This is Mary and Tinsley, a math professor and clergyman, who also happened to be the greatest checkers player of all time. There was a stretch in his tournament career, where he played 501 games of checkers and lost one of them. A single loss in two decades. The man was basically unbeatable at this good old board game. Even the first checkers AI never beat him in a match. And I find it intriguing to learn about people like this, who randomly stumble upon their perfect niche and become a genius. Not in particle physics or something, but in a board game. This video is not about Tinsley though. His story is fascinating, but if you want to find more about that, check out this fascinating book by the researcher who developed the AI that was on the brink of beating Tinsley just before Tinsley's unfortunate and untimely passing. Instead, I want to tell you about the Mary and Tinsley of the board game that I happen to play competitively. I don't have a clue about checkers, but I know a lot about scrabble and the gentleman with the affectionate smile over here is of course, Nigel Richards, known for winning the French scrabble championships without actually speaking any French. And chances are you've actually heard of that somewhere before, because this story gained so much traction outside of our little niche of scrabble enthusiasts, but the reason you should still keep watching, even if you've heard about this and read about this before, is that the reporting on this guy actually undersells what a crazy story this really is. Man eats dictionary and proceeds to beat everybody at scrabble is typically the gist of it, and while that is bizarre enough, it honestly leaves out the most interesting parts. Now there are some fantastic videos on Nigel by world-class scrabble player Will Anderson, which you might have seen, but they focus on specific games or moves. What I'd like to do is talk more about the background and the context to tournament scrabble, so that you can really appreciate what Nigel has accomplished in this game, because the more you know about this, the more jaw-dropping it gets. So please bear with my German accent for a while and let's jump into the rabbit hole of competitive scrabble. So Nigel was born in a country that is probably not on the radar of many people when they think about French scrabble, not that they would do that very often. He's from New Zealand, and you know, from looking at him, you do wonder why they didn't cast him as Gandalf when they made those movies over there. Or as a French player put it, he could well be part of a quiz hipster or serial killer. Anyway, we're not here to mock the guy. The first thing that we need to establish for our story is that Nigel wasn't exactly a new name in scrabble when he won in French. This didn't come from nowhere. He'd long established himself as the greatest scrabble player of all time in English, which is, of course, by far the most widespread version of this game, which can be played in any language in principle. When you look at Nigel's game stats, though, they look far less lopsided than Thinsley's. He loses about one in four tournament games, not one in five hundred. But of course, there's a simple reason for that. Unlike checkers, scrabble as a game has a large luck component. You can draw lousy combinations of tiles from the back or great combinations, and you have virtually no control over that. So winning 75 percent of your tournament games in a game like that is quite remarkable. And of course, over the 20 or so rounds that make up a tournament, luck will more or less start to even out with the result that Nigel has finished every single world ranking tournament that he's played. And he's played more than 150 of them with a positive or even record. He's never had a negative record at the end of such a tournament. As of the time of this video, he's also in a streak of 28 top three tournament finishes in a row. So basically when Nigel has bad luck in a tournament, he gets third place instead of first. And when he has all the good luck, the result can be something like this, winning an elite tournament with 10 wins over second place. And of course, you know, the guy is a five time world champion in English, nobody else has even won more than once so far. So it makes sense that Nigel might have been looking for a new challenge. And he stated that this was his motivation. He likes trying new things. And so he decided that he was going to feast on the world elite of players in a different language. And of course, the first step to doing that is to learn the words in that language. So how on earth do you learn a dictionary? Well, I can tell you how a normal person learns a dictionary or at least a normal Scrabble player. There might not be that much overlap to a normal person, but Nigel obviously isn't the first player to realize that to get better at Scrabble, you should memorize as many words as you can. Because in a way, that's the equivalent of just reading the rules. The words are in effect nothing but an extremely long list of legal moves in this game. And so a word list is nothing but the world's longest game manual. So why don't we just all read that manual? Because it wouldn't work. That's the first thing that to me is missing from media reports on Nigel. They often make it sound like it just talks to someone who is obsessive enough to do this. But it isn't just a question of putting in the effort. It's also too difficult to do.  Here's a part from the French Scrabble word list. What do you even do with that? If you simply read through that list, there's no way you will still know all of these words in a few weeks from now and probably even in a few minutes, even if we just pick out one word like Ebutere. How will you make sure that this word is still there in like 15 minutes or 15 days and in 15 weeks?  You need to do this 500 times over to get through the entire list. And the fact that we can't just do that checks out with what research has found about human memory in general. One of the major lessons from psychology in that regard is that in order to remember something, humans need context. Every Scrabble player knows the phenomenon where there's actually one surefire way of remembering a word and that is having somewhat played against you as a crucial winning move. You'll never forget that word. It now has a vivid context to it. So people use all kinds of tricks to give the words context. And most players use one particular method for this, namely, alphagrams. An alphagram is just the alphabetical version of a word. For example, A-G-I-L-N-P-Y is the alphagram of the word playing. And A-E-I-L-N-O-S is the alphagram of a word that you probably don't know, but that gets played in Scrabble a lot and is so. This is a combination of letters with a relatively high probability of showing up in the game. And so you would like to know this word, which you don't know from everyday language. So you quiz yourself repeatedly on the alphagram, A-E-I-L-N-O-S, until you have that association in your brain. And then while playing the game, you will always put the letters you draw on your rack in alphabetical order, so that if you draw these particular tiles, you get the exact same prompt that you saw when studying the words. And that hopefully evokes that association. Hey, there's a word in there that are studied. That process doesn't happen half as effectively when you just read a list of words.  Just like you would when learning the vocabulary in a new language. So doing this for the entire dictionary takes years of study, and you really have to enjoy the process to do it or be extremely driven by competitiveness, I guess. But a few people have taken this all the way and learned the entire list of allowable words in English-language scribble at least to eight or nine letters up in length, some even beyond that, but longer words hardly ever come up in the game, although we will get back to that later. And I wanted to emphasize that this takes years because it really puts into perspective what Nigel did, which is to learn the entire French dictionary in nine weeks, not years, not months, weeks. The crazy aspect here really isn't that he was studying a language that he didn't speak. He's not the first to do that. Players from Thailand, for example, have had great success in scribble tournaments, including some world championship titles, with some of them barely being able to communicate in English, it's a foreign language to them. And if you think about it, even native speakers are basically studying a foreign language when they go through the English language, scribble dictionary, I mean, just look at this board from a world championship game that is hardly more intelligible to you than a French game, right? What's crazy is that Nigel does this so much faster than us without even using the tricks we use because he doesn't use alphagrams. He reportedly read the list up to 11 letters twice. He also reportedly goes through these lists in his mind while going on long bike rides. And that's it. That's apparently all there is to it. And honestly, nobody knows how this is possible. So if you were looking for an explanation in this video, I have to disappoint you. Now, maybe you might be thinking, well, he's got a photographic memory, but all that really gives us is a label, not an explanation, because nobody truly knows how photographic memory works. There are some indications about which brain areas might be implicated in it, but we don't have a clear understanding of the processes. And you might even read that literal photographic memory is regarded as a bit of a myth by many researchers in psychology. There are a lot of similar cases, though, outside of scribble, including the artist Steven Wiltshire, who can draw cities after seeing them in flight. And every single window is in the correct spot here. I've been to this place numerous times. This is Cologne in Germany, but I would have no chance of drawing this even remotely closely for memory. This is basically a photograph for memory. And there has been an NBA player who was capable of memorizing pages in a phone book, which is so impossible to do for a normal person that the famous computer scientist, Douglas Hofstadter, cited this as an example of a story that you can dismiss without any further research, just because common sense makes it clear that it cannot be true. But it is true. He's proven this in public and there are lots of other similar cases. I would say the same as Hofstadter about memorizing a dictionary. It's not humanly possible to do perfectly, but it's a simple fact that Nigel has done this and he can't tell us how that is possible for him. But maybe that shouldn't really surprise us because there are so many things that everyone does in a subconscious and implicit way. Like imagine you were on an alien planet where bicycles don't exist. You wouldn't be able to tell the mind blown aliens what exactly you're doing to balance on that thing. It's just possible and effortless to you. It would look impossible to them. And maybe it's the same from Nigel's perspective. Maybe it's strange to him that we can't all do this. In any case, it's understandable how some of the French expert players reacted to this. Some of them were hesitant to believe that he should really have learned their entire language in like two months. And so when Nigel actually showed up at the World Championships in Belgium, some of them tried to trick him and played fake French words in their games against him. Now that might sound a bit unfair to you, maybe, but it's a perfectly legit strategy that is part of tournament scrabble in any language, actually.  So it wasn't dirty or anything of them to try this, but it didn't work. Nigel knew the word list with such certainty that when he didn't recognize the word, he knew it couldn't be in the list. And we should take a moment here to discuss what it means to know the entire word list, because people are sometimes confused that the headline suggested Nigel won without speaking any French because, you know, he knows more French than literally any French person. How can we say he doesn't speak French? Someone was even so adamant about this that they made this hilarious edit to Nigel's Wikipedia page to make sure that everyone was aware of this point. But this person is wrong. This edit didn't survive very long. Nigel doesn't speak French because he didn't learn the meaning of the words. He only memorized them as valid letter strings to use in this game. He read the manual. And this is the ultimate proof, by the way, for something that most expert scrabble players will tell you, we're not really playing a language game. Scrabble is a language game on the surface, of course, and almost all scrabble players are very interested in language. But when it comes to winning your games, you need different skills. You need pattern recognition, numerical skills and intuition of probability. And accordingly, the top players are often computer scientists or statisticians like myself or architects, because you're not trying to write poetry on the board, right? But what is an Earl King? And has it ever prang to blell him? Who cares? Scrabble players don't care about definitions. They just care that they're words. Nigel even got into scrabble because his mother wanted to find a board game where she could finally beat him for once. And the guy who would go on to become the greatest scrabble player of all time was so bad with words that she hoped to beat him in scrabble. I'm not making that up, although we do have to trust one newspaper article on this story. I don't really know if it's true. So apart from the basics like Bonjour, Merci, Voulez vous coucher avec moi and so on. Nigel can't use French to communicate. As far as I know, maybe he's learned it a bit by now. There's one other funny exception to this. He needed to announce the score of his moves in French because the rules said so. And so at the French World Championship, Nigel made it to the final where he played Chélique Ilagouris Kavé from Gabon, one of the many French-speaking countries in Africa. French scrabble is very much a worldwide affair. Here's the deciding game of those finals. Look at this. The noble language of French in all its beauty and the twist at the end of this game is another fake French word by Chélique who tries playing Fanatida when the actual French word is Fanatisa. Since it's the end of the game and Chélique doesn't have a legit way to win anymore, this makes sense as a Hail Mary, but Nigel wasn't having any of it. He challenged the word off and goes on to win the title with Chélique showing some nice sense of humor, playing Fini on the next turn, literally ending the game. So Nigel wins. Nigel goes to the prize ceremony and at that prize ceremony needs someone to translate for him as if people needed any further demonstration that he literally doesn't speak their language. And the ensuing Q&A is so great in showing what different worlds are colliding here. Question.  Nigel, of course not. These are some excellent players. Question. So how long have you been studying the words? Nigel, since the end of May, so that makes it about two months and you have to imagine that the guy reporting on this interview is a tournament player himself who like all the players has been trying for years to painstakingly drill tens of thousands of words into his head and he finds a convincing way to express his sheer disbelief by means of orthography. Last question. Do you have any particular method of learning the words and the subtext of this question is loud and clear. If you do, please tell us the secret. Nigel, no? Well, merci beaucoup for this enlightening interview, Monsieur Géchard. But as the French would say, c'est la vie. So this victory came as a shock even to most people in the scrabble scene, even though we already knew what Nigel was capable of. But you know who wasn't impressed? The Icelandic Scrabble Federation, they pointed out that French really is for beginners. Icelandic grammar is so complex that their word list includes two million words. But unfortunately, Nigel politely declined to take them up on that challenge. So that's the story of how Nigel won his first French championships. But you might notice that there's still a lot of video left here. So what's still to come? Well, the second and third part of Nigel's genius. And the second part comes to you as a puzzle. Can you solve this scrabble position? What's the highest scoring move available with the letters you see at the bottom? What a question mark denotes a blank that can stand for any letter? Feel free to pause the video and look for it, because the point here is that the word we're looking for is pretty common English. You most likely know it, but do you see it? Here it is.  Nigel played this in a tournament game. If you saw this move as well, please sign up for the next scrabble championship near you. I hope this makes it clear that knowing a word and untangling it on the board are two very different tasks. So let's make the next puzzle a bit easier. What is the everyday word that you can play here as a bingo? Might still be a difficult task if you're not used to playing scrabble a lot. But for tournament players, this is a routine play with no vowels on your rack. The E on the board jumps out to you as the letter to play through and that gives us the word children. It doesn't take a world champion to find that, but there's a catch. It isn't the best move. There's another bingo and it is this absurdity of a scrabble move. They are lists of word frequencies in scrabble games generated from millions of rounds of computer programs playing against themselves. You know how often the word chlorodyne shows up in that data set of millions of games, not even once. You can play scrabble millions of times and you never need this word. And I couldn't quite verify the following. Maybe somebody can help me out in the comments. But the story goes that at the time when this game took place, 1998, scrabble word lists only went up to nine letters in length. Nobody had even bothered to compile the longer words, let alone learn them. That's how unlikely they are to be useful in the game. The only one who cared was our friend from New Zealand who had read the literal dictionary rather than a word list and remembered this one obscure entry in a situation where he has an obvious fine move. I want to be clear, though, that Nigel is not the only player to find spectacular moves in general. Not at all, actually. There are tons of fantastic moves by many other players. Here are some nice examples. But for one thing, chlorodyne stands out even among those moves. And more importantly, for other players finding such a play once in a blue moon is a highlight. It's the exception, not the rule. For Nigel, this is the rule. He keeps finding these plays when they're available. They're not available very often. But if they are, he just spots them every time. The longer you watch his games, the more you start to wonder, wait, does this guy ever miss anything? I'm hesitant to claim that he really never does. But I also had a hard time finding evidence to the contrary. This is the one example that I could find of Nigel just straight up missing a bingo. But this relies on a game protocol by a third person. And it almost seems like the likelihood option that he actually didn't have these exact letters and that this was misrecorded. I couldn't find any other misses. I'm sure there must have been more glitches in the Nigel matrix. Please leave a comment if you know of any. Weirdly enough, occasionally Nigel does make mistakes, but of a very technical and basic kind, like accidentally putting the tiles down in the wrong order, misspelling a word like hair nets as higher nets, which amazingly stayed on the board. But beyond these basic mistakes that almost seem like hardware bugs, they appear to be no genuine mistakes in Nigel's games as far as word finding is concerned. So why is this so remarkable?  But I want to emphasize this. It's completely out of reach for anyone else. Scrabble as a game is deceptively simple because the task is easily defined, combine your letters and those on the board in the optimal way. But the permutations between all the words in the dictionary, the combination of letters on your rack and the spots on the board are so vast that there's just no chance of always spotting every possibility, especially under time pressure in the tournament. You can get to 90%, 95% if you are an elite world class player, but not to 100%. The brain will automatically simplify such a complex situation just out of sheer necessity and no matter how hard you try, you'll always have blind spots, typically because the move is counterintuitive. It's not obvious, it has an unusual pattern. For example, every top player knows the word that is the best play here. It's a very strange word, but Scrabble experts would know it because they study the Q words. But finding it in this situation is another matter because playing a word through two letters and sticking the Q at the end is a very rare pattern and you might easily miss this. This is of course a move by Nigel. I don't know which other players would have found it, but I'm sure that they wouldn't find it with a 100% success rate. Similarly, there's an obvious bingo in this situation, obvious to top players, which further more easily wins you the game here. So you don't even have to find the perfect move.  Again, top players will usually find this, but it's impossible to have a perfect success rate for moves like this. Every other player right up to the second best player in the world has to accept as a simple fact of life that this is impossible and it's inexplicable how one guy can just break that rule. By the way, if you're wondering who is the second best player in the world after Nigel, that is a very interesting conversation because there are a lot of candidates you could you can see in that spot. It might well be David Elder from Australia and look at what he said about Nigel that should tell you all about the status that Nigel has in this community. And this play-finding skill is why it's a bit regrettable that the media articles on Nigel mostly don't go beyond look at this guy. He read the dictionary because as crazy as that already sounds, it isn't even the hardest part. And ironically, Nigel seems to think that it's the easier part because in the one interview snippet that you'll find of him on YouTube, he says that his success really is only matter of learning the words. And that's so funny to me because he's basically contradicting what I'm trying to tell you here. So you just have to believe me that for anyone else that's just not how it works. Anyway, this brings us to the punchline to all of that, which is Nigel's other French world championship. It isn't often mentioned in the media reports, but he actually won two different titles. This is because the French like to do things their own way. And what we know as Scrabble is a bit of a variant in French tournament. They call our game classic and only started holding world championships in it in 2006. But since the 70s, they've been battling it out in duplicate. This game, duplicate, works by giving each player their own board and the same seven letters to start the game. And now the goal of the game is simply to find the highest scoring move with these letters, which might sound like the same thing that you're trying to do in regular Scrabble, but it's not because in Scrabble, you will very often routinely sacrifice some points for strategic reasons like you wouldn't play the blank tile for just two additional points. You would keep it to wait for a better opportunity because it's so valuable. In duplicate points really are all that matters. So everyone starts with the same tiles, writes down the highest scoring move they can find. And then everyone is told the optimal solution and puts that on their board, regardless of whether they found it, so that the game stays identical for everyone. And at the end of the game, you can simply compare which player missed the fewest points compared to the perfect solutions overall. Or as the French put it, who has the smallest croissant? Of course, they call it that. All of this means, of course, that the luck factor is completely eliminated and knowing and spotting words is all that matters. So you can guess what happened when Nigel joined this competition. Well, this happened. He had some trouble in the beginning, but most of the points that he missed there came from technicalities in writing down his moves. He made some formal mistakes there and they are very strict about that. Look at Sir Secoop, that's the best in the world, Nigel Vichon. But since he got a hang of that, what you see denoted here by the word top means that in each of these competitions, Nigel didn't miss a single point on any move. And every competition consists of several games. So all in all, these are several hundreds of moves in a row where Nigel literally played like a computer. In French, just in case you forgot. This needless to say and at the risk of repeating myself is so difficult that nobody else can do it and not for lack of trying. Duplicate, like I said, is the more popular variant in French Scrabble. Their world ranking includes more than 15,000 players which is kind of wild. And in previous championships, one of them had done the impossible before and won the tournament with the perfect score, once. And then here comes some bloke from New Zealand who can't even order croissant without butchering the pronunciation. We can get some frappuccinos or some cappuccinos or a croissant. And he just does this every year like it's nothing. It's understandable that not everybody liked that. Some players have argued that Nigel shouldn't play in these tournaments because that just takes away the competition. It's like playing against a computer and there's nothing to play for. Of course, some also suspected him of cheating which, just to be clear, is not what's happening here. There's zero evidence of cheating. But to their credit, most of the French players seem to take it in good spirits. They just play as well as they can and let Nigel be Nigel. I studied all by heart in two months, I heard you say. So it's a little surprising. It's an extraterrestrial. So here's one of the duplicate moves that Nigel played and I want to give you this one as a puzzle because while most of you surely don't speak French, you should all be able to find the solution in theory. Can you? Feel free to pause the video. The solution is the nice word of e buterre which is the word that we highlighted earlier. And I sneakily asked you whether you'll still know it in 15 minutes. Well, here we are. And correct me if I'm wrong but I don't think many of you were sitting there just now and were like, ben oui, à très simple, e buterre. And neither were the French expert players because this move, being a nine letter word and difficult to spot, was missed by 90% of the players who played in this tournament. That's how difficult it is. In this situation, similarly, Nigel was one of only a few players to find Ombrecha, another nine letter word. And in this situation from a blitz game where you have less than a minute to spot the highest going move, Nigel was one of only eight players to find this move with a bunch of overlaps. One of their players put it like this. We knew he was a monster. We just didn't know he was a computer. But as you can still tell from the video timeline, there's yet one more level of genius to unpack. And that level is strategy because after all, we're not usually playing duplicate. We're not just looking for the highest scoring move. A killer move like Chlorodyne is of course best just because it scores by far the most points. But a lot of the time the equation isn't simply score as many points as you can to win. Your candidate moves usually all scores similarly well and you need to figure out which of them gives you the best chance of winning the game in the end. And this is a surprisingly tricky and obscure question to solve. Marion Tinsley, the checkers champion, once said that chess is like looking out over a vast open ocean. Checkers is like looking into a bottomless well. Scrabble is also a bottomless well and it's in fact so complex that it remains an unsolved game, which might surprise some of you. Scrabble AI exists and is very strong. Wackel is the state of the art AI at the moment and it can evaluate most situations very accurately and is used by virtually all top players to improve their game. But there is still a lot of improvement possible. A lot of intricacies in the game that AI hasn't figured out yet. But there's one exception to this, the end game in the Scrabble game. Both players have their last tiles. There aren't any left in the back and this allows both players to figure out which letters their opponent must be holding because if the queue hasn't been played yet and this is not on your rack and the back is empty, it must be on your opponent's rack, right? So all of a sudden Scrabble turns into a game with perfect information and in theory, you can now go through every possible sequence of moves between the two players to figure out the optimal course of action. In practice, it is usually not feasible to literally go through everything because even with only a few tiles left to be played, there are often hundreds of possible moves for both sides and the tree of possible sequences becomes humongous. Luckily for human players, you can stick to some basic rules and quickly concentrate on a few candidate plays in order to play a pretty good end game most of the time. But doing it perfectly requires such extensive calculation that even Quackal, the Scrabble engine doesn't even try and uses heuristics for some of the more complex cases. Most of the time, almost all of the time, this will work perfectly, but there can be Scrabble end games where a very sneaky low-scoring move gives you the best course of action and that is so difficult to figure out. But of course, it is possible to program a software that is a truly complete end game solver and then be very patient while it does its job because this can take hours or maybe sometimes even days. And this is what Francis Dijardin and Gilles Blanchet did a while ago. I will surprise that they are French, I don't think so. Francis is an elite tournament player and Gilles is a software engineer as far as I know. The candidate, by the way, Francis Dijardin. They did this fantastic analysis where they took almost 600 of Nigel's English language games, basically all of his games where we have a game protocol and their exhaustive end game solver compared Nigel's moves at the end of the game against the mathematically optimal sequence. And you probably have a vague notion where this is going. So they did found 11 mistakes by Nigel and confirmed that he is in fact human, but only barely really because they also looked at what Quackle would have played, the state of the art Scrabble AI and this engine made 41 mistakes in the same games which also proves in the funniest way possible that Nigel can't be cheating because using an engine would actually make him worse let alone the fact that the engine often wouldn't be able to give a solution in time in the tournament game where you only have a few minutes to figure this out. And of course, Nigel was always playing against someone and we can look at those opponents moves in the same games in the end game phase. And even if we only filter out those players who at some point had been in the top 10 in the world ranking, elite Scrabble players, they didn't make 11 or 41, they made 200 mistakes in half as many games because we filtered the data set. They lost 60 times as many points as Nigel. And look at this line here, when there's only one optimal move in this situation rather than several ones that are equally good, these elite opponents only played a correct move about half of the time because end games are this difficult and Nigel is at 99%. Honestly, I challenge you to find any statistic in any game or sport that is this lopsided between the best player and their very best competition. Maybe Donald Bradman in cricket qualifies. So this is the third time in this video where we have to conclude that it just shouldn't be possible to be this good and yet Nigel somehow does it and he does it intuitively and apparently effortlessly. It just seems to click for him. So let's look at an example. This is my favorite Nigel end game. Nigel is trailing by 67 points here but he has some great tiles left like the Z which scores 10 points on its own and his opponent has FX and V leftover clunky tiles and one of them, the V cannot be played at all on the spot and that allows Nigel to do some end game trickery.  So far this all looks unspectacular. Meanwhile, his opponent does the best he can with the X and DF but now he's stuck on the V and Nigel can play his letters one turn at a time while his opponent is forced to always pass the turn back in return and Nigel uses that to play PI, then play add and then finally plop the Z down for 64 points thanks to two of the most notoriously bizarre scribble words adds with the Z and Z for pizza. I wish that was a joke. Nigel had a 57 point move available from the start. Zadza over here. But this isn't the optimal sequence although it also edges out a win but he wants to find the optimal sequence and that is this funny sequence. But now what if I told you that this was in fact Nigel's worst end game in the entire data set? He technically blundered here because the way he set this up allowed his opponent to interfere because the opponent doesn't need to play the F immediately. He can pass his turn in this spot and then when Nigel tries to do these shenanigans over here, FAD blocks the Z play which is why this is technically a losing sequence. Nigel, what Nigel needed to do was to first block the highest going at X-Bot which is in any case weird that he didn't do this and then play the same setup with the S in this spot rather than taking it at the end of this word as he did earlier. Like this, the F can't be used to block the setup. So just to recap, Nigel found this exotic sequence that most players wouldn't spot in the first place. He just missed the subtle way his opponent could in principle have prevented the sequence and that's the worst move Nigel has ever played in an end game that we know of. That tells you all you need to know. So much for end games, the perfect information part of Scrabble, the chess part of Scrabble, the rest of the Scrabble game which of course makes up the lion's share of gameplay is a different beast because you obviously don't know the tiles your opponent is holding and you don't know what you're going to draw from the back next. So it's a game with imperfect information meaning that the best move is not deterministic in nature but probabilistic. The optimal strategy in a game like that means playing in a way that has no systematic flaws that an opponent could exploit. The strategy will not always work but it has the best chance of working. In that sense, even games like Scrabble can become a solved game in a broad sense of the word. As you might know, some variants of poker, the game with imperfect information have for all intents and purposes been solved but Scrabble remains unsolved as of today meaning that we can't judge Nigel's or anyone's gameplay with mathematical certainty but unsurprisingly for all we know Nigel is as close to playing optimally as anyone. This is what strategy expert Kenji Matsumoto says about Nigel and it's telling that when a game is commentated live and the computer analysis and Nigel's move disagree commentators usually look for reasons why the computer isn't playing the Nigel move rather than the other way around. Not all top players would agree many would be of the opinion that you need to question Nigel's moves as well that you don't need to blindly follow his strategy and there are examples of moves played by Nigel that are generally seen as highly dubious and that the AI also judges as mistakes but overall Nigel is seen as the player to learn from in terms of strategy. And to me, this is where it really gets interesting because knowing the dictionary by heart and having computer like board vision is extremely impressive but it's also robotic in a way it feels a bit like you're up against the board but strategy brings an aspect of style and creativity in the equation and to me the way Nigel plays strategically and tactically is so stylish, it's so elegant and I've learned so much from it for my own games it's like watching Leo Nemesi or Wayne Gretzky the best players who often make the difficult things look really simple. It's also reminiscent of the style of play we've seen in games that have been mastered by AI. Alpha zero in chess, Alpha go and go have through neural nets, learned the optimal strategy for those games and turned out to play in a pretty unique creative way that often goes against the intuition of top human players and I find it really telling that Nigel's way of playing Scrabble is often described in similar fashion. He plays unorthodox moves, counterintuitive moves moves that require you to think outside the box and not follow conventional strategy too blindly. Many people say that he plays moves that nobody else can understand that are just mysterious. I don't agree, I think the top players it's often pretty straightforward what he does it's just that he does it in a very unusual way or in a way that other people wouldn't think about. I'd like to show you three examples and the lesson from them is similar to what I said earlier about spotting moves on the board. Nigel isn't doing some 200 IQ level stuff that nobody else could understand. The difference again lies in something like open-mindedness and alertness to the possibilities that are available in the situation. In every game situation, expert players will immediately notice a bunch of candid moves. They know pretty quickly what they want to do in the position and principle and then they narrow it down to the moves that achieves their goals in the best way. And this immediate simplification of the situation is an automatic thing. It's how the brain works in any domain where you have a lot of experience and that is complex. It's difficult to prevent, but it can result in missing a weird outside the box idea that happens to be the best way to go in this specific situation. In psychology and research on creativity, this is called divergent thinking and Nigel is so good at finding these hidden possibilities. Here's what I mean. Nigel is trailing here late in the game and he has the Q, which is the worst letter in the game contrary to what many beginners assume and it's strategy one-on-one here to get rid of the Q and try to get a bingo in the next moves to make up the deficit and score. And that's the problem because you've immediately narrowed the problem down to which of the moves that get rid of the Q is the best. In order to do that, you can place some nice Arabic loanwords here, the Arabic words that made it into the English dictionaries really are a godsend for scrabble players because they often use the Q without a U. And the commentators on this game, which was live broadcast, were debating the merits of all of these moves and then Nigel placed this. He's going just 12 points and keeping the Q. Once he played this, the commentators immediately realized what he was doing, which is to try and draw one of the remaining U's. Three are still in the back to hit the word quail up there for 68 points with the Q tripled and the word doubled. And there's a second idea because not only aeroid is valid, so is leroid and Nigel is keeping the L. So he's setting up two different ways. He can profit from this next move. Computer analysis agrees that this is the best move, but it wouldn't have occurred to most players. We wouldn't generate this move because it doesn't follow the pattern of what we usually do in a situation like this. Here's another situation where again, the obvious thing to do jumps out to strong players because they simply have a bunch of bingos that can play here. Again, trailing late in the game and so playing a bingo seems like a good idea, obviously. But Nigel decides that the best way to give himself a chance to win is to play a move for nine points. Why on earth does he do that? Because he realizes that the timing doesn't work. If he plays a bingo now, the temporary lead and score that he gets is an illusion because his opponent will often be able to overtake him again in the resulting end game and edge out a win. His opponent gets to play first in that end game and that can be decisive. We don't need to get into the details here, but Nigel realizes that he has a better shot of actually winning the game in the end if he plays off five of his tiles now so that he leaves just one tile in the back. And after his opponent plays his next move, the opponent will draw that last tile and if Nigel then plays a bingo, that move ends the game and this opponent can't do anything to get back again. The other crucial thing here is that there's enough space left on the board that after Trigo, his opponent can't just block the spaces where Nigel would play bingo. He's got several spaces. Computer analysis again confirms that Trigo has the highest chance of winning. You really have to know what you're doing in order to pull the trigger on such a weird, silly-looking play in a tournament game. And last but not least, here's my favorite Nigel move because here we are in a world championship final and Nigel does something that to me is the equivalent of the famous Panenka penalty in soccer.  Nigel has the X and he's got an obvious simple play of scoring with that X, the French word as it happens of G, which triples the X. But the commentators on the live broadcast here, which of course Nigel couldn't hear, were like, well, we know Nigel like set ups, so what if he doesn't play the X in the world? What if he just plays J-E-U, which is also valid for just 10 points rather than 34, but setting up a potentially huge score on the next move with the dangerous double word, triple letter combination and the letter here would be six tupled or whatever the word is because it counts in both directions. But they immediately dismissed this idea because it's just too crazy even for Nigel. And just as they were getting to that conclusion, Nigel played this move. So this is by far not the first such play of his, he loves set up plays where he creates a hotspot for a letter that he's holding back, but this one is so in your face in this world championship final that it put his opponent into the think tank for like seven minutes or something. And that's part of the strengths of such a move. You force your opponent to react, which you can't do as much in Scrabble as in other games, and you take over the initiative. They were perhaps planning to play a move somewhere else on the board. Now they need to react to this somehow because it's completely obvious what you're doing. And they will sometimes maybe most of the time be able to stop you from catching another setup, but in doing so sacrifice points themselves. And the cases where they cannot stop you are so profitable that Nigel thinks it's worth sacrifice 24 points here. Again, computer analysis agrees, but very few players would have played this move. I almost want to move on without showing you what happened because in theory that doesn't actually matter. We're playing a game of probability and which particular scenario happens to take place in this one instance doesn't tell us much, but I realized that would be a bit cruel. So in this specific case, his opponent did play the best blocking option available to him, but Nigel still got 60 or so points for exact because C-H weirdly enough is a valid word. And Nigel went on to win this game. And if you're wondering about the other examples, after Tri-Go, Nigel did win the game with the bingo. The Aeroid move was less successful as his world-class opponent had an effective way to block and Nigel ended up losing that game. Actually, all of his opponents in these examples were world-class players, but sometimes you just can't do anything. All right, I hope it has become clear why our little bubble of scrabble aficionados views Nigel the way we do. But before we finish this video, it might occur to you that I haven't given you any background on Nigel other than that he's from New Zealand. There's a good reason for that. Nigel is absolutely not interested in public attention. He doesn't give any interviews, like I said, the reason being that he just doesn't like the questions. He has no online presence, he keeps to himself. And even though you can find some information on his biography, if a person is so adamant on privacy, I think we should respect that. But such an in-depth video on this story would simply not be complete if I didn't talk about this guy's personality for a minute because it is an essential part of Nigel's mystique in scrabble. Because for one thing, people who become the very best at some game or sport are often somewhat difficult characters. They might be extremely competitive and driven by ambition. They might be a bit arrogant and look down on the mere mortals, but in a very wholesome way, Nigel is the exact opposite to all of that. By basically all accounts, he's the most down-to-earth guy you could imagine, likes to keep to himself, but is friendly to people, no arrogance whatsoever. And apparently another characteristic of this guy is a great sense of humor. Be honest, would you have guessed from this photo that this is a funny person? Well, he just doesn't like to be photographed, which is why Nigel celebrating a world championship title looks like this. So, as the saying goes, don't judge a walking dictionary by its cover. And then there's the second aspect that needs to be mentioned, which is the approach to the game, the mindset. Because scrabble, like many games, has a mental aspect that really shouldn't be underestimated.  And one challenge in this regard that all tournament players face is the random and unfair way that variance and luck can influence the game. Every scrabble player knows that you just have to accept good and bad luck, but it's easier said than done not to be frustrated when the tileback just won't cooperate with you. Of course, every sane person also knows that winning or losing in a board game doesn't ultimately matter, although admittedly in some cases there can be quite a lot of prize money at stake, but staying perfectly rational and not letting your decision-making be clouded by emotions is a crucial skill in this game. And the top players either bring it as part of their personality or develop it through experience and necessity. But Nigel, as with the other aspects of the game, apparently does this as effortlessly as anything else and often says that he simply doesn't care about winning or losing. He's just there because the game is fun. And if he happens to play so well that he wins the world championship, well, that's just a by-product. Well, congratulations to David Eldar in winning this ridiculous game. David's showing a significant amount of emotion. Nigel's showing exceptional emotion as well, right? Wow. The man is distraught. Now, whenever someone points out how little they care about something, I tend to suspect that they are lying to themselves and they wouldn't need to emphasize this if they really didn't care. But with Nigel, it really seems genuine. He's the perfect impersonation of that Russian hockey player. It's just a game, why you have to be mad? It's only a game. Why you have to be mad? Thank you so much for watching, everyone. If you're still stacking around here, you're probably interested in Scrabble. In that case, check out Will Anderson's videos, which I've linked in the comments. Also, maybe check out the discord of Scrabble players that we have. If you want to get into the game, we're happy to welcome you. It's a fantastic game. It's a wonderful game. It's really fun and you don't have to be slaty but fast, long lost cousin who didn't make it back to Macrothia to enjoy it and to play it well.


As you can see on the screen, set out with a file, so like we decided to split, do the front end web and we have us to like store, queueing implementation together like a playlist that you're watching on the back and but they had to catch a flight in the Narendra like 30 years of what we set out to do and you know it's somewhat what it does is it pulls data from and if you can see and there's a little bit broken and there's no rocket science about this and yes we use jQuery even though it is yesterday but it's so Microsoft staff is fanaticism does not scare me yeah so basically like jitaka something so yeah so yeah Paging is as a limiting of the API that impeded the performance a lot of white goose to Rotten Tomatoes API when you left at four o'clock they will but we had done some app on that, and then he left it for, so, but it was a very nice experience, and at first, I actually submitted something, so, and even though they had very little experience, the Reddit API, we actually used Reddit API, I figured out the, so, I did API, I can't find Reddit API documentation, there is a link, look in the documentation, there is a link to basically presents a console where the links are listed, and the response, and I also, really


Next question is from Eva fit our unilateral movements more beneficial than bilateral movements. Oh nice follow-up question I know right. No, they're just different and they have their own value So bilateral movements allow bilateral means two legs two arms unilateral means one arm one leg at a time Bilateral movements allow you to push more weight generate more, you know central nervous system force You're gonna get you're gonna build bigger gains and strength Unilateral is great for stability. It's good for creating balance preventing imbalances that can develop from bilateral Stay in one for too long and you start to see problems unilateral stuff You're just not gonna build as much strength power and muscle if you only stay there And then bilaterally start to develop imbalances So I'm gonna go out and actually challenge it a little bit saying that I do think that Unilateral movements do have more benefits for something specific like just health and longevity There's no there's no doubt bilateral movements So both feet both arms are gonna build the most amount of muscle which in turn could also burn the most body fat So body so aesthetic goals you got to have both in there And I think that bilateral you cannot negor and neglect But if someone was just I just want to feel good move well be healthy longevity goal There's a lot of value to you know a lot if you were to only do unilateral training And there's some there's a lot of coaches and trainers that that Live by that philosophy, you know what the downside of that is is that you can get a strong Well, no not that not just that but when I train like when you train the average person that's deconditioned Unilateral is a step above bilateral a lot of exercise like I'm gonna take someone's decondition. Maybe they're like 60 I'm there's not I'm not doing very many unilateral exercise because they lack they even lack the stability to do bilateral Well, so to jump them to unilateral especially for lower body exercise. Maybe unless I'm on a machine Is gonna be really hard. So, you know, I would go unilateral But I used to have to start with bilateral especially with older clients It's an interesting argument because I've heard this from strength coaches on both ends of the spectrum Yeah, like a Mike Boyle would will claim it's more beneficial for athletes to train in unilateral Work specifically because it gets the longevity aspect to it But you get strong and stable and in a position that is more translatable Towards what you're doing either on the ice or on the field or you know, you're you're just more You're more apt to be in a split stance or you know out wide or rotating and being able to drive and and get explosive forces and be able to Stabilize in those forces is that the up is almost at a higher priority in his argument Well, and to his argument and he makes a great case on this. I mean Most sports require some sort of running and running is unilateral, right? You know, so it makes sense that and I can get behind that Yeah, but but again the then now to and this is where I'm kind of like in the middle This because then in the other side, it's like all about building that base strength and support, right? So you can generate more force. You can be strong and stable in that force But the the caveat there is that if you get into those split stance and those different types of positions You may not be able to be as familiar with that which means you can't generate the force in those Here's why I'm going to debate him because I respect him, right? He's a good trainer. Here's why I'm going to debate What have we seen with the studies on athletes? When they're young They're better off doing a wide range of sports And then when they get older, it's better to be more specific Now we used to think if you take a little kid and you want them to be a great soccer player Just have them play soccer just specialize the whole time studies now show that the kid who plays soccer basketball football and gymnastics Will be better at soccer later on than the kid that just did soccer because they they built a wider range They can problem solve with their body a lot more effectively. Yes, so it's like again You could be good in one direction so far But then again, there's repetitive stress injuries as well There's you get good at it, but at the same time you don't have the ability to problem solve outside of that Yeah, so if I'm training a younger athlete I'm going to go bilateral general strength and power And then move unilateral as they get older and this is how I used to train athletes anyway When I would train an older athlete it was much more my training was much more specific You know if I'm training a 15 year old Like I'm not doing super specific football resistance training if you play football I'm just going to get you stronger Generally if I'm training a college football player like at this point you're in college You're doing good. You've got the strength now. We got to work on the more specific application Yeah, I think building a base a foundational base of strength and support is is at the utmost importance to then venture out into You know these unilateral positions, which will benefit the whole well I would just say why wouldn't you incorporate both 100 great tools There's no reason to it's such a silly debate to me. Well because that's fitness for you Right. Yeah, this is I mean so we get questions like this. It's always a camp. Which is better one or the other This is I hear this from these coaches say this is better this coaches this but the truth is if the program that beats both of those Is the one that incorporates both. That's why we exist Yeah, I think you if it's for the average person listening and watching right now They both have tremendous value and if you don't incorporate both You're going to miss out on something and that it means you're not going to reach your full potential So it's not a which is better It's a which is better for that for this specific person with this specific goal and what they've been doing You know for the last look at the appropriate tool and apply it. Yeah, because it depends on the person I'll see a person's results and their workouts what they've been doing and who they are and I'll say Unilateral for you and then I'll look at someone else and say bilateral for you So it's the they're all tools you're building a house You got to use a hammer and a screwdriver and you got to use a saw you got to use everything Hey, if you enjoyed that clip You can find the full episode here or you can find other clips over here and be sure to subscribe


So, you're all expecting a talk at the quantum session, but as already announced, this will not have much to do with quantum or post-quantum cryptography, but if you want to be a bit in the stain in that area, I will try to explain what white box crypto is, it's related to secure software, and try to think, because not many people have looked actually into this, how we can turn the post-quantum crypto proposals into white box solutions, and that would be a fantastic research area. All right, so this talk is based on work with Charles Houbin, Will Michiels, and Phil Teube, all at NXP. At the time we worked on this, and currently both Charles and Phil are at Quark's lab, and our paper was already presented this summer at chess. So what is white box crypto? In order to understand this, let me try to give an overview, when we talk about crypto, we often talk about, you need to understand who is the attacker, where is this adversary, is it internal, is it external, when you think of internal, it can be the user, it can be a virus, and what is realistic for your particular use case? So the old way of thinking about this is the black box model, so you assume that the end point are trusted parties, and the attacker observes data being transferred. So this is from the, let me call it the 80s, and then in the 90s, there was this new model, which people refer to as the gray box model, it's related to hardware implementations, and imagine you have a smart card, for instance, with your crypto algorithm running on it, it was shown that if you measure, for instance, the power or other external information, meta information about this implementation, while this running, yeah, you can use this information to extract the private key material used during the execution of this cryptographic algorithm. So then we come to the white box model, which is related to the gray box model, but it's not related to hardware, it's related to software execution. So now, for instance, think about a cryptographic algorithm running on a device you own, but it's implemented in software. So an easy example, for instance, is a mobile device. And again, we assume that the adversary can be the owner of that device, so it can even be the user of the device, and still we want to protect the private key from being extracted, even by the user running this cryptographic implementation. So, and this setting where you want to, among other things, ensure that the cryptographic key cannot be extracted from the software implementation is referred to as the white box attack model. So why are we interested in this white box attack model? Who is actually using this? So this was originally proposed early 2000s in a setting of digital rights management, and think here of streaming content from somewhere, for instance, to your setup box. And then the party who is streaming the movie to you does not want you to have the key which can decode this movie because then you might be able to give this key to a friend and then he can watch this movie as well. And then there was more or less a decade, not too much attention to white box crypto, until a couple years back when it was a renewed interest in this technology really after the introduction of HCE. So HCE stands for host card emulation. And the idea behind this is that it emulates in software your NFC, so near field communication. And the idea is that it replaces the secure element or it emulates the secure element in software. And this is, for instance, in practice used that you can pay with your mobile phone or take a train or any other transit. And in practice, how is this cryptographic key in this implementation then protected? Because why do you want to protect this? If the user would have this cryptographic key it could, for instance, do a rollback attack which means I pay my fare for my train, I extract the key and I just upgrade to any other amount I have or I rollback the data I had and then I have the previous fare and I actually didn't pay at all. And how this is done in practice is with this, then you are in this white box attack model and if you have a cryptographic implementation secure in this model people call this white box implementation. And we see an increasing and increasing demand of this in practice. So in 2014 FISA MasterCard announced their support for host card emulation and in these payment protocols if you implement them in software it is a requirement that you protect it with white box cryptography. And according to the studies we will only see an increase of these HCE solutions in practice and phones and other mobile devices which actually support this technology. So in practice what do they actually protect? It's mainly symmetric crypto so we're talking about AES and triple desk and how these keys are really protected. Already in practice if you have a mobile phone for instance not only payment but also the apps which are allowed to install from your play store or any other app store you have on your phone. It's very likely that this is protected with white box cryptography. So when you think about this how would you actually try and solve this problem? What should we think about? Why do normal security cryptographic implementations in software not work? Because it was already shown actually before the invention or the introduction of white box crypto by Shamir Phansoma that if you just load your crypto key into memory and you would just scan your memory and look at the location with the highest entropy that with very high probability this is the location of your cryptographic key. And then you can just dump it, extract it and then you have extracted the key. Another easy way how to extract the key is with a technique called S-Box Blanking Attack. So you just have your implementation of for instance AES. You just replace the S-Box with all zeros and then that gets xord in and you just the implementation outputs the key. So we need something more advanced. So then of course the question arises is a white box implementation even possible? The answer of course is no because if you want to build an ideal white box AES implementation you could just create one big lookup table for one specific fixed key but this will not be very practical risk. Even modern mobile phones don't have this much storage. In practice what people propose so in the original paper in 2002 by Chao and others and they propose the technique where you replace every algorithmic step in the algorithm in this case of AES with a lookup table and then the goal is that you put you try to obfuscate these lookup tables by putting input and output encodings on calls to this lookup table. So on the right here you see a nice overview how then the flow of the algorithm would look like and then this already gives rise to much smaller implementation but still orders of magnitudes larger than the original AES and their proposed solution was around 700 kilobytes and you actually didn't compute anything here it was just a sequential series of table lookups in the hope where it was fixed for one particular cryptographic key in the hope that the attacker is not able to deduce any information about the key actually used and partially stored in these lookup tables. In practice however so in the remainder of the talk I will be discussing how to extract the private key from a white box implementation but in practice you would use much more than just white box. I just wanted to tell you to give you a bigger overview in practice people apply code obfuscation, anti debugging just to make the life of the hacker more annoying and different platform binding techniques which all serve different purposes. Like I said if you want to have anti rollback protection or something which is called code lifting you want to protect against these types of attacks as well. So code lifting for instance is the simple attack that you don't want to extract the private key but you just copy because it's software you just copy the entire software solution put in another phone for instance and if you run your cryptographic algorithm you essentially have copied the private key because it was embedded in there and you get the same functionality. So if you want to protect against these types of attacks you need other types of counter measures. I will be solely focusing on extracting the private key from the implementation. And last year at your crypt there was a really nice overview talk by Christine Colbert about these other techniques related to obfuscation and how attackers and people who try to protect these things how that works in practice. So it's good to state that all efforts in academia to build white box implementations have been broken. So it's completely unknown how to build a secure white box implementation of for instance AS of all the standardized approaches. But how do these attacks work in practice? So first of all they were very white box specific. So you need to know exactly what approach was being implemented which encodings were put on what tables which Cypher operations were exactly implemented where and in which set of lookup tables. And if you knew this then you could reverse engineer the code because you could assume that they would put some code obfuscation on top of it target the correct lookup table and then apply your algebraic attack and extract the key. So we studied yeah we looked into a way how to make this a bit easier. So I will try and explain briefly how we took the attacks from the grey box model so how people attacked hardware implementations and how that also applied to this setting of white box implementations. And our attack works automatically. It's very simple. So see for instance we had the chess challenge this year so one of the challenges we created and was related to white box implementation and you could try our two tools which we released and see how it actually works in practice. You didn't need any knowledge of how this was implemented in practice. The only thing you need to know is which algorithm is implemented. So you need to know in practice there are only two choices. Is it DES or is it AES? And then you can put as much code obfuscation on top as you want. We don't care. It's just ignored by our attack. So what's the idea? It's about tracing. So tracing binary. So when you look at academic papers and academic approaches they're all nice and they're open designs. You know exactly what's going on. But in practice what our company is doing they don't specify at all their algorithm and you don't get the first code of course although that should be possible in this attack model but in practice you just get a binary blob which you can inspect. And then our initial idea was let's try and collect information using dynamic binary instrumentation tools and for instance the popular tools for this are PIN for the Intel platform or Foggrind which lots of people use for debugging or memory leakage detection but actually it's a much more advanced tool which can do much more things. So we wrote plugins for these tools and we released them as open source which allows you to trace the execution of the trace the software execution and what do I mean with this? It traces all the reads and writes into memory. So all the memory locations or the instruction locations. Then we wrote a visualizer which visualizes these reads and writes and then we're going to use these traces of these so the other memory accesses and try to find correlations the same way as you try to find correlations in the greybox attack model. So yeah we wrote plugins for Intel PIN and for Foggrind and we were especially interested in Foggrind of course because that supports the ARM platform so that means mobile devices. So how does just to give an example how does a visual trace look like? So here you so this was inspired by a tool as Quark's lab so the time is on the y-axis from top to bottom and on the x-axis you have the whole range of the memory addresses and the different colors is either an access to an instruction memory read write or read and write. So this is a typical picture when you execute a secure software crypto implementation. So why do we want to use this because our attack only needs one piece of information and that is what kind of crypto algorithm is being implemented and like I said in practice that it's either AS or DS so here for instance you see a trace a visualization of a trace of white box implementation and the actual crypto is just the tiny bit on the bottom and large on the right and there you can clearly see nine blocks nine times four blocks so this is a hint that it's probably AS because the 10th round this is slightly different so you see this pattern and then when you have your guess it's AS you can mount an AS specific attack but what if the white box is a bit smarter and it has completely unrolled its algorithm you would just see a straight line like this and of course this will not leak any information then you don't look at the code but you just look at the data so if you just look at the data pattern how it fetches things from RAM you would see one plus 15 nice lookup tables it accesses so that means it's probably DS and then we had another nice example of another white box implementation which had also its memory access pattern sequentialized so then it's really hard to tell what's actually going on but look at the far right that's the stack and it turns out that it's really hard to hide information or access patterns on the stack so if we zoom in on this so this is exactly this green bar on the right if we zoom in you again see a nicely access pattern of one plus 15 so it means that probably the implementation is computing DS okay so once we have decided which algorithm is actually being implemented we could just our idea was let's see if the grey box attacks so attacking a smart card for instance if that works here as well so the naive approach of course would be port your white box implementation to a smart card and measure the power consumption that should theoretically work but this is of course pretty stupid because we have much more in the white box attack model much more powerful attack model and each bit which accesses memory is equally important so the idea is we're going to serialize bits and then you get the equivalent of a hardware power trace which looks like this just values 0 or 1 and it doesn't reveal much it's already visually very hard to identify the multiple rounds in this trace but if you would use auto correlation you would immediately see them but once you realize what you're actually measuring and what you're doing this would be the same as you would in hardware probe the bus so each bit of your bus individually and you would not measure any error so it's an extremely powerful attack and so the hope is of course that you need much fewer traces and it's much easier to extract the secret key compared to the attacks on hardware implementations where there is inherently much more noise and you cannot measure the individual bits that easily so we went online of course and we try to collect white box implementations which were publicly available and we just said let's check if this actually works and to our surprise it actually did work something we did not expect from the beginning so the first implementation online is from Brecht Weisseur he put his white box implementation online in 2007 so it was couple years later already broken by one of these algebraic attacks and after actually finding his implementation back on some internet archive that was most of the work it took only 65 traces and the traces just running the software implementation which takes less than a millisecond and then automatically our tool would just collect this trace serialize it and run a standard DPA attack and the secret key was outputted and similar for the other white box implementation so in practice in the hacker open source community these open source implementations pop up in these capture the flag challenges so at HackOU or SSTIC so the middle two so there we only needed 16 traces but we should say that these were designed to be broken in a day so on these hacker events so they put no encodings on these lookup tables which makes it easier for the algebraic attacks but of course also much much easier to find correlations and then there was a master student clean edge who for his master thesis implemented the most advanced academic white box approach which we then used and created a challenge for ourselves and this was based on the approach by Karomi and it uses these dual ciphers that you can represent AES in different ways and here actually we needed a bit more traces initially 2000 which still is less than a second to collect these traces but in the end after fine-tuning the attack to this implementation it was only a few years ago and of course leads to the question what's the intuition why do these correlation attacks actually work and this was elaborated a bit more on FSC paper last year and yeah the intuition behind this is that the encodings which you put on these lookup tables do not sufficiently hide the correlations when these keys are actually used in the implementation so this of quickly because these white box implementations are deployed and used already in the wild so what about counter measures so the most common counter measure in the hardware community is that you are gonna try and create random masks or random delays you're gonna mask values but we're in the white box attack model so we assume that the user has full control over your platform so if you just query a random number 0 because I you can assume I'm rude for instance on my Android phone and thereby disabling the entropy in your counter measure doesn't work anymore so this approach does not seem to be the right path so what about having some sort of static random data in the white box another counter measure is based on threshold implementations which they use in hardware that seems like an interesting approach to go for here as well there's more on the hacker side of things what about detecting if you run in such a DBI framework detecting if you run within Valgrind or a debugger but it seems like in the hacker community there are lots of papers who introduce new techniques how to detect this and then other techniques how to get around this of course so DCA so this attack is not a holy grill you can use large encodings on these lookup tables because then there's no correlation anymore between then and the output but that means you get larger lookup tables and things actually might become impractical too large and too slow in practice and more over the original algebraic attacks will all still work so after we put this online other people so most notably the people from RISCURE they look at this as well independently and they look more at software fault attacks so the other type of attacks we know from the gray box community and that approach was very successful as well and they showed that if you in this white box attack model you just flip a couple of bits in these lookup tables even if there are encodings on top of them it's similar as a fault attack and you can extract the secret key material as well so we released all our software we used so the visualizer the tracer and the code we created to actually perform a CPA attack or a DPA attack because to our surprise we were not able to find any open source CPA tool together with all the scripts for the implementations I showed earlier which we attacked so people could actually can try and do these attacks themselves so if you feel encouraged please come and help and extend these tools if you know of white box implementations which we could try and test let us know we're always interested in extending our tools and adding more expertise or test counter measures for instance so to conclude it's clear that software only solutions become more and more popular especially in the HCE environment and they rely heavily on white box crypto the attack I quickly described is just the counterpart of the DPA attacks from the hardware community you don't need any expertise it's just a matter of you download the tool and you run it against your white box attack if you know which algorithm is being implemented and this of course raises the question that the level of security and especially maturity of at least all the white box schemes we tested is very questionable we could easily break all of them and this gives rise to a couple of questions so for instance asymmetric crypto there are companies who offer solutions for asymmetric cryptography so think RSA think ECDSH but actually in academia it's a completely open question how to do this so it would be interesting to have if people would start to study this in academia as well because in industry they keep all their designs secret and I think there's a need we need a way to measure the real security level somehow like we do in hardware implementations the security of such software solutions so this is just the beginning I would say so probably we will see much more advanced attacks and countermeasures of course and then attacks on these countermeasures in the near future that leaves us with the final question which I don't know the solution to what is actually the real level of these white box schemes which are applied in these HCE solutions which are currently implemented on our mobile phones thank you we have a minute or two for questions hello you mentioned that your tool can be used in the cases where some additional postcation is applied that was not a bit clear for me so did you test it on some implementations of AES where it's like within a group of I know some garbage code that does nothing or you used only implementations where carefully designed to look up tables and do you think that using sophisticated code where 99% doing some completely unrelated to AES stuff can be countermeasure so yes we did try it on code where code obfuscation or garbling of the code was present so good countermeasure indeed is if you put random delays or random garbage at places because then if you want to try to do the correlation it becomes much more difficult but then it's because it's full control of everything you could just see which steps were not used subsequently and then it would be so we tried this and then it was very easy to write a tool which would just more or less align your traces and remove all the information so that is when you include garbage code but when you do real code obfuscation or transformations on the code that is simply ignored because we just execute the code and look at the addresses being accessed and that's the only thing we need so if there is code obfuscation we simply don't care most of the cryptography that we study at this conference or that we discuss here is either designed to protect and empower the user whitebox cryptography does not do this so if you view it like that how do you evaluate working on whitebox cryptography from a moral standpoint it's a very good question indeed so it does not protect the user it's really protecting the implementation or the entity providing the implementation I don't know morally or philosophically how one should categorize these things it's a good question so in my opinion I think there is a use for whitebox implementations for sure because how else would one try to protect if there is no hardware secure element or something available how would you protect your, how would you want to implement for instance a payment solution in software so there is a need for whitebox crypto there are companies that are doing that by the way there are companies that are selling whitebox crypto to protect credentials and keys for you on your mobile they're crap but they're doing it I was only going to mention that there are other applications here like if you don't have hardware and you want to build an ATM or some other machine where the owner of the machine and really in some sense the user of the machine has a legitimate interest in keeping it secure because you don't want someone to sabotage the ATM and steal all the money out of it but for ATM it's exactly for ATO in most use cases it's often hardware but I agree there are lots and lots of other use cases