Thank you very much to the organizers. It's a great pleasure to speak here. It's my first appearance in the number theory web seminar. So I'm very happy to be doing this. So the title of my talk is about explicit class field theory and a connection with orthogonal groups. And most of what I'll be talking about today is joint work with Jan von Kahn. And since the format of the web seminar is a bit impersonal, we don't get to meet each other in person. So I wanted to at least put the picture of my collaborator here as my first slide. OK, so the idea is to try to generalize a very classical theory, the theory of complex multiplication, which concerns the values of modular functions at cm points to other settings, like the setting of real quadratic fields. And so a singular modulus is simply the value of a modular function, like the j function being the most classical and standard example, at a quadratic imaginary argument of the upper half plane. So something like a tau here of discriminant d, where d is a negative, say, fundamental discriminant. And the value of the j function at such a tau has all kinds of nice algebraic properties. It generates, it belongs to the Hilbert class field of the corresponding imaginary quadratic field. And it has an interesting highly structured factorization. So for example, the value of j at 1 plus root minus 23 over 2, an element of discriminant minus 23, satisfies this cubic polynomial with rather large integer coefficients. And likewise, for j of 1 plus root minus 31, we have this kind of value that satisfies. And these two polynomials are interesting. Their splitting fields are the Hilbert class fields of the corresponding quadratic imaginary fields. And while the coefficients seem to be very large, when you look at the constant terms of both of them, you see that they really factor into small primes, primes of small primes with large multiplicities. Now, the fact that j of tau belongs to the Hilbert class field implies, in particular, that its value at any tau corresponding to a quadratic imaginary for the class number 1 belongs, is an integer, is an actual integer. And you can see this, here's the value of j of tau and all the quadratic imaginary tau corresponding to class number 1 imaginary quadratic fields. And you see that their values are integers, which are highly factorizable. So although they're quite large, their largest prime factor is in fact quite small. In this case, the prime factor is strictly small. The largest prime factor is strictly smaller than the discriminant of the corresponding tau. And this kind of behavior persists also if you subtract from j of tau, the value of j at any other quadratic imaginary argument. So for example, here, if I translate j of tau by 1728, which is the value of the j function i, then I get the following table where, again, I see the same kind of phenomena. Here, the largest prime factor is never larger than the discriminant of the corresponding tau. So you have this. Now, that previous slide suggests that the natural quantity to study really is the difference of j values at two distinct quadratic imaginary arguments. So if we fix two such things, tau 1 and tau 2, you might want to assume for simplicity that the discriminants are relatively prime to each other. Then you might study this quantity j of tau 1 minus j of tau 2. And it was studied very classically. You'll see examples in the classical treatises of Klein and Fricka on modular functions where certain values are studied. And then, of course, this difference of singular module, I also plays a key role in a seminal paper of Gross and Zagier from the 1980s, which has sort of motivated a lot of what I'm going to talk about today. Now, the theorem of Gross-Zagier concerns the factorizations of these differences of singular module i. So if Hj is the Hilbert class field of the corresponding imaginary quadratic field, then the theorem asserts that if I take the difference, j of tau 1 minus j of tau 2, that belongs to the composite now of the two Hilbert class fields of q square root d1 and q square root d2. And if I take its norm down to q, I get an integer, and I take its absolute value, then I can write that integer, of course, as a product of primes with certain multiplicities. And the theorem says something about what that factorization looks like. Namely, it says that the primes that appear in this product always divide a positive integer of the form d1, d2 minus a square over 4. In particular, the largest prime factor is never larger than d1, d2 over 4. That's the first thing that you have. And moreover, these primes have certain constrained splitting behaviors in the two imaginary quadratic fields. They're either inert or ramified in each of q square root of d1 and q square root of d2. So these are patterns that you will see for all these factorizations. And the theorem of Gross-Zagier is more precise. It even gives a precise formula for the exponents, ML, that appear in this factorization. So it's a completely explicit recipe for the factorization. And I'll give you a little bit of a, since this is meant to be a kind of the general almost colloquium style, tough for a broad audience, I want to give you an idea of the geometric explanation underlying this phenomenon. So if we consider the difference j of tau 1 minus j of tau 2 and we consider primes that divide the norm of this difference, well, these j of tau 1 and j of tau 2 can be interpreted as a j in variance of elliptic curves with complex multiplication by these corresponding orders, corresponding maximum orders in the quadratic fields. And if l divides this norm, that means that these two elliptic curves have the same reduction, modulo l or rather modulo prime of the Hilbert class fields that lies above l. And so there's some elliptic curve over the algebraic closure of fl, which is the simultaneous reduction of these two elliptic curves. So that means in particular that if we look at the endomorphism rings of A1 and A2, those two endomorphisms inject into the endomorphism ring of the special fiber, which is therefore quite large since it contains two different quadratic imaginary orders of different discriminants. And the only way I can happen is if the endomorphism ring of this elliptic curve over fl bar is an order in a quadratic algebra of discriminant l. And so in an order that contains elements omega 1 and omega 2 having these discriminants d1 and d2. Now that, of course, places a large constraint on the kind of elliptic curve we can have. The curve has to have a super singular reduction at l. And if we now take these two elements omega 1 omega 2 and consider the pairing matrix associated to them, I mean this endomorphism ring is endowed with a natural quadratic form given by the trace form, then you can really discriminate. The determinant of that pairing matrix is d1 d2 minus t squared over 4. And because this is allowed us in a definite criterion algebra, that discriminant has to be positive. And it also has to be divisible by the prime l because essentially because the quaternion algebra is ramified at l. And that, of course, places a constraint on the prime l. Then it has to divide this expression, as was asserted in the theorem of growth since I gave it. OK. Now I want to formulate a real product. I'm sorry? Yes. May I ask, do you have a converse? If you take the intersection of all the endomorphism rings which contain all the l's such that the endomorphism contains two copies of A1 and A2, do you recover all the devices of the norm of the difference? A little bit more complicated. But as I said before, I mean, I guess you list of suspects, of course. But then in the work of growth since I gave it, there's a formula for this exponent ml that arises. And I do not think that all the integers which satisfy these two conditions, which I wrote here, will necessarily have an ml non-zero. OK. So further, it's not. I don't think you can rule out the fact that some of these l's could actually not appear. So these are necessary but not sufficient conditions for an l to appear in the factorization. Does that answer your question? OK. OK, so now what I want to talk about is an extension of this story to the setting where the imaginary quadratic fields are replaced by real quadratic fields. And the goal then is to define a quantity j of tau 1, tau 2, which is going to behave like the difference of singular moduli. And the key differences in this construction are going to be, firstly, that this, rather than having an analytic function, like j, which involves a Archimedean limits, it will be defined via a periodic limiting process. So it'll be a periodic construction rather than a complex analytic one. And the second key difference, which is very much at the heart of what we're puzzled by, is that we lack an arithmetic geometric understanding of the construction analogous to what we have coming from the theory of electric curves with complex multiplication. OK. So to describe the formula, so I want to give a very down to earth description of this function. It's a little bit less, how can I say? It's a bit less fine than the finite invariant we can define. But the advantage is that we can actually sidestep a lot of the formalism that's involved in, yeah. So I'll explain it now. So we have this local greens function, which we can associate to a pair of real quadratic arguments. So I'm going to let tau going to tau prime be the natural involution, which sends the square root of dj to its negative. And I'm going to, so to any real quadratic tau, I can associate a geodesic on the Poincare upper half plane, which is simply the geodesic joining the point tau to its conjugate tau prime. So that's like a semicircle joining those two points, which lie on the boundary of the complex upper half plane. And so you have tau 1 and tau 2. You get this pair of geodesics, gamma 1 and gamma 2. And you can consider their topological intersection on the upper half plane h. So these two geodesics, either they intersect or they don't. I mean, if they're like this thing. And the intersection number is either 0, 1, or minus 1. So it's just an intersection on that non-compact symmetric space attached to SL2R. Now we can associate a local greens function to the pair tau 1, tau 2 by considering this expression. It's essentially tau 1 minus tau 2, which is the difference of tau 1 and tau 2, multiplied by its algebraic conjugate numerator. And then in the denominator, you just normalize by this factor, which is comparatively less important, tau 1 minus tau 1 prime, and tau 2 minus tau 2 prime. But this is just some algebraic number, which belongs to the compositum of q square root d1 and q square root d2, so to this bicarbonic field. But then we weight this contribution by the topological intersection of gamma 1 and gamma 2, which means that if our pair tau 1, tau 2, if they're corresponding geodesics do not intersect, then the greens function simply takes the value 1. So it has a trivial value. And so this by its very definition, it belongs to the bicarbonic field, but then you look at its invariance property under tau goes to tau prime, and you see that it actually belongs to this distinguished quadratic subfield of the bicarbonic field. And it's easy to see from the definition that this greens function is a point-pair invariant. If you simultaneously translate tau 1 and tau 2 by an element alpha in SL2q, this expression here is essentially a cross-ratio of the four elements, tau 1, tau 2, and their conjugates, and therefore is invariant under translation. And likewise, this exponent here is, I mean, SL2q acts as hyperbolic isometries on the upper half plane, so it preserves the intersection number. So, okay, so we have this property. And now we're gonna define a global multiplicative greens function by simply taking the product of these local ones over suitable translates of these towels. So the group gamma, which is SL2z, which I'm just gonna denote by gamma, acts on the real quadratic elements, of course, by Mobius transformations in the usual way. And it acts on the set of two-by-two matrices with integer coefficients both by left and right multiplication. So I can now denote by gamma 1 and gamma 2, the stabilizers in SL2z, of these real quadratic elements, tau 1 and tau 2. These groups turn out to be of rank one. They're essentially cyclic groups of rank one with the generator of modular torsion, which is given by the fundamental units of the core, or by matrices whose eigenvalues are the fundamental units of the corresponding real quadratic fields. Okay, so we have that, and then I'm gonna define g sub m of tau 1, tau 2, to be the product over all matrices of determinant m, running over this double coset. So I take a matrices, modulo gamma 1 on the left and gamma 2 on the right, of the local greens function evaluated tau 1 and alpha tau 2. Okay, so it's clear that this expression here depends only on the value of alpha, mod gamma 1 on the left and gamma 2 on the right. That's easy to check from the equivariance properties of this expression. And so I take the product over all alpha determinant m. Now this could still be an infinite product because the indices over which it's running, there are this double coset space, consisting of element of matrices of determinant m, modulo gamma 1 and gamma 2 on the left and right, is an infinite set, but the way that I define this local greens function by decreeing that it would contribute a one whenever the corresponding geodesics do not intersect, actually cuts this down to a finite product. In particular, it's a finite product of elements in this quadratic field. So the final outcome is just an element of q square root d1, d2. Yeah, so that's what I'm saying here. It's really just a finite product really of these local greens. That's the importance of this factor, this weighting factor given by the topological intersection at infinity. And okay, so it belongs to this quadratic field. Okay, so now to make this interesting, we will need some kind of, to bring in some kind of analysis. And so we're gonna try to consider a periodic limits of these expressions. We do this by introducing a prime p, which for simplicity, I'm going to assume that it's inert in both of the real quadratic fields. So both d1 and d2 are non-quadratic residues. I could also have that p divides and describe, I'll ignore that case for now. And so this is, if this is true, then the prime p actually splits in the quadratic field q square root d1, d2. And therefore I can consider both the local greens function and this product g sub m as elements of qp by choosing a prime of q square root d1, d2, which lies above the rational prime p, okay? And now what I'm gonna consider, instead of just taking gm, I'm going to consider the product gmp to the n. So where now I take the product over all matrices of determinant m times the power of p. And the idea is gonna be to grow this power of p, okay? So this is still an element of qp. It's still given by a finite product of things, but this finite part of the force is getting larger. It's involving more and more terms as n grows. And we're gonna be interested then in these limits. We take n go to infinity of gmn evaluated on tau one, tau two. And that's what I denote by j sub m of tau one, tau two. So we wanna consider these limits when they exist. As a first theorem about real quadratic singular moduli. So I'm gonna first assume for simplicity that the prime p is two, three, five, seven or 13, which is equivalent to the fact that the modular curve level p, x not of p has genus zero or equivalently that there are no way to cusp forms on gamma not of p, okay? And then the theorem, which Yan and I, yeah, this is the theorem of Yan, Vanquin and I, is that this limit, the limit of gmn as n goes to infinity exists in qp. So it's a well-defined periodic number. And it has an interesting algebraic property. First, it belongs to this compositing of the two narrow Hilbert class fields of the two real quadratic fields up to torsion. And furthermore, if I take m equals one, this quantity j one, tau one, tau two, exhibits exactly the same sorts of factorization patterns as we saw in the difference of singular moduli in the theorem of Gross and Zagier when the tau one and tau two are imaginary rather than real, okay? So we'll see that it's the same kind of phenomena that arise that the primes that divide this difference are rather small and less than the project discriminants, essentially over p, et cetera. So there's a theorem very analogous to the one of Gross and Zagier, the governing these quantities. Okay, now I say a word about what happens for general p. So this restriction, of course, is very strong. You might wanna ask what if there are customs of level p? Well, we can consider this space of so-called weakly holomorphic modular functions on gamma not of p. These are modular forms of weight zero modular functions and we require them, we allow them to have poles at the cusps. But if so, gamma not of p, x not of p rather than modular curve has two cusps usually they're not at zero and infinity. And we still require that these functions be regular at the cusp zero. So they have a single pole which is at the cusp infinity, okay? And so that's the space which we're gonna be considering. Now, if I write, if I take such an element in M zero shriek gamma not of p I can write it as a Laurent expansion and q into the two pi i tau.  And so these coefficients A, M of the principal part if I take such a thing and I assume that the coefficients aren't actually integers then I can consider a weight a kind of multiplicative combination of the GMNs weighted by these coefficients A, M that appear in the principal part of this weekly homomorphic modular form of weight zero weekly homomorphic modular function. So I do this and I call this G sub phi of N because it's governed of course by the form, the function phi. And the next theorem is that I can then take the difference of these G phi Ns of tau one, tau two and I'll call that J sub phi of tau one, tau two. And that limit exists as a piatic number and it belongs to the compositing of the two Hilbert class fields. Now the way you might wanna think about this J phi is as a kind of a piatic board shards lifts of the weekly homomorphic modular function phi. So it's a and I'll try to explain more of that when I talk about the eventual generalization of this framework. Okay, so now I wanna one thing I wanna do in this lecture is give it an idea of the ideas that go into the proof of this theorem, give some kind of outline. And it actually helps to actually recast the formula in a broader setting, which is inspired in fact by two things. So the first is a the theory of what we called rigid maromorphic co-cycles for orthogonal books. So this is something that I developed that's with Leonard German and Mike Lipnowski about a year or two ago. And so the goal is to sort of extend the notion of rigid maromorphic fun. I mean, these rigid maromorphic co-cycles are meant to play the role of a maromorphic modular functions in the setting of for things like real quadratic fields. And one can try to generalize them to general orthogonal groups. So that was the first source of inspiration for the formulas I'm now going to describe that are more general. And the second were the calculations that arose in the PhD thesis of Romain-Branche-Rô that was defended two years ago or a year and a half ago. So those are the two things that I and now I'll try to explain that a little bit. So the idea is to think of the previous formula as having something to do with a quadratic space of rank four and signature two-two. So now I want to look at higher rank quadratic spaces. So the basic object behind the construction is going to be a free Z module of rank two R equipped with a bilinear form from V cross V to Z a Z valued bilinear form. And the basic assumption is that the tensor product of this lattice V with the reals is a real quadratic space of signature RR which means that when you write the quadratic form in a diagonal form over R you have R plus signs and R minus signs. So it's a quadratic form of that signature. And I'm going to assume for simplicity this is not an essential assumption it just makes statements a little bit cleaner that this lattice has discriminant one. So the pairing actually identifies V with its Z linear dual. Now the final group of this quadratic lattice is defined over Z and it's even smooth over Z because of this assumption on the discriminant. And the main case that was of interest in the setting of real quadratic singular moduli as I sort of said at the beginning is that it's the case where the quadratic space M2 of Z, the space of two by two matrices with integer entries equipped with the trace form. So A paired with B is the trace of AB star and B star is the so-called adjugate of B the inverse of B times the determinant if you want. And there's a natural action there's a SL2 cross SL2 acts on M2 of Z by simultaneous left and right multiplications. So UV acts on A by UV A V inverse. And that group action determines a homomorphism from SL2 cross SL2 to G, which is defined over Z and this. And so the framework I'm about to describe now when you specialize this setting you will recover the formulas that I wrote down earlier. Okay now this quadratic space of rank two R comes as it has naturally associated to it two different kinds of symmetric spaces. So firstly there's an Archimedean symmetric space which is very standard in the theory of Chimora varieties or spaces associated to orthogonal groups. One can consider X infinity to be the collection of all maximal negative-definite plane R planes R dimensional subspaces of VR. So because of the signature the maximum dimension of the negative-definite subspaces are and you can look at this collection of all these spaces. And so it's a kind of subspace for the Grasmagnian of R dimensional subspaces of VR. And it turns out that that space is a real has a natural structure of a real manifold of dimension R squared. Okay. And there's also a periodic symmetric space associated to V which is now going to be a kind of rigid analytic space. So this space we're going to denote by XP is identified with the set of isotropic lines in the tensor product of V with CP. So I take CP which is the completion of the algebraic closure of QP and I tensor V by that to make it into a vector space of dimension two R over CP. And I look at all the lines in this quadratic space which are isotropic. And I subtract from that the set of lines at the set of lines which are spanned by vectors which are orthogonal to some QP isotropic lines to some vector which is isotropic, but defined over QP. So I remove all the orthogonal compliments of isotropic lines defined over QP. And so that's my symmetric space. And that turns out to be a rigid analytic space as natural structure of a rigid analytic space of dimension two R minus two. So you can see that the way that these two symmetric spaces are defined is a rather not parallel. The dimensions are quite different in the way that we define. So there's a feeling that perhaps the construction is not, I would be a bit hard pressed to give a very strong conceptual justification for why we made these definitions. They seem to work in what we're doing but one could imagine perhaps other things. And the formula I'm gonna present are very much going to exploit the interplay between intersection theory, topological intersection theory on this archimedes symmetric space which is the kind of thing that appears actually Roman-Brancheral's thesis, for example. And something happening with the analytic, the rigid analytic functions or meromorphic functions on this piatic symmetric space. Okay, so I wanna associate a certain quantity to this orthogonal group together with a maximal torus in the orthogonal group G. So I'm gonna call T such a maximal torus. I assume that it's R split, it's split over R. So these real points is just isomorphic to two R copies of, we're sorry, to R copies of R star, okay? Now, for such a torus, there's a general classification of tori in orthogonal groups. The Q points of such a torus are identified with L one star where L is a totally real ital algebra. So product of fields of finite extensions of Q equipped with an involution, lambda goes to lambda prime. And the L one star, this subscript of one denotes the elements which are of norm one relative to this involution. So lambda, lambda prime is equal to one. Now, if I take the sub algebra of L of this field of this ital algebra, which is fixed by the involution, I'll call it F instead of lambda, lambda is equal to lambda prime. So L is a quadratic extension of this F. So to speak. And, but now the assumption I'm going to make about the torus is a strong condition, strong assumption about how the torus is actually globally non-split. I'm going to assume that L is a totally real field, not just any ital algebra, not a product of fields but really just one field. And even more than that, I'm going to assume that there's a prime P for which the tensor product of L with QP remains a field. So this prime P then has to be, there's a unique prime of L, which lies above P. Okay, so that's a rather strong assumption on the torus being non-split at P. Okay. And so this is an essential assumption. The next one is just to simplify things a little bit. I'm going to assume that the sub ring of L which preserves the lattice of E. So V remember was a Z module, right? And that in general would be a no order in L. And I'm going to assume that it's the maximum of the ring of integers of L. Okay. Now the action of this torus, the irrational points on the torus T, it becomes diagonalizable over the tensor product of V with the field L. And of course there the action splits completely and decomposes VL into a direct sum of one-dimensional eigenspaces. And I'm going to fix an eigenline, subspace of dimension one, which is preserved which is fixed by the torus action in VL, okay? And so this C is isotropic and therefore it gives rise to an element of XP after choosing an embedding of L into CP. So then you just base extend the change scalars to CP by this embedding. And that gives you an isotropic line and the condition of L being a field after tensing with QP sort of ensures that this C is never orthogonal to any QP rational isotropic line. So it really belongs to XP. It's a really a point. So that was one of the justifications for making this assumption on L being non-split at P so that I get a point in this symmetric space. And in addition on the Archimedean side at infinity I have two R real embeddings because L is a totally real field. So I have two R, it's a totally field of degree two R and these real embeddings of L, they come in pairs because I grouped together an embedding and the one which differs from it by composition with this automorphism prime. So I have then two R vectors, two R lines rather C1, C1 prime up to CR, CR prime which are contained in the tensor product of V with the real numbers and our isotropic lines there. And these lines are all mutually orthogonal to each other except that Cj and Cj prime pair to something non-zero. So they give a natural decomposition of VR as a direct sum of our hyperbolic planes, okay, over R. Okay, so now to these I'm gonna now describe certain Archimedean cycles which are associated with this torus and those are, they generalize the geodesics on the upper half plane that were associated to the real quadratic tau, okay. So now if I have an R tuple of positive real numbers I can consider the R linear span of the vectors T1, C1 minus T1, C1 prime. So here I made an abusive notation I'm just choosing a vector in that isotropic line which I'm calling C1. And I take this thing and then up to TRCR minus TR inverse CR prime. Now these R vectors are mutually orthogonal to each other and they all have negative inner product of themselves. They have negative length. And so this plane which is spanned by these R vectors is negative definite. So I get a collection of negative definite planes of dimension R, one for each R tuple of real numbers and so then I can then use that to define a cycle, a cycle dimension R, which is the collection of all these pi C of T1TR as T1TR range over the positive real numbers. So that's a subspace of a cycle in X infinity of dimension R. So this delta C is an R dimensional topological cycle in the Archimedean symmetric space. Now, give it a vector of positive length. I'm sorry. Yeah. You impose here the TR to be positive, but then that depends on the choice of the embeddings. XI, I, because XI, I, XI, I prime. You're completely right. Yeah, so here maybe I should have said this. I said this, but then I actually kind of normalize the, I take these vectors that's in these lines, but I normalize my choices so that these inner products are always positive. No, but it depends more on the order than on the positivity of that thing. Like who is CJ and who is CJ prime? Yeah, so CJ is a vector in the line and CJ prime is its conjugate. Yeah, but what I mean is you could have chosen the conjugates and then in your next definition, when you impose the TI to be positive, it exchanges to, so in the next line. I make the choice. Okay, so you're right.  Yeah, that's another way of saying it exactly.  Okay. So if C1, C1 prime was negative, right? I would put a plus here, not a minus. Okay, okay, so you would adjust them so that they are all positive. Okay, thanks. I mean, these sign things to some extent are a little bit a matter of convention because I could have defined my symmetric space as the set of all positive definite subspaces as well. If I have a negative step in something, I think it's orthogonal complement that's going to be a positive one. So the two spaces would be a natural bijection to each other. So in the literature, you will see both conventions being used more or less, it's not very essential. Okay, we'll just have to be consistent, of course, with this. So I choose in such a way that is negative definite and then I get this cycle. Now in parallel, I also want to associate certain cycles to the positive vectors in my lattice. So if I have a V and V with positive length, I can consider the negative R planes which are orthogonal to V. So V is positive, this orthogonal complement is going to be a signature R minus one R. So we will contain certain negative definite subspaces. And it's one can show it's not hard to see that this delta V is of co-dimension R in X infinity. So as dimension R squared minus R. And in particular, these cycles delta V and the cycles delta XE, they are of complimentary dimensions. There are some of dimensions as R squared. And therefore we can talk about the topological intersection. It should be some met. And it's always turns out to be always zero, one or minus one. And it's completely well-defined. There are no issues of a non-transverse intersection of degenerate intersection in the setting which I'm describing now where L is a field. You always have a well-defined, very simple kind of intersection number. Okay. So this is gonna allow me then to define certain piatic class invariance attached to this torus T in the setting. So I let V of one over P be simply the lattice V tends it with Z of one over P. So I turn it into a Z of one over P lattice. And the Z of one over P lattice, so it's a rank two R Z module, as sorry, Z of one over P module free over Z of one over P of rank two R. I can also write it as a direct limit an increasing union of the Z lattice is P to the minus N times V. And this expression of the Z of one over P lattice is an increasing union of Z lattice is gonna be useful shortly. Okay, so then I consider the following expression. I take the product over all vectors in the Z of one over P lattice of a given length M and I look at the orbits under the Z, the integer points of the torus. So I look at T of Z. The non-split assumption implies that T of Z and T of Z of one over P are essentially the same. So it doesn't really matter whether I choose the Z points or the Z of one over P points. So I look at these orbits of vectors of length M and I look at the simple expression. I take the inner part of V with XC and V with XC prime and I divide by the inner product of XC and XC prime. Now this expression here, it depends our priority on the choice of a vector in these isotropic lines, but you can see that it in fact does not because here XC prime is the conjugate of XC. And so if I rescale XC, this entire ratio will be unchanged. So it's a really canonical invariant attached to XC and V. And I take this element and I raise it to the power of the topological intersection of the cycle delta V of the previous slide with the cycle delta XC. Okay, so that's my JM of XC. And again, because of this factor here, I mean, this set is infinite, but this factor makes the number of terms appearing in the product which are not equal to one finite. Oh, no, sorry, sorry, no, I take it back. I mean, I'm taking now the product over V of one over P. So if I've been taking the product over a Z lattice, I would get a finite product, but having inverted P, this becomes an infinite product. But I define it, one has to be careful and define this infinite product. I define it to be the limit of the JM ends where JMN is the product over this thing, the P to the minus N V mod T of Z. And now this product here is a finite product. Okay, and but I take, allow N to increase and then to infinity to get my JM of XC. Okay. And if you, so in addition to these JMNs, it's useful to introduce a J phi N attached to any weekly whole morphic, wow, here 20 formal powers, Laurent series in Q, okay. If I have a fee like this, then I define J phi N to be the weighted product of the JMNs, raised to the power AMs, these coefficients that appear in the principal part of the, of the fee. Okay, so that's my JM, J phi N of XC. Okay, and then the theorem is basically going to be an algebraicity result about the value J phi of XC. Which generalizes the previous result on real correct senior module. So the theorem is if fee is a weekly whole morphic modular form of weight two minus R. So two minus R is kind of the complementary weights to weight R and level P, then the following limit exists in QP or not in QP, but in, in F P in the completion of F at P. So this J phi of XC is just a limit as in goes to infinity of the J phi Ns. And it belongs, so I prioriates just the periodic number which belongs to the periodic completion of F, but it actually belongs to the narrow Hilbert class field of L relative to a suitable embedding of that Hilbert class field into the completion. So those just narrow class Hilbert class field up to torsion. Okay, so the case of, as I alluded to before, the case of real correct singular module can be recovered from this more general results by setting R equals two, V to be again this four-dimensional space M2 of Z, L to be the bicodiotic field Q square root D1 square root D2, F is this quadratic subfield of a bicodiotic field and the isotropic line or the isotropic vector is this one here, which belongs to this tensor product of V with CP. So that's the vector of that. So if you plug that was into the formula, you will recover that earlier formula I gave you. Okay, so now I'm going to say, give you a little bit of an idea of what goes into the proofs of these results. And it turns out that there's even some conceptual clarity to be gained by treating the general case. It doesn't make the proof much more complicated and even make simplifies it on some conceptual level. Cause yeah. So the main thing, the main object in the proof are certain Hilbert modular theta series, which are associated to finite order HECA characters of the field L. Okay, so I remind you a little bit, the notation involving finite order HECA characters. If I have, I consider Isabel to be the group of fractional ideals of L and PL to be the group of principal ideals having a totally positive generator. So the quotients of IL by PL classically is what we call the narrow class group of L. And a character of this narrow class group, we say that it's a mixed signature. If it's value on principal ideal is the sign of the product. Remember that we have these two R real embeddings of L into R, but we group them together according to when they differ by this prime. And so we chose for each prime of, for each Archimedean place of F, we chose a real embedding of L that lies above it. And I call A1 up to AR, the images of A under these are distinct real embeddings. And they take the sign of the product. And if that's, if PSI satisfies this, we say that it's a mixed signature. So it's sort of, even an odd at each of the real places lying above any real place of F. Now, if PSI is a mixed signature, the reason why these characters are useful for us is that when we look at the induced representation from L to F, we get a two dimensional representation of the Galois group of F. And this two dimensional representation is odd at all the Archimedean places of F. So it's an odd, it has eigenvalues one and minus one when evaluated at each of the Frobenius elements attached to the R Archimedean places of F. And we know that such odd Galois representations of F, Archimedean representations odd to correspond to a holomorphic Hilbert modular forms of parallel weight one. And in this case, the forms that correspond to these induced representations are the classical Hilbert modular theta series, which I'm gonna describe now quickly. So we can define a function on the integral ideals of F depending on this HECA character PSI by saying that C PSI of an ideal A of F is the sum of the PSI of J, where J ranges over all the ideals of norm A. Okay, so that's the function on ideals. And then we can write down certain generating series, which are indexed by the elements new in a certain, the totally positive elements of certain ideals of F. And so I write theta PSI of I to be the sum over the news of this ideal of C PSI principal ideal, generated by new times, sorry, times I inverse times Q to the new, which is just a shorthand, of course, for the usual thing you see in the theory of Hilbert modular forms. Okay, so this is a Hilbert modular form of parallel weight one on a certain congruent subgroup of SL2F, which is essentially of level one under my assumption that OL preserved the lattice, et cetera, and that the lattice was of a discriminant one. Okay, now I wanna bring in some Abelian extensions of L, so for the next part of the proof. So if I have an Abelian extension in this context of level one, where everything is un-ramified, so to speak, this H would just be the narrow Hilbert class field of the extension L. So this would be an Abelian extension of L, but it would also be in fact, a Galois over F, right? It's Galois, but not necessarily Abelian over F. And I'm gonna write G for the Galois group of H over L and G plus, so the evolution in Gal L over F induces an evolution on G, which I again denote by prime, and I let G plus be the subgroup of G, which is invariant into this evolution and G minus the quotient of G by this G plus. So you have the following diagram of field extension. So you have your F, which is the base field, totally real, this quadratic extension L corresponding to the torus in the orthogonal group. And then you have this G, the Galois of H over L, which decomposes as a subgroup G plus and a quotient G minus. And this H minus is actually Galois over F and its Galois group is a generalized dihedral group, where this evolution acts as minus one on this G minus. And so we're focusing particularly on primes P of F, which remain inert in L over F. And so the Frobenius in Gal H minus over F, which is associated to this P, is actually an element of order two. It's a reflection in this dihedral group, which means that this prime P has to split completely in H minus over L. And then the splitting behavior of this primes in H over H minus is immaterial. It sort of splits in some way, but what really matters in the construction is that we have this behavior of P being totally split in this extension H minus. Okay, so the crucial results that really allows us to prove things is the theory of deformations of these modular forms and their associated Galois representations. So I fix a prime P, which is in inert in L over F, and I consider this theta function. And the main result is that this theta function admits the first order, ordinary pietic deformation of the following form. So here you recognize the coefficients. I hope that you people see I have my cursor moving over the slides, I hope you see it, yeah. So this is just a coefficient of the original Hilbert modular theta series. And then you add in this infinitesimal term, so the epsilon is just a short hand for this element of square zero, and you just add this pietic logarithm of the corresponding element in U times Q to the U. So this is kind of not terribly interesting kind of deformation of the modular form, but then there are these extra coefficients which crop up, which only occur at the coefficients of the original theta series, which were zero. So one of the features of theta series is that when you look at your Q expansion, it's there fairly lacunary. Any element in U which corresponds which is divisible by an ideal which is inert, for example, the corresponding Fourier coefficient has to vanish. But in this first order deformation, you get this interesting sometimes Fourier coefficient. And what characterize these S psi of U inverse is that, so this is a function on ideals. It can be written as a linear combination of S G of A's as G ranges over the Galois-L over L. And the crucial point is that the coefficients that arise here are pietic logarithms of algebraic numbers in H minus star. So in the multiplicative group of this abelian extension of L. So this is the crucial thing, the crucial phenomenon because we see the algebraic numbers that we were trying to construct appearing as the first order, as the Fourier coefficients of first order deformations of these Hilbert theta series. That's the source of the algebraic numbers. And I won't give you the formula for these S GA's is quite involved in general, but as a special case, S G of P Q, if I take a product of two primes, P and Q, which are both inert in L over F. Then I can take the recipe for it is that this is going to be the P prime attic logarithm of a unit U of Q prime. This U of Q prime is an element of H minus and it's chosen so that it has valuation one at Q prime. So Q prime is just some prime of H minus above Q that has valuation one there and valuation zero everywhere else. And I take the P prime attic logarithm of that and these P prime and Q prime are pairs of lifts. They're chosen to have a certain compatibility relation, which is that if I look at the two Frobenius elements attached to P prime and Q prime, these are canonical elements in my dihedral group, the Gal group of L over F. And I want that this element G, which occurs here, is the product of these two reflections. So this is now an element of Gal H over L, okay? And so that's the formula. I'm sorry, do you have a common logical interpretation of this deformation by saying that the trivial deformations are like boundaries and the non-trivial are sort of co-cycles? I'm not sure. One of my goals is to give this lecture without saying the word co-cycle once. Okay. Yeah, I mean, of course, the mechanism behind the proof of this result is the theory of deformations of Gal representations. So the specialization of this data series, of course, it's associated Gal representation is this Arten representation, which is particularly simple. It's a dihedral type representation. And when you look, when you analyze this first order deformations, you're led to consider Galois homology, the homology of the Galois group of F with values in the adjoint representation of this Arten representation. And out of that, you extract, out of really class field theory for H minus, in some sense, you see appearing these logarithms about to break numbers. So these very interesting coefficients really emerge naturally from the deformation theory of the Galois representation. So the log of the units are kind of the trivial deformations. And then the ones in H star minus are the non-trivial ones. I don't know.  So, yeah, so these ones correspond to deformations where the Frobenius with a prime splits and therefore the elements. So this Galois group of H over H minus over F is a dihedral group. And if the Frobenius lands in Gal H minus over L, yeah, over L, right? Then we get these relatively straightforward terms coming up in the deformation. And then something interesting happens when the Frobenius is a reflection and you look at the deformation, you pick up some information about an extension class between two Galois, between two one-dimensional Galois representations, which gives you these numbers. Okay, so I'll leave it at that because I'm running out of time but that's sort of what's going on. Okay, so now that I have this, I can just describe in one slide the proof, the remaining proof. So I first define an ideal, a fractional ideal in L by taking the inner part of the Z lattice V with C, this L vector. That gives me a fractional ideal well-defined up to homotasy. And I can look at and make an ideal of F by taking the norm from L down to F of this ideal divided by this C, C prime inverse. So this is actually canonical, not depending on the choice of the vector in C. And then I define a function on ideals by sending alpha, an ideal alpha to the sine of A if alpha differs by this S by principle elements, by principle ideal and zero otherwise. This function is not a character, but it's an odd function. It's a kind of mixed character function, I should say. And therefore it can be expressed as a linear combination of characters. And that's gonna be enough for me because I've analyzed the deformations of all the theta C's for C characters, mixed signature characters. I can then recover something about this thing. And I'm gonna then consider the theta series associated to this function. And it's Q expansion attached at the ideal I, so to speak. And so I get this first order thing by taking this theta psi S tilde and I take its derivative, or in other words it's epsilon term, the derivative respect to epsilon. And so I get this. So the crucial thing is I take the Hilbert modular form and I look at its diagonal restriction to get a classical modular form over Q. And now this is just, I can write down it's Q expansion, now the Q expansion is indexed by integers M, okay? So that's my diagonal restriction. And so this is actually, because it's the diagonal restriction of this derivative, taking the derivative means I only get a piatic modular form, not a classical modular form. It's a piatic modular form of weight R and tame level one, okay? And then the main point of the proof is just the calculation of the Fourier coefficient solution. It turns out that if you calculate the Mp to the end Fourier coefficient of this piatic modular form, you get two contributions. The first is the piatic logarithm of this finite product, Jmn of Xe. And the second contribution is the piatic logarithm of an R of M, where R of M belongs to this H minus star, tensor Q. And this R of M, of course, is coming from when you take the diagonal restriction, all these new Fourier coefficients in the deformation where the original coefficients were zero in the Theta series. And the crucial point, the crucial feature of the calculation is that this R of M depends on M, but it does not depend on the exponent N. So when you multiply M by powers of P, you do not change this algebraic contribution, okay? So then the key thing is to take this piatic modular form of weight R and look at its ordinary projection, where you just iterate the UP operator. And if I write this now as a few expansion, this modular form is now a classical modular form of level P because of how the ordinary projection behaves. And so this A of M is just a limit of A of M, P to the N factorial. And then, of course, here, I just recover the piatic log of JM of C plus the piatic log of this R of M. But now this A of M is the Fourier coefficient of a classical modular form of weight R and level P. So if there are no classical cost forms of weight R and level P, then I'm done because this coefficient has to be zero and I recover the algebraicity of the log of JM C from this. But more generally, the space of forms of weight R and level P emerges as an obstruction to the algebraicity of these expressions. But that obstruction is controlled by serduality by the principal parts of weakly homomorphic modular forms of the complementary weight two minus R. And that's what explains the formulation of the result I gave before. Okay, so I'm gonna finish now. I was actually at a further slide where I mentioned rigid homomorphic co-cycles, but since I had kind of promised myself to not try it out to mention co-cycles at all, I'll just skip that slide. And thank you for your attention.


They're probably done, it's really low. I'm only getting the C and we're not getting everything. Wins are calm. The LZ is dry. You can land a pile of discretion when right here.


Good morning, speaker today. Dr. Soji Bodani is a professor of M.S.A. at PFL, Swiss Federal Institute of Technologies, where he has a security and pictography authority. As you know, Sash has been really active in this field. He has written many papers and books and edited proceedings as program chairs of IACI conferences and workshops, including FSE 95, PKC 2005, Europe 2006, and so on. As today's inviting talk, FSE program committee asked Sash to give a talk on RFIDs. Today's talk is about distance-bounding. This is a cross topic involving construction based on symmetric cryptography. So the title of this talk is called Secure Distance-bounding. Thank you very much. So thank you for this kind introduction. I would like to thank the program committee for inviting me. It's a pleasure to be here. So today I will present you some joint work with Iwana Koryalu and Katerina Mitroko. Good stuff. It's about distance-bounding. Distance-bounding is one way to prove that someone is close to someone else. I can prove that I'm close to you. So maybe here you may be looking at someone who looks like talking, but maybe you're looking at a robot and I may be seated somewhere far away. It's which they are trying to pilot this robot. So if this ID is uncomfortable for you, I can try to prove you that I'm really close to you. So that's one way to an application of distance-bounding. Maybe an interesting application. So I've just arrived from CISERA, so I may be saying some stupidities for any consistency in this talk. So I will first introduce the notion of distance-bounding, and then I will essentially show that there exists no secure distance-bounding in the literature so far, and try to propose a new protocol which is hopefully secure. So first, why distance-bounding? So there is a very popular way to try to win a chess. So if you don't, you don't master chess very well. If you're not a very good chess player, you can try to defeat one master chess in some very easy way. So here you have some guy who tries to defeat two one master chess. So there is one one master chess, one chess one master here who is deeply thinking at what he wants to move, another chess one master here. And this guy is defeating both of them, but the two masters do not know about this part. So here this guy, we make a move, so he's playing the black, he will make a move, and then this guy will run very fast to the other board to do exactly the same move, so he's playing the black against the other, and he waits for the other to make a move so that he will go back and play the same move against the first master. So with this strategy, this guy is not a very good player at the chess, but he can defeat the two grandmasters here, and he's making sure that actually both of them will spend a hard time playing against him. So the things they play against this guy but actually they are playing against each other. So that's actually a relay attack. So a relay attack you have here, a two verb and a very fire, and someone in the middle is playing against both of them at the same time. So here this guy is sending the message, so he explains the very fire side of the protocol, but he's relaying the message to a simulator of a prover here who sends the message to the very fireman. He waits for the answer to forward the backward. So that's a relay attack. So where can we have relay attacks? You can find many applications of relay attacks. So this is an example. Here you have one fancy power, which can be open, which can be controlled by a wireless key. So for some cars you have this kind of wireless key who can open and close the car and even start the engine, and sometimes you don't even have to press a button to do that. So it means that someone who is sitting close to the key holder can just relay whatever he intercepts from the key to someone who is very close to the car and so on so that the car will open. So some people have demonstrated that this attack is feasible against many, many cars. So that's actually a real threat for this application for wireless cars. Another application here, you have an EPFF fellow called Roger here who tries to access to the building of EPFF during night or during the weekend. So during night or during the weekend, the doors are not open but you can just present this kind of car to the entrance door and the door will open. So here you have some contactless protocol between this car which has RFID inside and this RFID reader so that the door will control access and eventually open. So of course you can relay the messages from the car to the door. So if you're here, so for example here I have my EPFF car, so you can just be close to my pocket and just relay the messages to someone with an EPFF to try to open the door of the EPFF. That's a real attack just to open the door. Another application is for payment system. Here you have one payment system which is completely wireless with some wireless cars on this device. But you can also think of a traditional payment system with a credit card. So if you try to buy something in a shop, you will use your card and you will try to pay on the device but maybe this device is malicious maybe this device is just relaying the messages to someone with a fake card is trying to buy something which is more expensive. And you have no clue to protect against this except by seeing that this terminal is malicious. So that's a real attack and it's also a threat. Some people have demonstrated that this is a feasible attack. And to avoid that, we need to prove that the card is close to the terminal making registering the payment. Okay, so for that, Bronson and Schoen propose a long time ago the notion of distance bonding protocol. In the distance bonding protocol, you have a prover of the verifier. So I won't go through this protocol here because you see that there is a public key and we are at FAC. We have a signature, so that's not a good protocol to illustrate that. But later we will see some other protocols which are fully symmetric, which are symmetric keys and nothing about public keys. What you can see here is that in this protocol there is a critical phase in which the verifier is sending a challenge to the prover and the prover has to respond. And this phase is time critical. So here this verifier is sending a challenge and at the same time it starts the clock and when the response arrives, it starts the clock and see if the response arrives fast enough. If the response arrives very quickly, it means that the prover is closing off. So it changes the correctness of the response and that the response arrives very quickly. So the challenge and the responses are consist of a single bit. So here the challenge is a bit and the response is one bit as well. So you don't have so much competition to do so you can expect that the prover will respond immediately and you will just have to measure the time. So it will measure the time of flight of the challenge and the response. Now you rely on the fact that information have a speed limit when you transmit information. The speed limit is the speed of flight. The light goes pretty fast so you have to be very quick when you use the measurement. So if you make an error of one microsecond, during one microsecond the information can move by 300 meters. So if you have an imprecision of one microsecond then when you translate it in terms of distance you have an imprecision of 300 meters. So you don't have any time to waste. You don't have one microsecond here to do the computation. You have to respond immediately with less than one microsecond. So that's the principle of distance boundary. So now more formally, the distance boundary protocol sets an interactive proof. So it's an interactive proof of proximity. You have a verifier, so we assume that this verifier is honest. You have a prover, sometimes the prover may be malicious if it tries to show that it's close to the verifier but actually it's far away so it may be malicious. So there may be a secret to characterize the prover and on the verifier side there will be a key corresponding to this prover as well but since we're at FACC we will assume that these keys are symmetry so it means that the prover has a secret and the verifiers knows this secret. We control that. The prover knows the secret as well. We will assume concurrency between many participants so we may have many provers, many verifiers and the concurrence between them. We may have also malicious participants, of course. Then what do we expect from an interactive proof? We expect completeness. We expect that if a honest prover is close to the verifier and running the protocol then the verifier will accept. We assume some notion of some nest so it means that here if the verifier accepts then there must be one participant close to the verifier who knows the corresponding secret and some kind of security here which says that if you honestly run the protocol then the secret doesn't leak. So it's maybe something which is weaker than the notion of zero-knowledge. You don't need zero-knowledge. So that's the notion you need for identification. You need not to leak any information which can be used to identify the problem. That's what you expect. Now in the literature people identify several kinds of threat. The first kind of threat they imagine is the notion of distance fraud. In the case of distance fraud you have a malicious prover, Pistar, who is interacting with the verifier. The Pistar is far away from the verifier but he tries to cheat with the protocol and convince that he's closing off. So when it's based on the measurement of the time of response it means that the prover has to send the responses before he receives the challenge. He has to anticipate the challenge in response before he receives the challenge. Another possible threat is what this man calls the mafia fraud. So in that case you have a honest prover who is far away from the verifier and someone in the middle who tries to convince the verifier that the prover is closed. So if you think of a real attack that's one example of a mafia fraud. A real attack here. You have an adversary in the middle who is relaying messages from the prover to the verifier. Since the prover is far away it cannot work. So now we can also consider an adversary who is not only relaying messages but also manipulating the messages trying to answer by himself or something. So he may have more general attacks of someone who is in the middle. So that's another popular threat against distance fraud. Another more technical threat is the notion of terrorist fraud. In a terrorist fraud you have a malicious prover who is far away and he has a friend here and he will use his friend so his friend is malicious and he will use his friend so the verifier is closed enough. So now if his friend is close to the verifier one trivial way is to stop giving him his key and letting him run the protocol. But since there are malicious or so there are friends they don't trust each other. Here we consider an adversary a malicious prover who tries to get the help of a friend to pass the protocol and give him any credential so that his friend will be able to impersonate the prover. So he tries to help this adversary to pass the protocol but without giving the key. Now you can also consider impersonation fraud so that the case of an adversary tries to convince that the prover is close to the verifier so he's not a prover he doesn't produce a secret. And sometimes there are even more exotic attacks such as a notion of distance hijacking so distance hijacking was proposed by Kheber, Hasmussan, Schmidt, and Jakun. You have a malicious prover who is far away from the verifier but you have some other provers who are close to the verifier they hold some other secret and this guy is trying to interfere with the communication between this honest prover and the verifier so that the verifier will be convinced that this guy is actually close to the verifier. So for some protocol this kind of attack is feasible and it's called distance hijacking so this prover is hijacking the distance between this honest prover and the verifier. Okay? So these are the popular threats that we can find in literature. So in our work we try to consider essentially three threat models the notion of distance fraud but in the notion of distance fraud we introduce concurrency so normally in distance fraud you just have a malicious prover and a verifier but here we introduce also other participants so we tolerate right concurrency so if we tolerate concurrency then this notion also capture the notion of distance hijacking so we can factor two threat models we also take the notion of man in the middle attack so that's an attack in which you have two phases the learning phase and an attack phase in the learning phase you have an adversary provers, verifiers and they all interact with each other without any restriction so in this phase the adversary is trying to learn some information about keys essentially and during the attack phase you have a prover who is far away from the verifier and the adversary who has learned something during the learning phase who tries to convince the verifier that the prover is closed so it's not the case so with this notion this is something which is a bit more general than the mafia fraud because in mafia fraud there is no learning phase but if you adopt this model it also captures a notion of impersonation fraud it's a bit more general it captures some other notion as well and finally we also consider a pollution fraud which is very similar to terrorist fraud maybe a bit more general we say that if a prover who is far from the verifier and interact with the adversary makes a verifier and accepts that the view of the adversary will give a clue so that this adversary can run manage the middle attack so now we try to track some information to run manage the middle attack to run a logic in our management that's pollution fraud so this is what we want to do and we will consider the security of protocols against these threats so now if you if you look at the literature you have many protocols existing so this is a short list of protocols which are available in the literature there are also many attacks to Christians so if you look at the literature the probability of success of these attacks and you can see that for many protocols you have so for example the Brown and Schoen doesn't resist the pollution fraud so actually it was not made to resist the pollution fraud you can see that pollution fraud are feasible the Musa or Bangalore protocol has actually a distance fraud it's physically a distance fraud and you see that in all the protocols there is at least one attack except this Swiss knife protocol and this other protocol TV now this result do not include some newer more recent attack that we will discuss in this presentation so we will see that actually all these protocols are available okay? so that's it about the introduction to distance building so now we will see the difficulty to make these protocols secure so we start with a very simple protocol which is a protocol proposed by Henke and Kuhn in 2005 so you can see that you have a prover in the verifier so the share of secret attacks so the prover will convince the verifier that he knows this secret and that he is close to the verifier so the distance between the verifier and the prover is small enough so we start with some initialization the exchange of nonces and with these nonces they derive two vectors so with this secret key they use the pseudo function here and they derive from the nonces two vectors a1 and a2 then you have the distance building phase which is time critical so you have n rounds and for each round so the verifier selects one bit for the challenge so the challenge is either one or two so he said the corresponding bits as a challenge to the prover if the challenge is one the prover responds with one bit of a1 if the challenge is two he responds with one bit of a2 so he responds with this corresponding bit and the verifier will verify that this bit is correct and that the response arrives quickly enough so if it goes for all the iterations then the verifier is happy and he says ok so this authentication is accepted so now this protocol is vulnerable against terrorist fraud actually it was not meant to resist it's not a big discovery so let's just see how this terrorist fraud works so in this terrorist fraud you have this malicious prover you have the adversary who is a friend of this malicious prover and during the initialization phase there are plenty of facts so they can just relay messages so as they change the nonsense and at the end of this initialization the prover can just leave the two vectors a1 and a3 to the adversary now with this vector a1 and a3 the adversary can run the time critical phase you can directly answer to the verifier but these two vectors a1 and a2 do not give him any advantage so a1 and a2 will not help the adversary to later impersonate the prover so that's a terrorist fraud ok so if you want to protect against this kind of attack we have to change the protocol now one way to do that is to use the protocol by this person that we call DBM here in this protocol you still have two vectors the first one is derived from the nonsense and the second one is just the vector a1 solved with a secret so if you do that you cannot use the previous example because if you reveal a1 and a2 it means that you reveal x because it's solved between a1 and a2 and a2 is x so here the malicious prover can no longer reveal a1 and a2 without compromising his secret so this attack is no longer feasible but now with this protocol you have some other problems actually you can do a man in the middle attack against this protocol so how does it work so that's a man in the middle attack against DBM which was proposed by a team of one current standard in which first you have so that this is a honest prover this is a honest great fighter you have another three just related messages between the prover and the great fighter so that's a running phase so you assume that the prover is close to the great fighter so the prover and the great fighter are close to each other but there is a man in the middle who is relaying the nonsense and at the end he will relay the challenges and responses so I said for one for one which is at the round J so he selected J and for this round J he decides to flip the challenge instead of forwarding CI star for what the complement of CI star so what happens and for the response he will just respond at random to this challenge so what happens is that from the prover the response to the complemented challenge and then from the verifier he will deduce the answer to this CI star because if the verifier is happy about the protocol it means that his responses was correct and he is not happy it means that his answer was not correct in any case he will deduce what is the correct answer because the answer is just a bit so he will deduce the answer to CI star and the complement of CI star so it means that you will learn one bit of A1 and the corresponding bit of A2 but since you have this relation here it means that you will learn one bit of X so if you learn one bit of X you learn some information about X so you can iterate this attack and you will get the vector X completely so you can do this manage the middle attack and get the secret and with this secret you can impersonate the prover so that you manage the middle attack so now we have a problem with this scheme because this scheme essentially leaks X so the idea of the attack is that now we have two vectors and if you play manage the middle you can get one piece of information from the prover and the other piece of information from the verifier so you can get two answers corresponding to this bit so one way to do that is instead of having two vectors we use three vectors three vectors which are here so now you go back so that's an idea which is used in A1, Doha Do and Marta published in 2011 so now you derive again two vectors from the answers and now for the challenge you have three possibilities because you will have three vectors first vector is A1 second vector is A2 and the third vector will be the serve between A1, A2 and X so you follow this scheme and the idea is essentially to use the secret sharing so you use the secret sharing and you get X but you need two shares are not enough to be constructed X you need the three shares to be constructed X so with the prover we get one share with the verifier we get another share but that's not enough to be constructed X so that's the idea of this protocol to use the secret sharing and what I forgot to say is that in this protocol the protocol we use so this is some kind of encryption based on one time pad but there was a proposal to use some other encryption scheme other than that but these other solutions are also insecure so if you use for instance the addition modulo some number or the addition with a random multiplicity factor then we can also break this scheme with a law clever management tag this is what we proposed actually in December as you can see so now we go back to this protocol so now we fix the problem of this management tag but as we will see there are still some other problems so the problem comes with the usage of this function and was present in all the previous protocol as well so here what we use for the function is a pseudo-random function so in many papers about distance bonding people use pseudo-random functions they say see it's pseudo-random it's a pseudo-random function actually if we can break the protocol with this pseudo-random function we can also break the protocol when we replace this function by a really random function so that's a security argument which is very familiar for people who manipulate pseudo-random functions if you can break the protocol with this PRF you can also break the protocol if you replace the PRF by a random function so this is what many people do so if the other person can break the scheme with a PRF then he can break the idealized version of the scheme when we replace by a pseudo-random function but this argument needs some condition to be valid so this argument is valid if the adversary doesn't have access to the key PRF key because if he has access to the PRF key he can easily distinguish the PRF from a random function and if this PRF key is not used anywhere else that's for distance fraud if you consider distance fraud then this first condition is not satisfied in distance fraud the adversary is a prover called the key the adversary knows the key this condition is not satisfied and if you try to protect against there is fraud that's the case which is here the key is used somewhere else it's not only used in this period it's used somewhere else so this second condition is not satisfied either so you cannot use this argument so this in some papers but this proof is incorrect but it's even worse it's not only that the proof is incorrect but the result is also incorrect so there are some PRF for which the protocol is insecure so actually we can construct PRF for which the protocols are insecure so for the protocol TV what we do is that we try to program a PRF so that it will render the protocol insecure so this is a technique that we proposed recently at the in print conference we say that if we start from a PRF let's say that G is a PRF we will construct another PRF which is almost everywhere equal to this PRFG except at some very special points which are some kind of trapdoor these trapdoor are not accessible to a regular adversary so here's the idea that this PRF will have a trapdoor which is actually the key of the PRF you say that if the NP that you input here is equal to the key if the NP is equal to X you will say that FX of NKV is equal to X concatenated with the itself in other case it just corresponds to G so with this property we can easily show that F is also a PRF but when we plant F in the protocol the protocol is insecure so why is it insecure so imagine that now you have this F and you have a malicious prover so the malicious prover could select his notes NP equal to his secret X so he selects NP equal to X and what will happen is that FX of NP and V will be equal to X concatenated with itself so A1 and A2 are equal to X A1 is equal to X A2 is equal to X and the A3 which is A1 A2 is equal to X so no matter what is the challenge the response will always be a bit of X so since the response doesn't depend on the challenge the malicious prover can send the response before he sees the challenge so he can anticipate the challenge and send the response before so that the response will arrive on time and the verifier will think that the prover is closed so we have here the distance from base on the real PRF so to avoid this kind of attack we propose to change the basis protocol by using a notion of PRF masking here the idea is that now the verifier will select the vector A so you will select A1 and A2 and it will set this selection encrypted using the PRF so what he said is N which is X or X of NPNB send it to the prover so the prover can decrease and get A so it's almost the same protocol except that now the prover has no influence on this vector A1 and A2 so you have no influence it cannot make A1 and A2 be equal to X for instance even with a regular PRF so now with a PRF that it resists to a distance from how about there is food it's still insecure so this is still insecure against there is food and we can again program the PRF so that the protocol is weak against there is food so how does it work we start with a PRF an existing PRF and we define a predicate which will say as inputs to the PRF are trapdoors so we have an input possible input to the PRF so actually it's half of the input so half of the input some alpha and t and we define this relation so this relation will depend on X and normally it's half for an adversary to create a string alpha and t which satisfies this predicate so we want enter into the detail of this predicate but imagine that this predicate say which string alpha t is a trapdoor and which is not now to define this function F F you say that for the trapdoor if you use a trapdoor input if nv is a trapdoor if nv satisfies this predicate then you answer by a1 and a2 equal to x this is exceptional in the other cases you will answer to something which looks like random actually it's not exactly the function g so the function g will return some alpha beta gamma what you return is alpha beta gamma and beta so gx of alpha so we can show that this construction is also PRF now what can we do with this PRF if we plug it to our protocol we can have an adversary who play with a number and who send as a challenge 1, 1, 1, 1 and 1 and then 3, 3, 3, 3, 3 so for half of the ones the challenge will be 1 for the other half it will be 3 so when the challenge is 1 the answer is from the vector a1 so the vector a1 is alpha beta so for the first half you will answer with a bit of alpha beta so the first half of alpha beta it's alpha you will give to the adversary the vector alpha then for the other half the challenge is 3 when the challenge is 3 you answer with a1 so a2 so x so a1 is this a2 is this so a1 and so a2 so x that's only the right path you will answer by gx of alpha so x so you answer with gx of alpha so x that's only what is satisfied in this relation so if you do it like this the response will form a vector alpha t which satisfies the predicate so if you run the protocol with this set of challenge you learn one trapdoor so you can run again the protocol using this trapdoor you select n equal to this trapdoor and the pover will select a1 and a2 equal to x so it means that the pover will give all the bit of x by answering the challenge so with this you have another attack which is the man in the middle attack against the protocol by programming the PR and now there is no way to change the protocol actually we didn't find any way to change the protocol to make it secure so that we can prove that it's secure based on the PRF assumption so the only way we found to fix this problem is to put some extra assumption together essentially what we want to do what we want to do here so we have this F dependent key but we are using the key somewhere else so if you know the results about homomorphic encryption you know that for doing the bootstrapping technique at some point you need to encrypt a secret key with a public key so you need to you need a crypto system which is secure when you encrypt your secret key yourself so that's exactly the idea that we have here we have a key and we will use the key somewhere else so we need some extra notion so for homomorphic encryption it's called a circular security for the encryption and here is a similar notion that we need which is the notion of circular key security for a PRF so now we need some extra assumption to this circular key security circular key security means that if you have an oracle such that you can select the input of the PRF and you can select a linear combination of this PRF and a vector x prime by playing with this oracle you cannot distinguish if x prime is equal to x or if x prime is completely independent from x that's the notion of circular key security if you cannot distinguish when x prime is equal to x or x prime is independent in a proof when you write a proof first you have this x and you will change it to another game where you put something independent from x and then you will use the key write assumption to prove the security there is one technical problem here is that if you pick some queries which are all equal to the input of x and if you have some coefficient b with a linear combination which is 0 you have to have a similar combination the a is also 0 you have to enforce this combination to be 0 otherwise you could make the linear combination of these responses and learn some bit of information about x prime and distinguish if x prime is equal to x or x so you have questions that are your queries and with this you have a new notion of security which is used for a key write which is circular key security and we then wonder if it is feasible to construct circular key security because we can easily construct them in the modern rock and roll that's the kind of I need to check on this notion what I forgot to say is that there are many other protocols which have problems with PRF programming these are the protocols that we were able to break using PRF programming and we were able to instantiate the PRF by making this protocol with the consensus protocol by pure force, extreme gas power connected and protocol by I want to check at them and also the Swiss knife protocol that I mentioned before so now we have a protocol in which we assume that f is a PRF with a circular key security there is still something that we didn't consider is the presence of noise so remember that when you send a challenge you don't have any time to waste you need to answer immediately so you have no time to do computation and you're sending just a single bit with very big power so even through this there will be noise so some rounds will fail so some rounds will be incorrect so you have to tolerate the noise so since the probability some error in one round will be a constant the number of rounds which will fail will be linear eventually so you have a linear number failure so you need to tolerate some errors so what you will require now is that there are at least a number of correct rounds in this protocol to make the verifier happy about the truth so if we do that we may think that it doesn't have an impact of security but actually it has there is something which has been overlooked by many people to come to this protocol which has been published very recently it was in December last year it was a problem identified by Hank which says ok so now if you don't need to pass all the rounds so it means that you can make a very interesting terrorist vote now you have this malicious pover his friend adversary here what they can do is that they can collaborate for the initialization phase but at the end of the initialization phase the malicious pover will compute the response function so for this protocol the response function is defined here and it will set the table of this response function for exactly tau rounds so you give tau response function to the adversary so the adversary will be able to use this table to response correctly to tau rounds all the other rounds will be answered at wrong time and it doesn't matter because the verifier only need tau correct rounds with this response function of course it will leak some bits of the secret but it will leak only tau bits of the secret so if you make sure that you are leaking the tau same bits for every terrorist vote then you don't reveal all the other n minus tau bits and since it's a linear number of bits which remains it still it requires exponential time to reconstruct the secret so it doesn't leak the secret it leaks one bit one part of the secret but not all the bits and still takes exponential time to fully reconstruct the secret so you have here terrorist vote which which is based on the theory I want to know so now we have a problem to fix this because there is actually no easy way if you want to have this kind of protocol so now we will move on to a protocol that we designed to resist to all this kind of force that we call the ski protocol so why the ski protocol I wonder what is this acronym so we have found the Synergy infrastructure as an existing acronym we have found the Sheffield Kidney Institute so I found a series here of ski protocol so we are looking at this actually the acronym comes from the name of the author I work on this with my friends Katerina and you and we just get the first letter of the first name to make this acronym so what is this ski protocol looking like so it's very similar to what we presented except that now instead of showing to X here in this third possible challenge we show the information about X which comes from the leakage scheme so we have a leakage scheme l mu X which will leak some information about X so the idea here is that the verifier will choose what is the leakage function that he wants to have in the case there is a terrorist code and this l mu of X is defined here so essentially this l mu of X will have all the bits X prime equal all equal to the dot product between mu this vector mu and X so it means that now if you try to do a terrorist code like before you will reveal tau bits and these tau bits will all be equal to mu dot X so it means that you reveal one bit of information about X but this bit is chosen by the verifier so if in one execution of mu in the other execution you will find that you will select another mu and after a few trials you will reconstruct X completely that's what we have found to fix this protocol so for the completeness so if we define a function B like this so if we assume that everybody is honest if it doesn't work study the completeness if we assume that the probability that one round is incorrect is equal to this P noise constant then the probability to pass the protocol is equal to this quantity so if we apply the channel bound so we just take tau over L less than 1 minus P noise with some gap and with tau over L not too large then we are ensured to pass the protocol except with the probability that we have an exponential minus 2L squared M so we have to select tau not too large and if tau is not too large then we have completeness of the protocol that's for completeness now we can wonder what are the best attack we can find so here is the best distance that we can find against this protocol actually it's not only the best that we have found it shows that it's the best so this attack has the best probability of success that we can have against this protocol so in this attack so the prove the malicious prove just follows the protocol except that here so he has to send a response before he sees the challenge so he selects the response by taking one response with the largest pre-made by the response function so to maximize his chance to be correct he doesn't know the challenge just select the R the response which has the largest pre-made by this response function so we can show that the probability that one round is correct is 3 over 4 so if the probability we correct is 3 over 4 then the probability of success of the entire attack depending on tau is this quantity so we can again apply the channel bound and now we have to select tau large enough that the probability of success of this attack is negligible so now we have to select tau over n larger than 3 over 4 plus some tips here so tau over n needs to be larger than 3 over 4 it needs to be less than 1 minus p noise so that we have the two protocols so the best distance prove that we have the best mafia prove that we have is this one in this attack you have the address 3 in the middle who just relay the messages and then it does a protocol with a prove which is far away so that you will learn one response for everyone after you learn one response for everyone then you can start the distance bounding phase with a verifier so if you select the same challenge as the one that is sent to the proveer then he's happy, knows how to answer otherwise he just answers after another and with this attack we can show that one round will be correct it's quantity 2 over 3 so we can review the same computation and what we deduce is that tau over n needs to be larger than 2 over 3 so that the probability of success of this attack so that the best mafia prove that we have again the protocol and the last there is food that we have is this one so that's the best probability of success that we can have so you have a malicious proveer when he spread the address 3 so they just collaborate for the initialization phase and at the end of the initialization phase the malicious proveer will send a table of response function but this table of responses is correctly the answer is that they select some challenges and he sends the table except that for these particular challenges he puts something which is random so instead of putting for sure the correct answer he puts something which is random sometimes it's a correct answer sometimes it's not so he sends this table to the adversary and the adversary will use it to response so it's easy to show that it doesn't reveal the secret because there is one challenge which is one response in the table which is always one doubt it doesn't reveal the secret but here's the probability to pass a protocol we can show that it's 5 or 6 if it's 5 or 6 send by a kind of channel bound we obtain that tau over 10 must be greater than 5 or 6 plus some hexagons so to summarize if the noise is less than 1 over 6 minus 0.7 then we have completeness we have resistence with failure probability bounded by some this exponential but we need this condition so if the noise has a probability less than 1 over 6 then we can tune tau correctly we have completeness and resistance to all these actually these are not only the best that we found but we can also prove it we can prove that these are the best attacks so we are convinced that our proof is correct so if the proof is correct then we have that if we have f is a circular key in secret prf and we have we require tau correct rounds then there is no distance fault which can succeed with probability greater than this there is no mechanism in the attack which can succeed with probability greater than this and if you have a collusion fault such as the collusion fault succeeds with probability greater than this for anybody to see here then we can use the view of the adversary to run a management attack which will run which will succeed with that probability and it corresponds to the values that we have here so it means that if key noise is less than 1 over 6 you can tune tau such that all these probabilities are okay so that's maybe the first distance running protocol so we have probability against all these strike models another question is can we optimize this protocol can we do something more efficient can we minimize 10 for instance corresponding to some security can we adjust tau correctly so what happens if we have probability of noise which is greater than 1 over 6 then we don't know how to solve we don't have any protocol which can generate a noise with probability greater than 1 over 6 so that's actually the first step to make a security so that in conclusion we have seen that there are several protocols which are insecure in the literature and even so many security rules which are incorrect but now we have a protocol for which we can put the security and now we wonder thank you very much it's time for questions and comments are there any comments or questions from the circular security of BRF you assume that in general can you construct it from standard BRF no actually I don't know how to construct in the slum model so I presume that it may even prove some separation but that's a in fact this random all of the sanity check as it goes through to the generic model as well I didn't change I have a question is the scheme protocol or any in your presentation adopted in the real world by the so actually I don't know about existing distance-bound protocols I've heard that some distance-bound protocols it's a my fair count I don't know about it but I presume that sooner or later we have distance-bound protocols in real world it seems the presented protocols are very lightweight in terms of hardware implementation is my guess correct so here essentially we don't have so much to do in this product world what we have to do is some XOR some evolution of the PRF it's something completely linear and for the time 21 phase so if we want to compute our lines and we just have to read one bit or to compute XOR with 3 bits that I presume that the best way is just to prepare for the response to start in the memory just to read the memory so we just have 3 bits to start to prepare for the work and how large is N so how many times do you have to repeat in the distance-bound phase so N will depend on the security level so it can be maybe 80 does it take in the distance-bound phase so I don't know about practical use I presume that here if you are closing off with the speed of light being very fast then you need just 80 iterations very fast thank you very much any comments or questions just one small question is it published anywhere? the ski protocol or not yet? maybe you said it not yet and is it possible to do something I know it's FSC but is it possible to do something analog in the public key model? yes actually the Bronson shop protocol is in the public key model but it doesn't resist to terrorist fraud there is also another paper by some people in Bronson who has a protocol based on public key techniques but there is also a problem with terrorist fraud it doesn't resist to terrorist fraud but it's still open so you can find a protocol based on public key techniques which resist to these fraud models thanks thank you very much thank you very much you're welcome