two distributions is the same as the advantage of A and B runs in essentially the same time as A. In high level this claim is based on two very well-established observations regarding the generic group model. First is the observation that if A which is a generic algorithm receives L group elements X1 through XL as input and computes a group element Y then anyone observing A's oracle queries can extract a vector W such that Y is equal to the product of the XIs whereas to the power of the corresponding entries of the vector W. This observation is the one underlying the original algebraic group model of Volkswagen Rital. The second observation is that the only information at the disposal of A regarding the input group elements comes from the equality pattern among these group elements and the group elements which A computes. Hence informally in order to distinguish between two distributions with advantage epsilon then with probability at least epsilon there has to be some equality that arises when the input is drawn from one distribution and this equality arises with different probabilities in both distributions. Using these two observations we can define the algebraic algorithm B guaranteed by the claim. B first simulates the generic group oracle to A and outputs the same output as A. This step depends on the exact generic group model used but is fairly standard and straightforward. B also keeps track of all the pairs of equal group elements that arise throughout the computation of A. In order to make sure that this list is non-empty we include in it all pairs which contain the same group elements in both coordinates. Note that if A runs in time t then there are at most t squared such pairs. Finally in order to compute the vector w B samples one pair yj yk of equal group elements uniformly from the list of all pairs of equal group elements. By the first observation from the previous slide B can compute vectors u and v such that yj is the product of xi raised to the power of ui for i running from 1 to L and yk is the product of xi to the vi. The vector w is then the difference between u and v. So this again is how B decides on w and since yj is equal to yk it indeed holds that the product of the xi's raised to the power of the corresponding w's is equal to the identity element. Now fix any two distributions d0 and d1 and let epsilon be the advantage of A in distinguishing between them. Very informally as we observed before with probability epsilon there has to be some equality that arises when the input is drawn from one distribution and this equality occurs with different probabilities in both distributions. Hence for at least one of the two distributions when the input is sampled from this distribution with probability at least epsilon there is a pair yj and yk such that the vector w which they induce is good for d0 and d1. Recall that this means that d0 and d1 remain distinct even when restricted to the support of w. Since there are at most t-squared pairs of equal group elements B chooses this particular pair with probability at least one over t-squared. Now let's see a simple example of how to use the DAGM. Consider the Decisional Diffie-Hammann Problem or DDH for short. We will show how to reduce the task of algebraically breaking the DDH problem within our model to the task of computing discrete logarithms in the group. Assume the existence of an algebraic distinguisher A which receives as input a DDH instance. A generator G, group elements capital X and capital Y which are G to the X and G to the Y for randomly chosen integers X and Y in Zp and the group element capital Z which is G to the XY plus BZ where little Z is a randomly chosen integer in Zp. That is, if B is 0 then Z is G to the XY and if B is 1 then Z is a random group element. A then outputs a bit B' trying to guess the bit B and since A is an algebraic algorithm then according to our definition it also outputs a vector W of 4 integers in Zp. This vector W has to satisfy the condition that the product G to the W1 times X to the W2 times Y to the W3 times Z to the W4 is equal to the identity element. Moreover, assume that A has advantage epsilon in guessing B correctly and that it runs in time t. Since A is algebraic this means that there exists a bit B such that when Z is sampled to be G raised to the power of XY plus BZ the probability that the vector W is good for the pair of DTH distributions is at least epsilon over t squared. Recall that according to our definition being good for the pair of DTH distributions means that when restricting both of them to the support of W we still have two distinct distributions. Our goal now is to use A in order to construct an algorithm B which successfully computes discrete logarithms in the group. The discrete log algorithm B guesses input degenerator G and the random group element capital S and its goal is to compute little s which is the discrete log of capital S with respect to degenerator G. As a first idea consider what happens if we plant little s instead of the exponent X in a random DTH instance and then invoke A on it. Concretely, B samples a bit better in order to decide which of the two DTH distributions to simulate to A. The reason for choosing beta uniformly at random will become apparent in the following slides. Then, B samples exponents Y and Z and invokes A on the input G S capital Y which is G to the little y and Z which is G raised to the power of Sy plus beta Z. Note that computing capital Z does not require knowledge of the secret exponent little s. As discussed when A outputs a bit B prime it also outputs a vector W satisfying this equation. But since G is a generator of the group this equation implies that W1 plus W2 times S plus W3 times Y plus W4 times Sy plus beta Z is equal to zero modulo P. It would seem that since B knows Y and Z it can solve this modular equation for S and output the solution. The problem is that this equation is useless for finding S whenever the coefficient of S which is W2 plus W4 times Y is zero modulo P. There are two cases to consider. In the first case W2 and W4 are both zero but since A is algebraic there exists a bit B such that when beta is equal to B then the probability that W is good for the pair of DDH distributions is at least epsilon over T squared. But in order for the two DDH distributions to remain distinct even when projected onto the support of W it must be the case that W2, W3 and W4 are all non-zero. The probability that beta is indeed equal to this good bit B is one half and hence the probability that W2 and W4 are both non-zero is at least epsilon over 2 T squared. So the second case to consider is the one in which W2 and W4 are both non-zero but still W2 plus W4 times Y is zero modulo P. Note that in this case B can plant S instead of Y and output minus W2 over W4 modulo P. Since we do not know beforehand if this event in which W2 plus W4 times Y is zero modulo P will occur the final reduction simply plants S instead of X with probability one half and instead of Y with probability one half. A simple argument yields that the overall success probability of B in computing little s is at least epsilon over 40 squared. So let's conclude. We presented the Decisional Algebraic Group Model or the DAGM for short. This is a generalization of the Algebraic Group Model that enables reasoning about Decisional Problems while still being a weakening of the generic group model and allowing adversaries to use the representation of group elements. Within this model we presented several equivalence results between strong Decisional Problems and variants of the discrete logarithm problem and we saw one of them in some more detail. To interpret our model and results note that on the one hand they can be seen as bolstering confidence that what we have in these strong Decisional Assumptions while on the other hand if one wishes to refute any of these assumptions then their efforts should either be directed towards extracting discrete logarithms or should deviate from all algebraic techniques that are captured within our framework. Okay, so with that I will conclude and thank you for listening.


Did the flowers survive? Did the flowers survive? It's fine out. They sure did. They look amazing. They look fine. They did good. The frost, so as you know, it snowed a couple days ago. We're good people. 2 O'Tools Garden Center. My favorite spot to buy plants in the greater Denver area. Researching trees. We're gonna plant two trees, most likely in the front yard. Because we have no trees in the front and we would like some basically some shade on the house and our patio. But trees is planting a tree is a huge commitment. I mean, we're talking that tree could outlive you depending on the tree and it could outlive the amount of time that you're in the house. So anyway, we've got to make the right decision. Doing a little research. Question of the day. Question of the day. Why not? Let's let's do it. If you could plant one tree at your house and you might live in an apartment so that might be a little tough. Hey, it could be a bonsai tree, but if you could plant one tree, what would it be? Comment below. Aspen, oak, maple, cherry. There's plenty of options. So one tree, what would you plant? I'm trying to figure that out. I'm trying to figure that out. You know what time it is. Mm-hmm. And I'm working on it. How about you? Out there? Internet?  I need to work on that. Okay, it was a hard day. Harder day. Hard to get going. I felt like I was sleeping kind of sleepwalking all day. But part of the strategy, which I talked about maybe two weeks ago on the blog to help basically motivate me to mow the yard, which I did. So part of the strategy was that I always tell myself mentally, and this is maybe, you know, a little tip of the day. You probably do this yourself already, is that if I got the yard mowed completely, you know, not cutting any corners. If I got it all done, I could watch a little bit of the NBA playoffs. All right. All right. And I saw I got it done.  Having it's been probably been like two or three months since we've had the TV out. So I'm gonna watch a little bit of the NBA playoffs. Hopefully the bunny ears don't work. A little bit of a moral dilemma here. Oh, it's hard. It's weird. Basically, I just opened up YouTube to reply to a lot of your comments on yesterday's vlog. Thank you for commenting. It was all about the new idea vlog where you guys are gonna hopefully send me some video clips of you guys seeking beauty, working hard and loving each other. Well, as you know, I've been working in the yard all day with the hope and motivation to watch a little bit of the NBA playoffs tonight. Spurs vs. Warriors. And basically, it's not on TV because we only have bunny ears and we don't get ESPN. But all right. So there's people live streaming the game through their YouTube channel. And it's delayed, but only by a couple minutes. And so I'm a little bit torn about whether it's morally right for me to watch this for free through somebody's YouTube channel. I don't know if that makes any sense. Maybe that should be the question of the day. Morally, should I watch sports, live sports, when ESPN is, you know, paying millions of dollars to do it through their TV channel. But at the same time, my gut is also telling me, guess what? This is the future. Like, you're not going to be able to control this, especially with Facebook Live now. It's like, absolutely insane. All right. I digress, but the game is on. I got to think about it for a second here. Maybe I'll just watch the first quarter.


Going on guys got Kyle and Sean here with late sports cars from one box for William s. It's gonna be a box of a stadium club Stadium club hobby Let's go Good luck William Again guys full for today. After this. I have tie you on post Sean Jeremy Lance Greg Peter Michael Chiakai and then Chai at the Y should close us out for today Good luck here William Stadium club first off. We have a trade Turner on the jumbo box toppers U.S. Of Trey Good luck William Joe Morgan There's a about a boralson rookie got mookie on the red foil Bobby quits JJ Bleday. Oh all pro right guard. That could be interesting Spencer Torkelson. There's a Corbyn Carroll rookie and Fantasy pros of a Tommy that game's coming up man. We're getting close Sam's sweating yet Sam's probably sweating Not sure but Say right for shame a clan of hand. He probably doesn't want to watch it at Volpe Austin Riley rooting for his team though To be alone They read for a rocker root Roanzee contours Hey, let's go Jaden Let's go They know everybody knows Jane There's a Bryce serang red foil and first auto is gonna be a rookie Michael Grove the Dodgers cool picture there On the rookie auto They know what's good JG Know you're coming for him He said he was he said a couple weeks ago. He's doing a tournament, but I think he says in Atlanta or something Oh, no, no, I see Vado He was saying he was doing a Atlanta tournament or something coming up local only Might get shot a South Florida for you, but there's a very Larkin on the red foil. I don't know about Atlanta Josh young rookie. Come on Jane. I know your voice You can't keep lying can't keep lying Tom Glavin got a Black foil of Ozzie Smith Ozzie Smith base We know we know Jaden been better boys say labor on the red foil and David Wright nice on there on the veteran auto for the Mets Captain hold up the apple David Wright Robinson Bogarts I'll agree with you though Jane because he was a gator. I'll be on I'll be team Jane There's a rookie Alvarez velocity all Sean's got to say today. That's what he's got to say about that There's a wow extra auto is gonna be Derek Jeter On the senior club chrome seven out of ten Boom, there we go. Will that'll work get an extra auto and it is a Derek Jeter Seven out of ten that'll work my man on the rainbow foil get that in a bag Talk about the captain got the Mets captain now. We got the Yankees captain There we go. Very nice one there. What a box got a rookie Blede on the negative very nice Let's go will really nice box here Say Josh young rookie chrome and Black foil of Pagaro. I was not having that box there Really nice box of stadium here. So young Shane Frank Thomas say triumbrates of want soda Tristan McKenzie and Will Smith like he had a Hulk Hogan stash That'd be kind of sick Is that my stash going on the Jeter? There's a Adley Rushman base. I Could see Jeter with the Hulk Hogan stash Chief fantasy prose Bobby and Derek Hall Jeter Yeah, maybe like like a little beard or something.   They got the Backround disappearing on that one Bo Jackson on the refractor chrome Red full Eckersley. That's probably the one of the better ones to get out of that set and Triumbrates is Peter Lonzo Peter Lonzo Can't go a day without saying miss Peters name. That is a fact All right. All right. There we go. Will really nice one there on the Jeter We'll get that right out to my man 7 out of 10 sick Jeter


Hello and welcome to another breakdown. Today we're breaking a film as opposed to a music video. Last episode we put out the request for people to submit their images for a chance to win a camera rent in the Lagos area but sadly we didn't get any from the Lagos area so we encourage you to participate in our challenges and be able to make good use of most of the good tips that we share in the videos. So for today we'll be breaking down a film called Shapa. It's on Apple TV, it's a crime drama thriller and without diving in too much we'll just start gradually and we'll break down certain scenes that are in the film and we can see what we can learn from it. So first of all Shapa was released on February 7th, it's an hour 56 minutes long by the director Benjamin Karen. I'm sure you must be familiar with his work because he's known for Andor, which is a TV series, also Sherlock Holmes that's the TV series and the Crown TV series so he works in television. Cinematographer's name is Charlotte Bruss and we know her work from I've seen Gal on the Train, I could remember that, the Gal on the Train, Fences and A Quiet Place. The film was shot on Panavision Panaflex light weight film cameras that are like super fast with Panavision C series and E series which are like lenses which they used on the film and also they also use the Panaflex Millennium XL2 and also using the same C series and E series and they predominantly shot on Kodak. So we'll just dive into some scenes if you have not watched it, there's a whole lot of spoilers that I'll be like dropping about the film so you better pause this video and go and watch it before I start spoiling the film for you. That being said all spoilers, disclaimers, now let's move into the film. So I'll play the opening scene from the movie this way the guy is like closing down the shop and the girl comes back because they had like an earlier exchange of she wanted to rent a library book and she didn't have cash and he gave her the book and now she came back with the cash to give him the book and he's like okay he's okay not now not today because he was hoping to score a date on the second entry but she gave him the cash nonetheless. So if you look at the BTS right you can see due to the nature it was shot on film right a lot of it was shot on the dolly you can see there using like a three feet offset I would I would try and show that in the frame you can there's like an offset there which the DP is holding to like give an extension away from the camera while the base is somewhere here where this guy is blocking and we have our boom guy and if we continue if you come if we continue throughout the frame you can see the time of day here it's more looking like a four o'clock 4 30 yet the sun has just gone behind the high rises on the street so you have like skylight which is makes a lot more soft and a lot more pleasing quality of light as opposed to and let's if we go back into the film like where the conversation exchange happens here so you can now see how the lack of light coming from the stall creates like negative feel right and we have all of the skylight that's coming in here and actually came from the face and if you look at the reverse this time I believe the sky has gone way down and the reason why I would say that because if you look at the background now you can see how that buildings a lot more darker although this could have been done in post you get all I could have been done in the grade but it feels like if you look at here the light that's coming in from say here it's looking more like a sauce like a unit that's set up on a big large bounce that's pushing through a diffusion or something to be able to open up this area and probably a skip bounce for this reverse as opposed to if we go back early in the frame and you look at let's see the ambience here also it's way different than when we get to um this part of the coverage yet so I guess by the time they say shouldn't this part of the coverage they've lost more light or or they closed down or the colorists decided to close down on the gaps if we turn on the first color to look at it you can see they literally went bold on the film allowing it to like drop into the shadows you can see the skin's belly on the exposed which is where black skin tones should exist though which is like half stop on the exposed from the from neutral gray you have the stars like a negative field and the skylight becomes like the ski and he's like on the exposed too so yet there's all of that that's going on for the entire film giving making fall into deep shadows just soft wrap from the sky we cut to the wide shot where we see them walk away um and they leave which is also you can find in the BTS when you get to see them walk away here um if you look at the entire kit that's like the film camera the panavision with the film magazine that's actually here um this looks like a small hd monitor and that's like a pterodact that's on set with a um cinetape mdr box I don't know which of them is this but I'm guessing it's I think in a nutshell I saw a clerish away the way using a range finder too that helps to focus pull that pull focus and if you look closely even at that they had max on the floor like they had max on the floor that guaranteed that they do not miss their focus and things were as they should be and nothing was left to chance here's a telltale sign that we know things are shot on film if you look at the um the shot here if I pause it here and we zoom in right you see these lines that you're seeing here um let me see if I can use ours to show you you see these lines that you can see here right all of them you see all these lines that are the edges of the actors yes those are what we'll call halation film gets like produced them based on um um how light goes into the emotion and scatters and reflects back and all that photochemical reaction that actually leads to all of this bleeding edge that happens that gives this red glow around the subject and if you turn on false color you see that's just literally soloid like it falls literally into the darkness so you can see between them there's about eight stops of exposure in this scene in the entire dynamic range of the scene like from the window to the darkest area which like the floor there's like eight stops of of um dynamic range data that that film can capture you can recover a lot from those highlights you you usually it's very difficult to clip on film because the highlights of when they clip they roll off beautifully here to balance out the window there's like a sauce coming in here that's actually raising the level of the face so they can because this is a real location there's some of the locations that felt like it was done in the studio but this is a real location so there's that that's the sauce and we get to see that in the BTS yeah so there's a bit here as we can see they're like on a dolly with a remote head that's actually holding so they're not using like tracks on this one in a way because it almost looks like it has like a z-axis because of this thing here almost looking like the DJI z-axis contraption but like a bigger version that holds a film camera and you have like your number three axis gimbal here that's actually working and that's like a dolly grip that controls it he has his own small monitor so that he could actually see the frame and when he walks on this on even floors the three-axis stabilization takes away all the unevenness that happens around the footage and he has the range find now still in your yeah that connects to the senior tape which was on the camera which I showed you on the on the other shot yeah it was here yes this is it the senior tape was here so this is the range find that what it does is reads the focus distance of what's in front of the camera allows the focus pullout to be able to get accurate distance measurement because it's film it's more critical because it's not like digital where you can go and check and see life feed you get so just like a video tap where they get out of the camera to be able to see an approximation of what's going on so it's really really critical for them to be able to nailing their their focus and they don't get to play like us where we do put our lens on the one five or or a one two or f1.2 and say okay allow auto focus take control of that because that shadow depth of field will be too shallow for film they usually make sure that it two eight or even a four depending on the scenario when you're looking this way now they're looking into the shadows that could be like a bounce light because it's not as intense as it was when you're looking out the window you guys because when you're looking at the windows it's very intense so that they can hold those sky highlights at the time of day that they were shooting because it's it's looking like that's like the direct sun you get you can see it on the floor and to compete with that they would need to be able to bring in some real serious firepower i'm not surprised even that's an m40 that they bring in to be able to hold against the window this is where they just came from a fundraiser and his head over heels for her and they go up to their mansion and why they go up to your mansion and he's walk into a con whereby this guy is not like a real cup he's not like a real cup and it's like the sun you're all faking like some drug abuse and stuff like that if you look at this frame something that's interesting if you check the first color levels same thing is still going on for the footage so if you check the first color on it you can see like the Caucasian skin tone is like one stop on the exposed and everything's just playing on that very undertone whereby it gets not too keen not too gritty it actually takes the professional to do that because you can see how they can like edge light them from their surroundings and you can just like some kind of rigged up light up there that's like actually creating this accent which i believe the structure here it's preventing it from hitting but it's another light source that's coming that's coming this way if you actually see like a tungsten source that's actually keying him and that's how it's presently is in the scene there's a different set of where we can see like now she has like a soft key here that's actually let me see if i can elaborate on that a bit so she has like a 5600 like some kind of daylight source coming in and there's also like some tungsten practical source that's probably backlighting her head for this scene though and it goes in and they have this conversation for a while she tells him she's disappointed and he's a fake car we shouldn't give him any money and this is what his son's his son does like he's a 419 sorry he's a scammer it's not such 499 durian thing it's not a global thing so he's a scammer okay so if we go to like the behind the scene we get to see properly now that's the sauce we're talking about that was like creating like the whole daylight pool in fact even two of them there's like one coming in that's hitting this guy there's this that's coming in that's actually hitting the guy we have our orange our tungsten sauce that's actually creating um the mixed color temperature whatever stock they're shooting they actually try to balance it out properly so that it actually gives this whole richness to the entire stock yes there's a lot of that and here's that same place again before they walked in now you can see this is the sauce for i believe is this sauce for yeah it actually looks like a sauce for that actually um bringing the whole tungsten light and remember that we had like daylight coming in from this other corner to why they were standing there and these are like they are max on the floor you get where and who goes what for the entire focus pulling and that's like a pool cat that is holding the sauce for which will become the latest backlight like we saw in the previous shot where she was backlit by by it this is it where she's backlit by it and that's where the light is that's doing that whole trick for her and yes we have like the sky panel which um i believe this goes in through some diffusion i'm not sure they left this on like this and you can see how bright the room is as opposed to how dark the film is like if you're supposed to compare just for fun sake and you turn on false color you get to see like they're like two stops overexposed and to show how um how film is quite a different beast than digital you get and you really really really have to pay attention and and respect the process because um some people are on the side of overshooting by exposing overexposing by two stops to be able to get a ticker negative and what that means is that you have to get more light into the shadow area so it's now it's less noisy and clean from the way it's it's been shot it's almost felt like they had a tick a thick negative and what they did was to not add the grain and the texture in post because given the levels that we're seeing from this behind the scenes it's really quite something you get yeah so now it comes back to what i was saying again like i'm not sure like they exposed overexposed that um they left that sky panel there you can see here they have like a net that's in red i think it costs down light by a stop and there's also like a diffusion behind it that's like a full blown 216 or a full grade diffusion that means it's almost like three stops of light gone just to be able to soften the direct source of the panel i remember like the sky panel itself it's something a hard source to begin with you get because it has like this diffusion surrounded so this is somewhere in the film where she's um rethinking actions for taking something key from him and seeing that they've taken his father's inherent sense and she reassembles the score to go steal back the money you get just quick shot so if we look at the behind the scene here we have we are back to like um i believe this like an cornerhead or something yeah and that's like the film camera and we can see this is the scintill tape and that's like the range finder that's like a small hd monitor the terror deck that's sending signal to the video village and they'll have like a bunch of receivers i believe the director was often using an ipad to be able to um watch was it and that's our dolly grip as we can see from here um the light seems to be coming from the side of the frame windy and this is the shot and you can see like that's like the light levels and i believe um yes all these are just like practicals within the set and they seem like they're skiing him it's what's spilling onto this chair it's probably a large sauce as we would get to see and in the reverse you can see yeah here we go again that's like the large sauce there with our cinematographer she's had a long day it's quite stressful and yeah now you shouldn't the reverse of the shot whereby they're seeing to the um seeing to the exterior and that's like um date and depending on the lens i believe that was like a close-up on the film i believe the angle didn't make it in because um from the bts that's supposed to be like we should be seeing the back of the room but we are not seeing the back of the room here we're just seeing it as like a light is coming from this side and it's actually creating this soft wrap that goes into the darkness i believe there should be some probably some bounce board that is actually complimenting to raise the shadows you get or else the shadows will just fall jet black into it if you check if you check for it yeah i believe there's there's something raising shadows up if not it should just fall into darkness or there's like a bounce up in the air that's actually making it that way now this thing is interesting because this thing was actually shot at a real location and the reason why i believe that is because um first of all what happens in saying he tries to get him into the office from doubt the same way he was walking on the hallway this time he says he's a nuisance to his mom how much will it take for him to be gone you get and if you just see differently you can see like they're able to hold the sky levels they're able to hold everything that's going on while so have like a decent key on him and you can see like and if you look at the direction of the light when you're looking at this side of the shot you get to see in the bts why it makes sense that i believe that's a real location that's like some serious fire part they shot into something and now diffuse you like a two one six here i guess like another diffusion here for him when you're doing the reverse this is the one that's actually going like key him and they have like negative here to be able to get like contrast on him so it doesn't like fly out over everywhere and he has like his own diffusion when they actually shouldn't do reverse action on him all the entire camera language emotion language of the film was shot on a dolly like it's it's either dolly or steady cam because it has a stability there has this pristiness that actually goes with it that you can almost tell how it was meticulously planned out it's not left to chance there's no handheld camera work there's no any of those razz energy that exists in the entire film everything is just meticulous and smooth and even you get that shows the character state of mind and kudos to the entire cinematography team and kudos to her for coming up with that brilliant camera language to be able to showcase the characters emotions you get that became the camera emotion for the film now this thing is interesting because this one i do not believe um it's a riser it feels more like a set and i would show you why in the future so they had like breakfast in the morning and she has like um talking about her son and and like prepping him and stuff and here you can see like this is set as sun rays here we can see light directions going this way but somehow there's another light coming in and kissing him you get if it was a real location i don't know how tall open the edges would be but i almost feel this may be really expensive to achieve this kind of shot we have like this edge in him and also having maintaining light continuity so yeah we'll continue he meets them in breakfast and she's like oh let's have dinner or something together and she's giving me hard time and stuff like that and she leaves both grown up men very soon and gets out of the house and he sits in and they both and he issues a soft threat to him like they should be friends and he's like oh okay but that didn't sound all friendly but it's interesting though because in this shot here um where she was i believe where she was here i believe the lighting was quite different based on how it ships um his eyes due to the camera if we'll go forward into the shot again and look at that same lighting you can see somewhat more wrapping and soft as opposed to um when we first see it here you get this is a different setup but for this setup we do have for this setup we do have the bts the behind the scene um if we look at it it's um a sandwich bounce i believe a it feels like a sky panel i can really see clearly but it soft starts as blood that's bouncing to like an ultra bounce and they have like this four by eight that they constructed with this frame to give this whole scenario here and that's what he sits into that lights him properly yes that's the director with his ipad here that's receiving the whole signal that's like our dolly grip um he comes in takes a drink sees his mom sees the party everybody's bougie now this is why i call this fake because that doesn't look like the sun and we continue for a bit he introduces them and you can see how low the levels are compared to what it really is on the day so yeah it's it's almost like they did overexposure to get like cleaned up and pushed it down during the grade because it's really really really still on that that one stop on the exposure one stop on the exposure two stop on the exposure one and a half stop to be fair from um the entire film if you look at the behind the scenes now you get to see what i mean like that's not a sun i guess i was painted out with vfx you can see the edge of the band of whatever that light is and that's what that is and if we continue um let's see yeah we get to see you get to see light now that same light here and up top here we have those soft boxes you can see them clearly in the mirror right they're like all there in the mirror and there's something that looks like a pole cat that's holding them there and um it continues in the room where we have like a far side key i'll have like negative to be able to do um to create contrast that happens to try the entire thing here you can clearly see what um we're talking about and it feels like on today's version of the set the director was like an extra like he acted as part of the guest and that would be cool though so that's like from the movie shop and i hope you found that useful as we broke down using real elements we could find from the behind the scenes to be able to explain some of the stuff of how they broke down the film and what they did with the film and um i hope this has been beneficial to you in some way and we'll try to break down more films and learn from them and actually take more things from them if you have any questions if you have any suggestions if this video has been useful to you please like subscribe and share if you want more videos like this you could hit the thumbs up and encourage and you can encourage us by um using any of those um stickers to be able to help us to make more dedicated time and create more quality content for you and um yeah we'll see you next time in next video where we'll break down more videos and see how they can be beneficial to you and i so until next time i see you improvise adapt and overcome