Hey folks, welcome to the podcast. So we're doing a special series of podcasts which I'm recording over Google Hangouts. So we're doing audio and video because for some unknown reason people don't want to come see me face to face right now. But there's always opportunity and the cool thing is I'm able to now podcast with people from all over the world. So we're going to get an amazing, eclectic mix of people from different industries, different perspectives to share their story and tell us their thoughts and feelings on what's going on right now and all of that cool stuff. Hope you enjoy it. Please subscribe in all the usual places and enjoy. Great and we're live. Really, really great to be joined by Wolfgang Lehmacher. Thank you so much for joining me and for those that don't know Wolfgang, Wolfgang is an expert in global supply chain and he kindly agreed to come and give me a good lesson on what's been going on in the world from COVID and everything's supply chain. So Wolfgang, thank you so much and welcome to the show. Thank you, Lewis. Great to be here. And you. So just tell everyone, so where are you based at the moment? I'm in Hong Kong at this point and I think it's a good place to be. We didn't have a true full lockdown. There were 1200 people infected in Hong Kong and six deaths so far and life has been going on. Great, great. And how's it at the moment? So cases have completely died down, stopped. So what's the scenario? As far as I know, I'm not even closely following it but there haven't been new cases for a while. There are people coming in so there are flights arriving and from time to time you have cases and I believe Hong Kong is dealing well with this. The people are very self-disciplined, everybody wears masks, there is sanitizing opportunity all across the city, restaurants and banks do temperature checks. So it's quite a relatively smooth situation. Great. It felt like Hong Kong and Asia more generally has dealt with it a lot better than Europe. I'm in London and culturally here we don't wear masks. So it feels like it's been a bit of a struggle to get people to wear them and now you have to wear them on public transport. That's the key thing. And the track and trace apps haven't taken off here either. No one wants to be traced here and again I think the cultural differences have maybe the Asians dealt with it much better. It's been interesting. Yeah, it should work in the UK. The Asians see the wearing of masks as a way of protecting others but also as a gesture of politeness. Yes, absolutely, absolutely. So how have you seen just kind of on the global supply chain? I think on the face of it, certainly to start with people thought there'd be major supply issues and here in London you walked around the supermarkets just as the lockdown happened and there was no toilet paper, everyone was panic buying and there was a period here of maybe a month where people were just going crazy. What's actually been like? What is the current state of the global supply chain? Despite all the hurdles put in the way of supply chain professionals, I think they managed the situation very well. It is very hard to deal with peaks and we see peaks in the area of personal protection equipment. We see peaks caused by panic buying as you mentioned it. We saw sudden border closings and controls that caused mile long traffic jams and that causes a risk for supply but in general supply chains are pretty robust. Supply chain professionals are problem solvers and even without technology they are able to keep things going for a while. Although with technology it's much easier but at that point the concerns are much less on the supply side. They are on the demand side of things and it started all as a parallel as a simultaneous supply and demand shock. Let's remember that early on in the crisis Microsoft warned that their supply could be affected because they are putting software in China on their computers but at the same time Starbucks warned that they had to close 50% of their stores in China. From the beginning it was demand and supply which had been affected. We have also to know that it fell into the Chinese New Year. Before Chinese New Year usually companies start to increase their inventories and build our buffer stocks. Then we have that delayed supply after the Chinese New Year so we had a very nice buffer and that prevented that we had in fact a lot of disruptions in Europe or the US. The disruption were very different when the production arrived which was not able to be cancelled. For example clothes in Europe after the Chinese New Year the shops were closed and then the disruption was coming in form of shortages of warehouse space to store all the goods could not be sold. Interesting yeah it's funny when we got locked down you kind of you took a step back and you looked at it and I had you know food delivery delivered to my door and we have a Cato here Tesco Sainsbury's they were delivering. The slots took a bit of time to get sometimes but even like the local supermarkets and all the shops were fully stocked. I ordered a new computer during lockdown because my old one broke which was really bad timing and it came from China and it came to me within a week and it tracked it said from the factory to Hong Kong to southern England on the lorry to my house and I thought that was amazing you know in the peak of the pandemic my computer made it within a week to my house which I thought was great so I think the reality for me was very different to what I was reading in the papers and all of the panic that was made up. Yeah I can only agree that I had the same impression that there was a lot of hype and also a lot of unjustified anxiety although we have also to admit that this is a moment of human tragedy and it is emotionally difficult to to go through so it's natural that fears build up but I believe that supply is secured and what is good to hear about the computer is that that also worked because for example the commercial flight cancellations have taken 40 percent of capacity out of the cargo market and to get the computer from China to the UK you need air freight so but still in those days the transport was was conducted without problem. Yeah no no it was great so what's the state now then is it is it really back to normal now? I think it's not back to normal and I'm saying this because my view is that the supply chain is the economy and the economy is a supply chain and we know that the economy is suffering we know that a lot of sectors struggle on the demand side when we think about automotive and closest and furniture etc although also on the other side there are sectors which are booming like medical equipment and grocery stores online delivery services so we are living in a in a time which has a lot of unusual let's say unusual effects or suffering from unusual effects what has in fact started in China with a lockdown moved on to a in fact failed containment and a ripple effect and where we are now I see this then the third phase we have this hesitant reopening the concerns about a second wave and that makes it very hard and the biggest challenge for companies today is the uncertainty. Yeah absolutely have also be found kind of that people have been an issue as well so so in terms of being able to staff warehouses to get enough staff in the social distancing as do you see matters being an issue as well? We have clearly the need for more resources in the area where we see peaks that means that the amazons of this world had to recruit more people and this is always an effort the same with delivery companies I've just spoken with the company in Korea and they saw an explosion of e-commerce volumes and they need to be handled so yeah there are challenges and then we had at the very early stage of the pandemic also the situation that people didn't want to go to work because they felt that they could get infected so that was another challenge we had also the situation in China that people couldn't come to work because they were locked down so not entire China was locked down but the Hubei province is home to many migrant workers so that was the challenge we also saw shortages of workers due to border restrictions along the belt and road some projects were delayed because the workers couldn't come back after the Chinese New Year holidays in the factories we see also constraints because we need the as you mentioned physical distancing that means we can have not the same amount of people working at the same time so we have to work in in more shifts or find other ways or accept that we operate at a lower productivity and that is also the case I would estimate that the physical distancing could cost 25 percent of productivity but at the same time I spoke about the demand shock and there are things fall nicely into place that some don't mind to have a productivity shortcoming because they have also a revenue shortfall but that stuff gives an idea about the overall situation of the workforce and what we went through and are still going through yeah so it's interesting so so overall it's the global supply chain has coped well there's been challenges what if you maybe we look back a little bit and we think about how it's been affected what what have been the major effects do you think on the global supply chain is there anything that that they're now that they've learned and that's really changing I guess technology has been has been quite interesting as well yeah what do you think that the effects have been if we go to the markets can be extremely volatile we knew that before we know about Thanksgiving and we know about Christmas but we haven't seen something like the COVID-19 crisis before so the volatility is a learning which we have to factor into our our practices and also our tools because some tools you spoke about digitization will not be able to deal with such volatility so they failed us and luckily we have experienced supply chain professionals that can fill in and ensure the supply of goods so that's that's one area the other area of impact is the uncertainty or caused by the uncertainty and this leads to the fact that we need to shorten our planning cycles because we don't have visibility over 13 weeks hence we have to plan one week two weeks three weeks four weeks and this is a another first impact and second necessity which comes out of the crisis then it became also clear that those who had shipment monitoring asset tracking in place were better off than those that had not such tools also the 24-7 monitoring of the supply chain ecosystem that means the weather situation the border closings the situation around critical infrastructure etc those who had the data and the analytics around it were better equipped then there is the whole area around remote operating so remote operating for us first triggers the idea of working from home and that's true and it was amazing to see how many people can work from home but also there is a for example remote inventory management that some companies had set themselves up to do the goods count without any human interference and that of course helped here and and this drives my last point I want to mention which is automation the more automated companies are better off but I also would like to remind us that 300 million people work in factories and they work in factories because a lot of things cannot be robotized true that's very true we've we've had a lot here the government have been criticized a lot for the lack of PPE equipment so the protective equipment what have you seen from a I guess a global perspective was there was there really a shortage I guess we never predicted this pandemic so stuff that wasn't made quick enough or was it there and not not able to get to the right places what's kind of underlying all of this there are multiple angles to this topic first I think that this topic is highly emotional because it goes straight to our our fears and and our concerns and it is also a political topic and this is independent from what the real situation is or is not I think there is an exaggeration of the problem clearly we see a hype and we see an enormous surge in needs for PPE yeah on the other hand I believe that first if we had more transparency and more collaboration across the globe and if we had started in January February collectively as a global community to deal with the situation and think about it and put the experts teams teams together the outcome would have been very different I also would like to refer to a many let's say suggestions in this field the suggestion to have buffer stocks the suggestion to bring factories back home I think these are not the full solutions and I can explain that how many buffer stocks do we want to have and what what goods do we want to stock for which problem disruption we are preparing and this comes with high cost I think it's part of the part of the solution so we could think and we'll definitely review our our emergency stock policies but then when it comes to the relocation discussion do we really think that we want or that it is feasible that countries from New Zealand to Nepal from Malawi to Iceland from Canada to let's say Uruguay all have their own capacity of all essential goods and then deep a lot of free capacity to deal with the peak situation which is maybe a 10x demand compared to a normal situation I think that also sounds not as if it were a great solution I believe it is about as I said at the beginning global coordination it is about transparency in the supply so where are the factories I think there we have also learning that we have not enough knowledge about the global supply sources and the two enabler to overcome what what some think was a big challenge is more flexibility is the flexibility to refurbish production lines and we have seen that we have seen in many places that factories that produce shoes can also produce medical equipment right yeah and absolutely and then to deal with the surge in demand this is about fast upscaling so how can I upscale capacity within days yeah there's some also some fabulous stories I did a podcast with a lady called Dr Sophie Cox from University of Birmingham and her team they gave 3d printers to all of the all of their all of the research team when they went home and they designed and the 3d printing the the masks for the nhs and they gave it to their local hospitals fantastic story of local local manufacturing local supply and often gets overlooked you rarely hear those those those great stories and and certainly here in the UK people really pulled together and I thought that was fantastic some really good things going on what do you think now I can only um let's say underline this that uh unfortunately we talk too much about the issues and the challenges we face and not enough about the great things that happening the creativity of the people the initiative and the solidarity which was brought about by the whole situation definitely definitely because we hear a lot about people you know they're at home they're locked down they don't want to get out but when you walk around these cities who are the people out working you know it's the delivery drivers it's the healthcare workers you know these people really holding the countries together and you know they're celebrated but they should be celebrated more and we should hear I wish we'd hear more about these stories because you know we we know that that negative news sales papers so unfortunately most of it's negative but there's so many great stories around that we should be we should be listening to yeah and if we talk about people we also need to think about all the train drivers the pilots the delivery people as you mentioned or also about the 200 000 seafarers which cannot go home because we are missing a global standard for essential workforce and we have 200 000 people sitting at home cannot go to work to replace them now these are the the macro learnings we have to take in and work on yes yes absolutely what you mentioned to talk about China and certainly stories about the over reliance on China for raw materials and finished products what what are you seeing are you seeing are you seeing people wanting to try and reduce their reliance on China how are you seeing that develop there is clearly a reliance on China there is the McKinsey global institute institute China world exposure index and this shows that the exposure that China has to the world peaked in 2007 and declined from from there on but that the exposure the world has in respect to China has increased the reason behind that is the very attractive value proposition of China is the capability of China I spoke about the rapid scaling up if we look into where masks coming coming from today a lot are coming from China because they ramped up very quickly their capacity the the reason why China became so heavy such a heavy weight in the world economy is also the size of its market we have to see that China has probably 30 percent of the automotive market luxury spirits etc so it is a market it's not a factory we speak very often about China as the factory of the world and that's true but it is also the biggest market in many segments so if you want to serve that market you need to be there and then come the all the constraints around manufacturing that you have specialization if we take computer notebooks the the core is the LCD the LCD is produced the screen is is produced in a very few factories in the world so we cannot just distribute it and and summer in China if we take the hard disk hard disk are produced by two manufacturers in the world and they have factories in China Malaysia and Thailand so it is very hard to decompose the the supply chain even if you want it so we have a world where there are a number of manufacturing hubs one is China there is and there are smaller ones like Vietnam Thailand Malaysia and Germany of course Japan US Mexico and these hubs have their competence China is the center for mass production as I mentioned Thailand is known for hard disk we learned that the hard way during the the Thailand flooding and it it will be very difficult to build up new and change also even the shape of these clusters when I think about Germany Germany has a very strong capability in automotive it has a very strong capability in machinery but Germany lost its position in electronics to the Japanese a long time ago and it's very hard and Germany has never succeeded to to grab some supply chains in in other areas so that that's the reality we are we are seeing so how is the way forward I think that because of I think the geopolitical landscape there will be companies building the additional capacity in other than China they will go to Southeast Asia Eastern Europe Mexico as I mentioned and and this is not by chance that what all these areas are close to the biggest market right or part of the biggest market there will be a bit into Turkey which is also close to Europe maybe North Africa so it's the China plus approach and this is also what the the companies or the associations say if if you look at the developments in Japan Japan offered companies that move out of China sport but they made clear statements leaving China no thanks right and what about is it is there a price issue as well here China China used to be used to be cheaper the cheapest let's say to to manufacture and has that changed now that has changed a while ago the rise of for example of the electronics cluster in Vietnam came with Samsung Samsung Samsung about 10 years ago a bit less than 10 years ago started moving production into Vietnam and out of China and this because labor costs were rising in China and this is now almost 10 years back so you can imagine that the situation is is even more different today and this is also in line with the reforms which are on the way in China China is moving up the value chain and we have heard that a lot and China has deliberately with its labor cost policy that means by giving very high wage increases to their workforce with this they have deliberately pushed out lower end manufacturing into Southeast Asia into Cambodia into or into Bangladesh so it is a natural process and that also will change the way China is positioned in the world and it also indicates what the real reason for the US China rivalry is because the battlefield has moved up the value chain it's not a trade battle it's a technology battle and it's a battle in the cloud yeah yeah because I guess when we talk supply chains we're not just talking physical goods anymore if I want to buy my microsoft office it's it's a digital product are you seeing now you know it's more and more digitalization more and more people are buying stuff online digital stuff have you seen that accelerate that's exactly what I meant when I said the battle is kind of moving into the cloud right okay we see we see a few trends in globalization over the last 10 15 years and one trend is that the goods value chains get less labor intense meaning although production is moving out and the output is moving up not moving out moving up we see less of the goods crossing the border then we see also that supply chains are more regionally concentrated so it's the Asian supply chain it's the European supply chain it's a North American supply chain and by the way it's not a change chain it's a network and it becomes Leo when I talk about the platforms because you have one tier one tier n supplier who gets supplied or materials from several sources he supplies then other suppliers they supply to other factories everything is connected it is variable to a certain extent so we are talking about networks but right there another another trend so the first trend that I said is less trade intensive the second trend is more regional concentrated the third is what I spoke about before that only less today less than 20 percent of the supply chains are driven by labor cost arbitrage so the whole labor argument which we hear in the press all the time is in fact not there anymore or to a much lesser extent but the fourth trend I wanted to come to is that the trade of services is growing 60 faster than the trade of goods and in some sectors it can be 100% 200% 300% faster and national statistics attribute 23% of trade to services trade and if we add to this the free services the services we use now every day zoom facebook linked in twitter etc instagram we reach a number slightly above 50 percent which means that the new phase of globalization is in fact digitization and when we look at china and the US and compare this the US is far ahead of china in services trade but china is catching up and that's one of the areas where the competition takes place now very interesting we've I guess that my last question which is interesting to discuss and we've touched on probably a lot of the aspects of the answer anyway but how do you think global supply chains will look like post covid once all said and done have you found that the trends we've discussed have accelerated quicker because of covid what do you what do you think we're going to see I'm saying regularly now that what I have seen in the last five months I expected to see in the next five years and this in terms of adaptation in the in respect to digital products and services it's absolutely right what you're saying lewis we see an acceleration of the pre-covid-19 trends we see probably a bit more faster regionalization of supply chains although there will always be intercontinental traffic as long as people love certain products and as long as not each country has all the resources it needs we will see probably a major a major boost of digital services and in the supply chain we will see more monitoring more remote management of inventories more remote lane or quick lane validation so the whole management of supply chain will be done in a digital way the days are long gone where where the physical good is the center of the supply chain it's now the data the information it's still a relationship-based business but we will see much more digital tools applied I hope that we will see a bit more coordination and a bit more help from the global political institutional community I mentioned the tragedy around the seafarers they are in fact imprisoned in their in their current contract and cannot get out and should go home we also need to rethink our approach to critical infrastructure I think every country over the last 10 20 years has identified critical infrastructure but we need to find out and define how do we deal with critical infrastructure in the situation of a major pandemic yes definitely thank you so much Wolfgang I really appreciate you sharing your your thoughts with us very interesting times ahead a lot of interesting times have just just passed and it's crazy to think that there's still six months left of 2020 as well and so who knows what's going to happen next but yeah thank you very much for joining me and look forward to speaking to you again Lewis thank you very much it has been a great pleasure and it's such an important topic and we have to remain on our toes because as as you're saying we don't know what what the future holds very true thank you so much speak to you soon


All right, so now we're going to keep the billable item as is, I'm not going to change that one. I'm going to imagine that this one, we think it's going to go up. Now, there's a couple general trends that you might use, which are the easiest things to think about. You might say, well, I think the income is going to go up by a percentage each time frame. So that's one kind of easy thing to put the data input on.  Those are the easiest ones to kind of increase by. So for whatever reason, we're going to say that we think from January to February and going out into the future, this revenue account is going to increase by 5%. So how can I calculate that? I could say 1130 times .05, 5%. That would be it goes up by 5650 plus the 1130. Or I could say I want to have .05 plus 1, 1.05 or 105% times the 1130. That gets us where we want to go. So let's do that. I'm going to double click on February here on February. And I'm going to say this equals the prior amount times the 1.05, 105%. 100% plus 5% in essence. So I'm going to say boom. So now that brings it up to the 1187. And then I can copy that all the way across. And it should nicely populate increase. And notice if I don't do that because I said equal the prior sell, it now takes the new amount instead of taking the original divided by two. Instead of taking this original amount, it's always going to be taking the new amount. But I want it to continually compounding the increase. I'm going to put my cursor on it, fill handle and drag it all the way to the right. And that will then not to the total, but to the December. And now the total totals up to the 17,986. All right, let's do the next one. And notice these are going to be the more difficult ones, because the revenue is often the things that we're going to, we're going to think are going to change based on what we're going to do. Possibly we're going to advertise more possibly we're going to buy more equipment, you know, we're going to have to make our projections possibly the business environment will change. And then the expenses, a lot of times some of them will be more fixed. So we can just basically keep the standard, whatever it is all the way across utilities will just be pretty much the same all the way across all the, unless we have a seasonal kind of thing going on there. So in any case, we're going to, we're going to say this one's going to increase by 10% each time. So we'll do the same thing. I'll double click on this. I'm going to say the prior thing times the 1.1, 1, 100% plus 10% right 10% and then enter. And so then now it's, it steps up for the rest of the timeframe. I'm going to put my cursor back on it and copy it all the way to the right. So it compounds on itself to get to the, to the six 24. So we're looking a lot better next year. Now let's do something a little bit different instead of it compounding like that. We might say maybe I'm going to do something saying it's going to increase starting in February by $1,000. So we think it's just going to increase by a set dollar amount instead of compounding on itself. So I'm going to double click on this and say I'm going to take the prior amount plus $1,000. So we'll just increase it by a thousand. Now it has stepped up to a thousand because each cell represents the prior one. And now I'm just going to copy that one across. So each time it'll just increase by $1,000. So another kind of fairly easy arithmetic type of thing to do. All right. So let's go back on over and then say, okay, the next one is cost of goods sold. Now cost of goods sold is generally going to be tied to have a profit margin or relationship to the sale of products because it's this cost of the goods that we're selling. So we're going to have this. So if this one is going up by 10%, you would think there'd be something similar happening down here. So in other words, I could say, okay, well the cost of goods sold, if I look at February is is two, two, nine, seven, seven divided by the three, two, one, four, eight, which is here. And say the cost of goods sold is like 0.737% of the of the sale. So I could use that formula. I could say this equals, I could say this equals this times 0.73767 or whatever and copy that across. That's one way we could do it. Or I can just say it's going to increase by that same 1.1, which should end up with the same result. And this should be a negative. I'd have to say negative of that amount times whatever. Or I could say say this is going to be equal to the prior amount times 1.1. It's going to have that percentage increase, which is going to be the same across. So we'll do that. And so now, so if I do that, this is at the two, five, two, seven, five divided by the three, two, one, four, eight. So now we're at 0.7862. And if I copy that across all the way across to December, and I do the division here, I could say, okay, this is at 65556 divided by this number, 83384. And we got the 0.786, right? Okay, so then the total's at the 491. Now some of the expense accounts should be a little bit easier down here. So if I look at some of those, I'm going to say, all right, let's go down here. We got the bank. The bank fees, $30, $35, let's say that's the same all the way across. It's probably in material, not really worth getting to bothered over on a budget. The liability insurance. Now, insurance, you kind of got to think if you're going to be doing a cash-based system or an accrual-based system, I'm going to try to try to just show when we're going to pay the insurance at this point, just so you can see how you might see it like a tier type of system. So I might say I'm going to record the insurance as an expense when I pay for it, for example, and look at it more on a cash flow basis and say, let's delete all of this. And I'm just going to assume that I'm going to pay the insurance in February, let's say $6,000 in February, negative $6,000. And then I'm going to pay again in September, negative $6,000. So you might have something like that if you're trying to do your budget kind of on a cash-based system. And you might have it like a step-up situation that we'll see shortly. Like let's say that the internet for the business, let's say that's going to be pretty much standard. We'll keep that as is. Then we've got our wages situation. The taxes, this is payroll taxes, I believe, and then the wages. So this is an area you might have a step-up kind of situation. You might say, well, I'm going to pay the same wages, but maybe in June, that's when I'm due to give people raises for cost of living or whatever, raises or something. So you might say I'm going to keep this as is until June, maybe. And then you have that step-up where I'm going to say it's going to be the prior amount times 110%, 10% increase. So I'm going to say times 1.1, 10, 110% increasing it by 10%. And now you've got this step-up that happened. And maybe you don't expect that to be compounding going forward because that's how wages often work. They're tiered up at one point and then they stay standard for some time after that, unlike possibly revenue, which hopefully has a nice steady flow increase upwards. Let me tweak that one a little bit. I think I wanted to just do the step-up in July. So let's say I'm going to copy this June, I'm going to copy from May back over to June. And then I'm going to do in July that step-up thing. So I'm going to say July is going to equal the prior period times 1.1. So now in July, going forward, you'll have that amount out to here, 87%. So that looks good. Now then we've got the sales tax, the payroll tax. So if there's a change to payroll, you would expect payroll taxes to change, which gets complex because the payroll taxes can have different caps on them and whatnot. And so there's a couple ways you can think about it. It'd be similar to like the cost of goods sold relationship to the inventory because this is basically our portion, the employer portion of taxes. So you might think of it as it should have the same relationship that it did before. So I could say, well, taxes were 486 divided by wages of 6,983. So that's about 6.95%. So I could go here and say this is going to be this times, so I could write, I could say this is going to be equal this times the .0695 or something like that, or I could just increase it by the same amount, which should give me basically the same result. So I could say this is going to be equal to the prior period times 1.1. And I should have the same kind of jump up. So if I then say this is 535 divided by 7682, we get the .069 so on and so forth. So the taxes should jump up in a similar fashion. And that would make sense. Okay.


work by Jens Quot and Victor Schupp about the security of ECDSA with additive key derivation and pre-signatures and Victor is going to give the talk. Thank you. I hope you can hear me okay through my mask. Yes, I come from a planet where we have a pandemic so I'm still there in my mind at least. So how do I advance? I didn't touch anything when that happened. Okay, okay, so let me start with some context. So I'm currently at an organization called DFINITY which is building something called the Internet Computer which is a distributed platform for executing smart contracts in a secure way. It does great things and it's amazingly fast and everything and what we want to do though is we want to build a new threshold ECDSA signing protocol but that's what we're implementing and we're currently integrating it into our protocol, our larger protocol and we're doing this because we think that it might be a good idea to allow smart contracts running on the internet computer to be able to securely hold and spend Bitcoin and other types of cryptocurrencies and of course most of these currently still use ECDSA so we need a protocol for that. So this is the MPC session. I'm not really going to talk about a secure multi-party protocol for ECDSA signing that's in a companion paper and this talk I'll be talking about just the analysis of a non-threshold ECDSA that's appropriate for analyzing a distributed protocol. So you'll see what I mean in a little bit. So just let's recall ECDSA signatures. We have an elliptic curve of order Q and a generator G and the notation I'll use here is my secret key will be little D and my public key will be this big D and I'll use additive notation and yeah so this is ECDSA. You hash the message, you point with a laser pointer that doesn't work. You pick a random R and you multiply your generator by that so you get the group element R and then you apply this funny function C which is this conversion function. It doesn't really matter what it is but that converts a point on the curve to a number mod Q and then you test a little corner case that never really happens and then you compute S as R inverse times H plus TD and the signature is this is pair ST and then you verify a signature by just kind of doing the obvious thing in reverse. You hash the message and then you compute S inverse times H, multiply that by the group element G, S inverse times T, multiply that by the public key D and then you check that you get a non-zero point on the curve and then the conversion function maps to T and so I'll keep this kind of basic verification equation up here. As you'll notice there's a part of the signing process is independent of the message M and you can do some pre-computations and a lot of people have of course noticed this before so you can compute the random R, do the multiplication of R times G and then do even the conversion function all independently of the message M so I'll call this group element R a pre-signature. Now if you're doing an MPC implementation of this you'll probably be using some kind of a secret sharing scheme and so we can do a pre-computation which in addition to computing this group element R, this pre-signature R, we can also pre-compute sharings of little R, the random number R and then also we can pre-compute kind of a beaver triple kind of thing kind of adapted to ECDSA a little bit so we can compute the random number U mod Q shared among all the parties and then we can use U to multiply both R and D so we get R prime is a sharing of R times U and D prime is a sharing of D times U so we've got two random numbers and then products of them so we can also do this as kind of a pre-computation in a distributed protocol and then once we have all this then to sign a given message M we can just do a local computation where we compute the hash of the message and then we assuming standard secret sharing we can just locally compute H times U the hash times U plus T times this D prime up here and then once we each party locally compute stat they can just open their shares broadcast their shares and then everybody can combine them so we open here V and R prime so V is H U plus T D U and R prime is R times U you cancel the U's and you get the S component of the signature out um yeah so that's pretty much it and I guess you're also right and you're going to open uh and you also already have T okay so once we have this pre-signature group element R plus this pre-shared data then the point of all is this then the latency for a signature is just one round of communication everybody broadcasts a share everybody can combine them and you have a signature okay so that's one so pre-computation is a is a technique that's used in many ecdsa threshold implementations another thing that's relevant to threshold ecdsa and ecdsa in the cryptocurrency community is something called additive key derivation so here the idea is that starting from a secret key little d we can compute kind of an offset of that secret key d plus e um and a corresponding public key which is just uh the original public key plus e times the generator uh where this e is kind of a public value and an additive tweak that's typically derived by some kind of hashing process applied to some identifier so it's so the main thing is that e is a a public value um if you're familiar at all with um bitcoin and and related cryptocurrencies there's a standard called Bip32 that's essentially a special case of this uh this additive key derivation and it's used in bitcoin and other cryptocurrencies to implement something called hierarchical deterministic wallets um so if we want to do something like this in a threshold implementation first of all it's fairly easy to implement because uh everything this tweaking this this derived key is is a linear operation basically so uh that typically means that uh we can efficiently implement that using secret sharing also uh it's useful in a in a threshold setting it's it's really important to use this kind of thing to keep the key maintenance costs to a minimum um let me elaborate on that a little bit so for every signing key that we have we have to share that signing key among all the parties right and so and then we're gonna have to reshare this key occasionally specifically uh when the network membership changes we're gonna have to reshare the secret key and uh if we want to proactively uh refresh the secret shares on a on a regular basis so just imagine uh we had you know tens of thousands of keys one for every user and then every you know every few minutes whenever we want to do a proactive reshare we want to have to re run this resharing protocol for all these tens of thousands of users even though maybe most of these users are not even using their key at this time right maybe they're not even generating that many signatures so um because of these costs we actually don't want to have all of these independent signing keys we we would rather if we could have kind of like one master secret key and then just derive uh secret keys secret signing keys for each user using a simple key derivation such as this one here additive key derivation um also in addition to all that uh the maintenance costs might also include any additional protocols for like backing up a signing key right the kind of a disaster if people lost their bitcoin signing keys uh and there wasn't some kind of a backup so that's additive key derivation and when you uh incorporate additive key derivation into ecdsa well you're right so you're essentially just replacing the public key d by d plus e times a generator so when you plug that into this equation here you just get a a t times e times g extra factor here so this is the new down here on the bottom here's the new verification equation that you get for if you want to verify a signature with respect to a derived key so what do we know about ecdsa security um typically in your average threshold ecdsa protocol you'll find that there's a security proof that reduces the security of the protocol to the security of the non-threshold ecdsa signature scheme hopefully that's the case but if we use pre signatures and or in combination additive key derivation uh we will need to consider an attack on the non-threshold ecdsa scheme that incorporates this usage right revealing pre signatures prior to messages being chosen and also deriving public keys in this way so what's previously known about uh these different kind of modes of operation well first of all if we just have plain old ecdsa the unfortunate thing about that is we don't really have a good reduction uh from ecdsa to any kind of standard problem but we do know that in the generic group model as a result of brown from 2002 that shows that um this is secure in the so-called generic group model uh under some collision resistance and in random pre-image resistance um assumptions on the hash function then if we look at ecdsa with pre signatures well actually there's a paper uh by ronkinetti and friends in 2020 who showed that uh a proof of security in the generic group model plus the random oracle model showed that ecdsa with pre signatures was secure for ecdsa with additive key derivation there's actually no general results prior to our work at least that i know of uh there are some results with various restrictions on the attack on the types of messages that you sign on the on the ways in which you use the public keys but uh there haven't been any real general results and then well in particular if you look at ecdsa with pre signatures and additive key derivations there's nobody's ever really looked at this at all even though uh this mode has been this mode of operation has been advocated in the literature for use i won't say who advocated it but because it's not really substantiated by anything but um yeah but you can see why you would want to use it right for those there's there's compelling reasons to want to use both of these modes of operation in combination so here's what happens if you were to use pre signatures plus a key additive key derivation there's actually an attack of sorts so here's how the attack works you make one pre signature query to get this random group element r and the and the corresponding uh you apply the conversion function to get the corresponding number t mod q and then the main step is step two where we want to find message m tweak e and another message m star and a tweak e star so we want to find these four things so this attack uh the the name of this attack is called the meme attack so the name was discovered by tall raven who wanted to make sure i gave her credit for the name for the meme and then what you want to do is find m e m e m star e star such that this equation holds here h plus te equals h star plus te star and the only real constraint is that the tweaks should be different the hash is the the messages could even be the same message it doesn't matter um and so so once you find these four values then you ask for a signature um on message m um you ask for a you ask for a signature st using this pre signature on the message m with tweak e and that immediately gives you a signature on m star with respect to tweak e star i mean this is just trivial math right so you can look at the verification equations and see that that's what you get so this is a valid signature on m star with respect to e star so that's kind of a simple thing to see now the hard part of course is the step two to find the meme and this is essentially a four-some problem um you can kind of just look at the hash outputs as basically random numbers and the tweaks are also kind of random numbers multiplied by this fixed value t so you're looking for four random numbers that add up in in this particular way so this is a well-studied problem called the four-some problem uh Wagner had a nice paper also 20 years ago that shows that you can do this in time cube root of q uh instead of square root of q which is what you would expect the the time it would take to uh attack e c dsa generically so it's still you know not a polynomial time attack but it's still uh i guess a bug rather than a feature in using this kind of mode of operation so uh i want to talk about some ways to mitigate against this type of attack and then um i'll present our results which basically is some analyses of these mitigations in the generic group model so one idea that we had um to prevent this kind of cube root type of attack is to use what we call re-randomized presignatures and when i show this to you'll think it's just kind of cheating in some way so the idea is this we start with a base presignature just as a normal presignature but i'll call it a base presignature r prime so you you pre-compute those now when a signing request comes in what we do only after the message has been committed to by the by the attacker we replace this this base presignature by the actual presignature so we we generate or we obtain a random number delta and basically add that to a delta times generated to our base presignature so the important thing is that this delta is a public random value so we don't it's not secret shared or anything so it's just derived publicly it's kind of like a you could get it from like a random beacon or some other threshold uh signing protocol that you could use like a BLS signature scheme for example that's what we actually do in our implementation so it's so it's a little bit cheating because we're going to use another threshold signature scheme namely BLS actually in our implementation to generate this public randomness but other than that it's sufficient to implement it may introduce some additional latency in the sense that you can only generate this delta after the the message to be signed has been committed to at least in our implementation it doesn't introduce any latency because anyway a signing request has to pass through a whole consensus protocol and by the time that happens you can easily start releasing the the shares of delta before before that happens so that's one mitigation this re-randomized presignatures the other one is i'll call it uh homogeneous key derivation so here the idea is that instead of having a single kind of master secret key d we're going to have two master secret keys d and d prime and then a corresponding master public key big d and big d prime then once we get a tweak we're going to derive the secret key as a linear combination of d and d prime so we're going to the new secret key will be d plus the tweak e times d prime and then the corresponding public key will be uh that so the this so that's a mitigation and I'll show you in a minute um what it buys you but right away just one disadvantage that I'll point out is that um it's not compatible with bib 32 and we wanted to have some compatibility with bib 32 so we didn't actually implement this um but one could and um finally you could actually if you wanted to combine both of these mitigations and you'll see on the next slide that this also buys you something you can combine re-randomized presignatures with homogeneous key derivation so this is what we analyze in this paper is actually we have like nine different theorems so let me just uh walk through kind of briefly and highlight some of the main salient features so first we start out looking at no key derivation and we look at no presignatures presigs and re-randomized presignatures so this first result here is basically Brown's theorem from uh 2002 this says that in the in the generic group model the the advantage that an adversary has in breaking the signature scheme is just the advantage of finding a collision that's this epsilon cr plus n times the advantage of finding a pre-image of a random number under the hash function and then there's this strange zpr which is the advantage of finding a pre-image of zero of the hash function and then you have the n squared over q which comes from the usual generic group model kind of analysis so that's actually Brown's result um yeah n here is the number of queries that counts group operation queries in the generic group model uh signing queries etc then if we look at again still no key derivation but with presignatures then we get another result which here uh let's see um qualitatively what's different you'll see here we have a factor u times n instead of an n here uh and then also so you here is the number of unused presignatures at any point in time you can generate presignatures and then you consume them when you sign and then there's at any point in time there's some number of unused presignatures and that for whatever reason comes into the analysis we also have another complexity assumption here which is I'll call ratio resistance this epsilon rr so this is the a bound on the advantage to find two messages who who's who's uh if you look at their hashes their ratios hit some random number so um this is similar to the result approved by kanedi et al in 2020 it's a little bit tighter actually than their result but that's not that interesting um then if we look at re-randomized presignatures this first mitigation I told you about so you'll see here that you know this reduction here in the second column is much sloppier than the than the original brown result and the nice thing you'll notice about this slide even though there are nine boxes a lot of them are the same in particular everything in column three is going to be the same as everything in column one so when we apply the re-randomized presignatures um mitigation we end up back in column one as if there were no uh presignatures at all then we look at additive key derivation um and again you can see here that everything gets slightly more painful and and the reduction gets sloppier and sloppier here we have to multiply this random pre-image thing by a factor uh of the size of the tweak set so here in this particular analysis I'm looking at the set of allowed tweaks I'm viewing the tweaks as the output of some random oracle I'll say something more about that in a minute um but assuming that we view the tweaks themselves as the output of some random oracle we can kind of make the adversary commit to the set of all possible tweaks in advance and then we have a guessing argument that kind of inflates the the the reduction here then we come to pre this is okay this is the worst of all possible words worlds here is when you combine additive key derivation with presignatures I showed you this quote unquote attack the good news is that's it's no worse than that we can basically we basically show that there are some specific instances that are for some problem that you can bounce the bounce the the probability of breaking it by so you get a reduction to a for some problem and then as usual if we add re-randomized presignatures to that we get back to column one so that's good so this is actually what we we implement additive key derivation with re-randomized presignatures it's it gives you a pretty good bound then finally if we look at homogeneous key derivation the good news is here column no row three is the same as row one so when you so so homogeneous key derivation is actually a more a more powerful mitigation so here you just see we get everything as in column one in particular the cell down here on the lower right is the same as brown's cell up on the right so if you do homogeneous key derivation plus re-randomized presignatures you're like living in the same world that brown was living in 20 years ago so that's nice it gives you a nice tight reduction and I'll finish up by just mentioning a couple other features of our analysis I won't be doing any proofs here it's all done in a generic group model there's been some complaints about the generic group model especially as it relates to the elliptic curves and e-cdsa in particular so what we do to kind of address some of those complaints is to you know in so in the generic group model we're basically going to choose a random encoding of the group we have a group of a prime order q and we're going to just pick a random encoding of it and then the adversary gets black box access to add and do group operations on these random encodings but our encoding space so to speak is actually an elliptic curve of prime order q it's just that we ignore the group law right so the group law is just has nothing to do with the group law of the elliptic curve but the space in which the group elements the encoded group elements live is an elliptic curve except again to address complaints we enforce the condition that the inverse in the group of an element of this curve really respects the usual inverse law right and this gets at this allows us to model some quirks in e-cdsa in particular malleability in particular if you have a signature st on a message m then so is minus st so we can actually model this and not only can we model the malleability we can actually then prove in this particular ggm model that e-cdsa is only malleable in this way which isn't surprising really we also analyze the standardized bib 32 construction and show that it's actually indifferential from a random oracle really a public random oracle but it doesn't really matter in this application and we also analyze the additive key derivation without using random oracles and just using kind of concrete assert security assumptions and the interaction between the e-cdsa hash and the hash that's used to derive the tweaks so that's it thanks and i'll make a shameless plug do we're all we're still looking to hire people at the finity um thank you um thanks for the talk uh are there questions for the last speaker um maybe a quick one um so in addition or except for the meme attack that you had are there any known attacks uh on uh if you have only uh precix or additive key derivation but not both together well we did i mean we do have lower bones but does it translate into um something because you have a bit of a loss right in comparison to the oh yeah there's some others yeah there's some other sloppiness in here like this extra factor here and there are various extra factors here and there that come in to just making a standard kind of hybrid argument or guessing argument and it's typical right in those cases i there may be attacks there may not be attacks we didn't really dive too deep into that there could be attacks there that match the upper bounds but i'm actually wouldn't want to spend any money thanks a lot okay so let's thank all the speakers from the last session again and this concludes day one of Eurocrypt have fun