Hi, I'm Lior. This is a talk about non-malleable vector commitments via local equivocability, and this is joint work with Gil Segev. Vector commitments, or VCs for short, enable a user to non-interactively commit to a long vector of elements, and then at a later stage to locally open any of the committed vectors entries by revealing its contents, and providing a short proof asserting its correctness with respect to the commitment. The security requirement of such commitments is position binding. An adversary shouldn't be able to produce a commitment, and then open one of its entries to two different values. Without any further requirements, a trivial solution is to simply have the committer commit to each entry of the vector independently, using some standard non-interactive commitment scheme. So, in addition, VCs should also be non-trivially succinct. That is, both the commitment string and the local openings should be of size sublinear in the number Q of entries in the committed vector. Perhaps the earliest construction of VCs is Merkle trees, suggested by Merkel back in the late 80s. Merkel trees produce commitments of length which is independent of the size Q of the underlying vector. The length of the local openings is the depth of the tree, which is logarithmic in Q. More recent constructions that are based on specific algebraic or lattice-based assumptions have both constant size commitments and constant size openings. Furthermore, they offer various functionality improvements, including updateability of entries in the underlying vector, the ability to simultaneously open multiple entries more efficiently and more. Another long-language research regarding commitment schemes deals with non-mallible commitments introduced in the seminal work of the left work and all. In this talk, we'd restrict our attention to non-interactive non-mallible commitments. Informally speaking, such schemes ensure that an adversary that observes a commitment to some value of V cannot produce a commitment to a value of V' which is non-trivially related to V. Over the years, there have been many constructions of non-mallible commitment schemes from different assumptions, satisfying different security notions and different efficiency tradeoffs. In this work, we study non-mallible vector commitments or VCs. Though the two above mentioned notions have been thoroughly studied, the notion of non-mallible VCs has not been explored. As we will see, the main reason why existing frameworks for standard non-mallible non-interactive commitments are insufficient to deal with vector commitments is that they do not consider the security implications of an adversary that is exposed to local openings of some of the vector's entries. A related notion that has been explored is non-mallible or independent zero-knowledge sets. Roughly, this can be seen as VCs that allow for non-membership proofs. That is, one can prove that a certain element is not in the underlying vector. Such schemes were defined and constructed by Genaro and Michali, but their construction, as well as subsequent constructions, rely on the notion of multi-trap dorm or curial-trap toward commitments as a building block. Just to specify these commitments requires no less than 11 algorithms. This high level of intricacy is tailored, at least in part, specifically to support non-membership proofs of non-mallible zero-knowledge sets. So this leaves open the question of can non-mallible VCs that do not require non-membership proofs be constructed within a simplified framework both from a conceptual point of view and from a technical standpoint? With this question in mind, our contributions are the following. First, we put forth a notion of non-malleability for VCs. Our notion strikes a balance between the weaker notion of standard non-malleable non-interactive commitments, which does not account for local openings, and the stronger notion of non-malleable zero-knowledge sets. We then present a general framework for constructing non-malleable VCs. Concretely, we show how to transform any VC into a non-malleable VC using a new intermediate notion that we present, which we call locally equivocable commitments with all but one binding. This notion is simpler and admits somewhat more efficient instantiations than the more intricate notion of multi-trapdoor mercurial trapdoor commitments. The non-malleable VCs that are obtained using our framework essentially preserve the efficiency of the underlying VC. Additionally, in the paper, we show how to extend our notion of non-malleability and our construction of non-malleable VCs to the dynamic setting, allowing for private updates to the committed vector. We also show that Merkel-Trees satisfy our notion of non-malleability in the random oracle model, which is not necessarily the case in the standard model. And finally, we discuss possible applications of non-malleable VCs to provide cross-transaction independence in blockchains and for the integrity of simultaneous multi-round auctions. Unfortunately, we will not be able to cover these contributions in this talk, and you can see the paper for more details. So the remainder of this talk will be organized as follows. First we'll review our notion of non-malleable VCs, then we'll present our formal definition for locally equivocable commitments with all but one binding, then we'll see our construction of non-malleable VCs from any VC, and finally we'll conclude with some closing remarks. So let's start by defining non-malleable VCs. Intuitively, at the most basic level, our notion of non-malleability asks that an efficient adversary receiving a VC to a vector x of elements should not be able to produce a VC to a non-trivially related vector x' In this sense, our notion is based on the standard notion of non-malleability for non-interactive commitments, but we extend it to accommodate adversaries that observe local openings of the vector commitment to x for entries of their choice before having to produce their vector commitments to x' In more detail, our notion of non-malleability relies on a simulation-based definition. We define two experiments, a real one and an ideal one, and we require that for any adversary A, any length Q of vectors, and any distribution D over such vectors, there is a simulator S such that the output of the real experiment with the adversary A is indistinguishable from the output of the ideal experiment with the simulator S. Before we define the experiments, two technical details are in order. First, as is the case for standard VCs and for standard non-interactive non-malleable commitments, our definition is in the CRS model. Secondly, in our formal definition, we have a technical requirement that the distribution D over vectors must satisfy. For ease of presentation, we will ignore both of these facts for now. So the real experiment is defined as follows. First, a vector x1 to xq of values is sampled according to the distribution D, and the adversary is given a commitment to this vector using the vector commitment scheme. Then, the adversary outputs a subset I of indices between 1 and Q, and receives local openings to all the xi's that correspond to this subset I. The adversary then outputs a vector commitment vc' and specifies a subset J. This subset specifies the locations which the adversary will later open with respect to vc' Finally, the adversary receives all remaining local openings with respect to the vector commitment it received, and replies with local openings with respect to vc' to all the indices in the subset J outputted before. We denote each value opened by the adversary by xi' where xi' is simply bought if the index I is not in the subset J. Moreover, if the adversary simply copies the vector commitment it received, or if any of its openings is invalid, then we replace all of the xi' with bought. The output of the experiment is composed of the vector x1 to xq, the vector x1' to xq' of the values opened by the adversary, and the subset I chosen by the adversary. The ideal experiment also begins with sampling a vector x1 to xq of values according to the distribution D, but there are no commitments involved. Instead, the simulator S outputs a subset I, and simply receives the values xi in the clear for every little i in the subset I. The simulator also outputs no commitments, and instead it specifies a subset J, and immediately outputs values xi' for every i in the subset J. As before, for every i not in J, we set xi' to be bought, and the output of the experiment is the vector x1 to xq, the vector of values outputted by the simulator x1' to xq' and the subset I chosen by the simulator. Again, our non-malleability definition requires that this output is indistinguishable from the output of the real experiment described in the previous slide. Note that existing GVCs do not satisfy our notion of non-malleability. First, Merkle trees in the standard model may be malleable. Informally, this is due to the fact that potentially the underlying hash function used to construct the tree can be malleable in and of itself. Second, more recent algebraic constructions are also malleable due to the homomorphic properties. This is often by design as to allow for public updates to the committed vector. You can see the paper for a more in-depth discussion of the malleability of existing VCs. Before describing our construction of non-malleable VCs, we observed that simple approaches failed to satisfy our security notion. First, consider the approach of committing to each entry using some non-malleable commitment scheme, and then committing to the vector of all commitments using a vector commitment scheme. This approach fails due to the potential malleability of the vector commitment scheme. For example, it might be the case that given a VC to some vector, it's easy to commit to the same vector while replacing only its first entry. Another approach might be to first commit to the entire vector using a vector commitment scheme, and then to commit to the resulting commitment using a non-malleable commitment scheme. So this works if you only consider the standard non-malleability notion of non- interactive commitments, but fails when considering our definition that takes into account adversaries that observe local openings. The reason is that after observing a single local opening, the adversary learns the potentially malleable vector commitment to the underlying vector, and then we're back to square one. Okay, so now let's define our notion of locally equivocable commitments with all but one binding. Our notion augments the standard notion of tag-based commitments with two additional properties, local equivocability, and all but one binding. It should also be mentioned that it's related but different from the notion of identity-based script or commitments, and you can see the paper for a complete comparison of the two notions. So let's start by defining the syntax of our locally equivocable commitments. The setup algorithm takes in an integer q and outputs a CRS. The commit algorithm takes the CRS, an index i from 1 to q, and a tag tau and outputs a commitment string c together with a decommitment d. The decommit algorithm takes in the CRS a commitment c, a decommitment d, an index i, and a tag tau, and outputs either an element x or the rejection symbol bot. So everything until now is pretty standard, maybe except the fact that the setup algorithm takes in the integer q and the commitment and the commitment algorithms take in the index i. So this is a good point to talk about instantiations. In the paper we show that existing approaches for constructing equivocable commitment schemes from algebraic assumptions satisfy our notion as well, and we also show a generic construction for many one-way functions which is of theoretical interest. Now the dependency of the setup commitment and decommitment algorithms on q and on i only comes into play in the generic construction for many one-way functions and doesn't come into play in the more efficient algebraic constructions. To the first three algorithms we add three equivocation algorithms. Alt setup takes in q and outputs some state st0, equiv1 takes the state and the tag tau and outputs a common reference string CRS hat, commitments c1 to cq, and an updated state st1. Equiv2 takes an element x, an index i, the state st1 and the tag tau, and outputs an opening d hat. The requirement is that d hat indeed opens ci to the element x with respect to the tag tau. More specifically for every q, tau, i and x the following should hold. So if we first sample a state st0 using alt setup on q and then we invoke a equiv1 on st0 and tau to receive a CRS, CRS hat, commitments c1 to cq and the state st1, and finally invoke equiv2 on the x, i, st1 and tau to receive a decommitment d hat, then decommitting with CRS hat ci, d hat, i and tau we should get back the element x that we used to generate d hat. In addition we ask that the parameters and commitments generated by the equivocation algorithms are indistinguishable from honestly generated parameters and commitments. So on the one hand we generate CRS hat and commitments c1 hat to cq hat and using some specific values x1 to xq we generate decommitments d1 hat to dq hat. All of that is done using the equivocation algorithms. On the other hand we have an honestly generated CRS and honestly generated commitments and decommitments c1 to cq and d1 to dq generated using the honest commitment algorithm and the values x1 to xq which are the same values that we use to generate the decommitments on the left side of the slide. Now we ask that the CRS commitments and decommitments generated using these two processes are indistinguishable even for adversarily chosen tag tau and values x1 to xq. The second property that we require is all but one binding. Intuitively this property requires that even an adversary that produces equivocable commitments with respect to some tag tau shouldn't be able to open these commitments to more than a single value with respect to a different commitment tag tau prime. So this is defined using the following experiment. First we let the adversary a output a tag tau then we sample a state st0 using GAL setup. We invoke equiv1 on st0 and the tag tau outputted by the adversary using some honestly generated randomness row and this gives us among other things a common reference string CRS hat. We give st0 and the randomness row we used in equiv1 to the adversary and then the adversary needs to output a commitment c to decommitments d and d prime and index i and a tag tau prime. The adversary wins if d and d prime are valid decommitments of c with respect to the tag tau prime to different values x and x prime and in addition the tag tau prime is different than the tag tau used to generate the CRS and we require that the probability that the adversary wins is negligible in the security parameter lambda. Okay so equipped with this notion we can now present our construction of non-malleable vcs. The construction that we will see in this talk relies on three building blocks. A vector commitment scheme vc, a locally equivocable commitment scheme le with all but one binding and the one time strongly unforgeable signature sig. In this talk we will make the simplifying assumption that the tag space of le and the verification key space of sig are the same. This is just for simplicity of presentation and in the full flash construction we apply a universal one-way hash function to map verification keys to tags following standard techniques when constructing non-malleable non-interactive commitments. So the CRS of our non-malleable vector commitment scheme is simply the concatenation of the CRS's of vc and le. Then to commit to a vector x1 to xq we sample a signing key sk and the verification key vk. Commit to each element of the vector using the locally equivocable commitment scheme le where the verification key vk is used as the tag for the commitments. Then we commit to all of these commitments using the vector commitment scheme vc and finally we sign the resulting commitment vcom using the signing key sk. The final commitment is then composed of the vector commitment vcom the verification key vk and the signature sigma. To locally open this commitment at position i one simply outputs the corresponding locally equivocable commitment ci together with its opening di and the proof pii that ci is indeed the entry i of the vector underlying vcom. So we won't see a complete proof for the non-malleability of this construction in this talk but we'll see a high level sketch of the main idea. This idea extends the classic template of how to prove the non-malleability of non-interactive commitments to the setting of vcs and locally equivocable commitments. For the sake of simplicity in this sketch we'll ignore the fact that the adversary observes local openings before outputting their vector commitment and we'll assume that the adversary opens all of the entries of the vector commitment that it issues in the security experiment. So the adversary receives a vector commitment according to our construction so it includes a vector commitment vcom, a verification key vk and the signature sigma. It then outputs a different vector commitment which includes a vector commitment vcom hat, a verification key vk hat and a signature sigma hat. The adversary now receives local openings to all of the entries of the vector underlying vcom and outputs local openings to all of the entries of the vector underlying vcom hat. We'll consider two cases. The first is the easy one and in this case the verification key vk hat that the adversary outputs is the same as the verification key vk it receives. In this case in order to have a non-trivial advantage it must be the case that vcom hat is different from vcom or sigma hat is different from sigma. Otherwise the commitment outputted by the adversary is exactly the same as the commitment it receives which informally speaking gives no advantage in the security definition. But this can only be the case if the adversary successfully breaks the strong unforgeability of the underlying signature scheme sig. The second case in which vk hat is different from vk is the more technically involved one. The main observation here is that any advantage that the adversary might have must come from their ability to choose the values to which it provides local openings after already outputting its vector commitment vcom hat. The reason for that is that the commitment vcom that the adversary receives at the beginning of the experiment is indistinguishable from a vector commitment to a vector of locally equivocable commitments. Such a commitment holds no information about the underlying vector x1 to xq and so intuitively speaking any information that the adversary learns about this vector must come from the local openings that it receives. Recall that a non-trivial advantage of the adversary means that it can open vcom hat to values that are non-trivially related to x1 to xq. This means that if we provide the adversary with different local openings to independent values x1 prime to xq prime it should be able to open its vector commitment to different values as well at least in one coordinate i. But this means that the adversary can either open vcom hat at position i to two different values which breaks the position binding of vc or it can open some locally equivocable commitment ci hat to two different values xi hat and xi hat prime. Recall that we are in the case where vk hat is different from vk and so the adversary in fact breaks binding with respect to a tag which is different than the tag used to generate vcom. Hence even though in the proof we switched to equivocable parameters the adversary should still not be able to do so since it breaks the all but one binding of the locally equivocable commitment scheme le. Okay so let's conclude. What we saw in this talk is a notion of non-malleability for vcs and the framework for constructing non-malleable vcs. We presented a new primitive called locally equivocable commitments with all but one binding and presented a generic construction that uses such commitments to transform any vc into a non-malleable one. In the paper we also consider non-malleable dynamic vcs the liability of random oracle model miracle trees and we discussed some applications of non-malleable vcs. An interesting open problem which is not addressed by our construction is to construct non-malleable sub-vector commitments which are vector commitments that allow for sub-vector openings which are more efficient than simply opening each entry independently. Okay so with that I will conclude the talk and thank you for listening.


I thought it would honestly be really funny if I read my blog post naked. That's writer Kathy Reisenwitz. On the day that she sat down for an interview with Reason, she had been posting photos and videos to the website OnlyFans for about two weeks. One of the goals that I have for My OnlyFans is to get more people exposed to my writing. I've been writing about sex for a long time.  OnlyFans is a social network like Instagram or YouTube, except the creators get to charge for their content. Nudity is both a loud and a common feature. And I think there's also this kind of dualism where you're like that kind of girl or you're not that kind of girl, like you're either someone who makes money from, you know, their brain or their body. And I think that's dumb. So when I saw some women who I respect intellectually start their OnlyFans, I thought that's a trend I like to see. It's a thing I want to be part of. It's a thing I'm curious about. And so I gave it a whirl. OnlyFans is catching on during the COVID-19 quarantine. The company told Forbes that it's getting 150,000 new users a day. It's a relatively straightforward way to make a little money from erotic photos and videos. I'm experimenting.  You know, I'm still trying to figure out like what exactly I wanted What Ryzenwitz and new OnlyFans users are engaging in lives under the big umbrella that covers sex work. Though OnlyFans has gotten some mainstream attention during COVID-19. A number of sex workers found their way to the site and websites like it years ago. It's just another tool for navigating a world that stigmatizes and outlaws parts of their work. But it's also a milestone in the story of how sex workers use the Internet's many technological devices to thwart middlemen and vice police to apply their trade in safer and more autonomous ways. So many more women are able to be their own producers now. Constance Penley is a professor at the University of California, Santa Barbara. In the early 1990s, she and her colleagues sought to give pornography the same study as other mediums in the film and media studies department. Since then, she's taught a porn 101 class and researched its history and importance to culture. With the rise of camming, there's been an extraordinary power shift in the industry away from studios, away from bigger producers, the bigger agents, distributors. And now it's much more in the hands of people who may perform in adult industry films. But that's not the main part of their living. Do you know anything about the history of webcam? Is there like a... I am the living history of webcam. No, but truly, I mean, I was doing analog webcam at the Lusty Lady Theater in San Francisco, it was like 2009. Susie Q's career tracks what the very transition Penley has been writing about. She started her career at the Lusty Lady Theater, a strip club owned by strippers. It was the job that I got right out of the recession. I had my liberal arts degree in hand and I was no longer going to put up with retail and things got a lot better. People literally walked in off the streets and opened a door, put a dollar in the slot and saw my naked body and we had a conversation through glass. But the peep show was failing. We weren't getting the money. We were not hitting the numbers. We were all making like just above minimum wage aside from what we can hustle from our individual like private shows. Then a pornographic website called kink.com was looking for webcam performers. I was one of the first generation of kink live girls.  There was like the Bordello that had like a cow skull in it, a stripper pole. There was the medical set. It was a whole deal and it was a completely unsustainable business model. So that shut down. Leaner sites came, but the payouts weren't always high enough to make it a priority for performers. Meanwhile, Susie Q saw the rise of social media platforms in real time happening all around her in San Francisco and Silicon Valley. Most of my clients were Silicon Valley tech industry folks. I had a podcast. I was really interested in this intersection between technology and sex work. Then in 2011, a new app debuted in the App Store. Snapchat was the first platform we had that had content that would disappear, that you could kind of eat.  It just it begged for it, right? Podcasting was another technology with low barriers to entry that allowed Susie Q to interact with her fans and get paid directly. I had a way for people to have a recurring monthly charge on PayPal that would then support the podcast or get them access to premium snap feed or whatever. Then came mainstream camera sites that offered similar autonomy, allowing performers to keep about 70 to 80% of what they earned through tips and private messaging. Part of Susie Q's webcam business is done through a website called Model Centro, which owns fancentro. It generally works the same way as only fans. But Model Centro really created essentially the adult industry's square space and the ability to just plug and play your own site where you could feature your own content. And then users can access that via their smartphones. That really changed the game. Camming is just one part of a sex worker's business. Performers also do studio films, stripping, escorting, making appearances, selling merchandise and even creating Amazon wish lists. The more eyeballs means the more popularity and the more popularity means the higher the rates across the board. There are ways in which the workers in the adult industry have to be even more creative in their precarity than a lot of other people because of the stigmatization, because of the legal status and all of that. But for artists, sometimes constraints can push you to be more creative. Instead of studio lighting, cameras may use a desk lamp. Instead of a set, they may use their messy studio apartment. They must choose between a stationary laptop camera shot or go handheld on an iPhone. Currently, right now, while we're in lockdown, I feel like everyone is creating their like auteur porno science projects. We're all at home being like, OK, what do I got? I've got the cell phone. I've got this makeup brush. Yes, we're doing an ASMR makeup brush. Sure, that's instruction for you today. You know, it's just like what it's such a creative challenge. Sex workers have always had to be creative to survive. Before the mainstream Internet, sex work was done mostly on the street through pimps and was dangerous. But when sex workers got online, they were able to cut out the middleman, screen clients and create a world for themselves that was more lucrative and safer.  You can create even more authenticity because you are speaking to someone.  If I go live for only my fans, it's wonderful. It's just like hanging out with the gang. Hey, guys, I got this new body wash. Let's see if let's see. You know, it's funny. I've been on social media. I'm like super active on Twitter, have been for a really long time. Only fans is like the nicest place on the Internet for me right now. Like, buy a lot. People come to have a good time. Like, they come to say nice things and be nice to me and each other as far as I can tell. Like, I get compliments. I get money. Like, it's it's nice. We can make sex what we want it to be and there's nothing wrong with that. There's nothing shameful about that. It's a beautiful thing to make meaning of our own sex lives.


Hey everyone, we are back and we are going to show you how to install the Geo VDBC for the Geo Alarm System. As you can see we've already pre-run the wire here. More than likely at your home it will represent just like this with the wire already pulled so you're just going to be removing a doorbell and basically installing the new one. Our technician Sal here is showing you how to pre-drill the holes. He marked these spots off from putting the back plate on the wall and then just putting a pencil mark where he wanted the holes to be according to the back plate. Very, very easy to do. He's pre-drilling here.  Otherwise if this is just a replacement it's just as easy as swapping it out with the new one. Which is why we didn't show you how to run the wire here. Running the wire would be something that's a little more specialized based on the home. As you can see after pre-drilling the holes he put the anchors in now he's just stripping some wire back to expose the copper a little bit further so that we can get solid connections. He's now attaching the wiring to the back plate here. That is how the doorbell will get power is actually through the back plate it has two connections and he's going to show you here how he got those connected once he puts it in.  And as you can see there the wires are both in both the red and the black wire. He's going to go ahead and tighten the screws into the anchors now so that we can secure that back plate to have it ready for the doorbell to be mounted to it. As you can see it's very very sturdy when you put it in there it doesn't move so it's going to be very secure for weather and things like that. As you can see he's showing you how to put it in. You start from the top and then you snap it in at the bottom and then there's a little screw underneath the doorbell camera that you're going to need to tighten down like so. And just like that the doorbell is installed and ready for use. If you have any questions or comments please leave them below. Take care and have a good day. Please like and subscribe to our page for helpful programming and installation videos, product reviews, monitoring, products and more. Visit www.gawarm.com or call<PHONE_NUMBER> that's www.g-e-o-a-r-m.com or<PHONE_NUMBER>, Gawarm, the worldwide leader in DIY security.


Welcome to Unit 3 of Sailor.org's Introduction to Financial Accounting. This unit is divided into five subunits and should take about two and a half hours to complete. Earlier this course, you learned that balance sheets, income statements, statements of cash flows and statements of shareholders' equity are all forms of financial statements. You also learned how to record business transactions appropriately. In this unit, you will take that knowledge one step further and learn how to prepare each of these financial statements using information you can gather from a company's everyday business transactions. We'll learn the specifics, for example, of what we call 10Qs and 10Ks. 10Qs are quarterly financial statements, and 10Ks are the annual financial statements. Companies like Starbucks, Nike, or Johnson & Johnson have for the public and their investors. Can you imagine the time and attention to detail that accountants at these companies have to use to prepare these statements? Or can you imagine what would happen if an error were made? Accounting can be a serious business. At the end of this unit, you should know all the basic components of a financial statement. You should also be able to take a look at a company's annual report and identify the different types of financial statements it includes. You're doing great. You've already tackled some of the most difficult concepts of financial accounting, so you should be proud of yourself. Now for the rest of the course, we're going to take a look at these concepts in greater detail and with an eye towards real-world applications. So good luck.