What's going on everybody welcome back to the weekly raking show where we go through all the ATP and WTA rankings for the week And it's official now the seedings for the French open are locked in after this week rankings Let's go have a look at the top 10 for the men so no changes this week to the ATB rankings We have no back Jokovic. He's still world number one Daniel Medvedev is number two meaning that he will be the second Seed of the French open with Rafa Nadal and number three meaning that he will be the third seed at the French open Dominic team He's number four the final city pass even after winning Leon last week stays in number five with Alexander's Vera at number six Rubelev at number seven Federer He'll be number eight going into the French open Baratini number nine and Diego Schwartzman rounds out the top ten having a look at the Race to the ATB finals and city pass after winning in Leon adds a few more points to his total stays at number one with Novak Djokovic close behind at number two Rubelev He's at number three Zverev at number four followed very closely behind by Daniel Medvedev Rafa Nadal at number six very close behind Medvedev Karatev He's number seven her catch the Miami open champion number eight Baratini at number nine and Yannick Sinner He drops out of the top ten Casper would jumping into the top ten after winning last week in Geneva Having a look at some of the players that have gone up the rankings this week on the ATP Casper would as I just mentioned winning Geneva he goes back up to a career high ranking of 16 in the world It's a career equalling high ranking because he was at 16 a couple of weeks ago That's five spots higher than last week and Cam Norrie after making the Leon final He goes up four spots number 45 in the world looking some of the players that have dropped down this week them up here He's dropped down four spots to number 40 in the world and Rado Elbot has dropped down nine spots to 88 in the world Having a look now at the WTA rankings for the week and we have no changes Ash Barty She stays at number one meaning that she will be the number one seed of the French open Nemo Sarko at number two Samona Halibut number three But she is not playing the French open she has withdrawn meaning that the number four in the world Sabalenka She'll be the third seed of the French open to fear Kenan She is the number five followed very closely behind by Alina Svetalina at number six Bianca Andrescu She's at number seven Serena Williams number eight in the world Egas Fiontech at number nine followed very closely by Carolina Pliscova rounding up the top ten having a look now at the top ten for the race to the WTA finals The race to Shenzhen again no changes this week with Ash Barty staying at number one Sabalenka at number two followed very closely behind by Osaka at number three Mugaruta. She's number four Egas Fiontech He's number five followed by Jen Brady who is at number six Elise Merton She's still at number seven followed very closely behind Kudamatova at number eight Svetalina is at number nine and Pagola rounds out the top ten this week having a look at some of the players that have Gone up in the rankings this week and Coco Goff. She is at a career high ranking number 25 in the world It's five spots higher than last week after winning last week in Parma So winning a title in Parma. She's gone up and Bodosa She is also at a career high ranking after winning a title last week in Serbia She's at number 34 in the world that is ten spots higher than the previous week Some of the players that have dropped down in the rankings this week Yastremska She has dropped down four spots to 37 in the world still on a provisional Suspension and Putin Seva has dropped down eight spots to number 43 in the world So there you have it there the rankings for the week no changes No big changes for the men or the women this week on the top ten side of things and remember this week The rankings this week mean that these are going to be the seeds going into the French open next week So number two in the world Daniel Medvedev He is the second seed at the French open with Rafa being number three Which means the Rafa might have to play Djokovic in the semi finals if that's the way the draw plays out We'll find out that in a couple of days. Let me know down in the comments below Are you shocked by any of these things are you shocked by any of the results from the week? Cocoa golf career high ranking Bodosa career high ranking are you shocked by any of that? Let me know down the comments below also Let me know down in the comments below you think Medvedev is going to be great at the number two seed at the French open Or do you think it doesn't really matter because Rafa is still the king of clay So no changes to the top ten for either the men or the women going into the French open


From around the globe, it's theCUBE, covering Upgrade 2020, the NTT Research Summit, presented by NTT Research. Welcome back, I'm Stu Miniman and this is theCUBE's coverage of Upgrade 2020. Of course, it's the NTT Research Summit and happy to welcome to the program someone that's watched theCUBE for a long time, but first time on the program, Simon Walsh, he is the new CEO of NTT Americas. Simon, great to see you and thank you so much for joining us. Thanks very much Stu, good to be here, nice to see you. As I mentioned, your previous companies that you've worked for are ones that theCUBE and theCUBE audience are well aware of. As a matter of fact, when I worked for some of those companies, NTT is one of the large global companies that I had the pleasure to interact with over the years, but if you could maybe let's start with just a little bit of your background and as I said, it's only been a few months that you've been the CEO, so what's it like coming into a role like this during the situation that we're all faced with in 2020? Yeah, thank you. I mean, my background is really in the platforms that enable the customers to run their technologies and I've spent some of my time in Europe and in India and then, you know, Latina, the last five plus years in the Americas, I have to say, I really enjoy it. It's a much better environment and if I think about it from a GDP and an economy perspective, it's a really dynamic place to work. I've worked with companies, you know, headquartered from Europe, running America's and I've worked with companies that were headquartered in the Americas running some of the European businesses. So I've crossed the continents, if you like. And I recently joined NTT and I have to say, you know, it was a pretty lengthy process to explore, but that was partly interviews and due diligence because you want to make sure that, you know, you're buying into a company that, you know, number one, you can have a cultural compatibility with but also somebody who you see really investing in technology that can solve for, you know, the business agenda of the markets. So that's really a bit about my background. And then, you know, joining, I mean, I literally joined last week of June. So my whole time has been through lockdown in terms of employment. It's been very unique taking on a new post exclusively remote. And I was a bit worried, you know, at a human level, just, you know, how do you connect with people? What I would comment is I've actually had the ability to really meet a lot more people in person because you can physically get to people's schedules a lot easier. So that's certainly helped. You know, and I've done my activities of meeting our clients. So they've been very amenable to connecting, talking to our business partners and spending, you know, considerable amount of time with my colleagues in the Americas and around the world. And it's actually been very rewarding. I think, funnily enough, you're probably physically closer because you're on a screen and you're probably like 24 inches away from each other. Whereas in a meeting room, you'd be the other side of a table. So it's been unique, but so far so good. Well, yeah, absolutely. The new abnormal as we've sometimes say, we're all used to looking in the screens all day, talking to various people there. The impact on business though has been, you know, obviously a lot of different things depending on the company. But that discussion of digital transformation, a few years ago, it was like, oh, I don't know if it's real. Is it a buzzword? But the spotlight that's been shown here in 2020 is what is real and what is not. Leveraging cloud services, giving people agility, being able to react fast because boy in 2020, if we needed to react fast. So help bring us inside a little bit. And your time there, the discussions you're having with customers, that adoption, moving along that journey for digital transformation, the impact that you're seeing and how's entity helping its customers as they need to accelerate and respond to the realities that we see today. Yeah. So you're right, Stu. I mean, digital disruption has been ongoing for multiple years. We used to call it technology and change. And now we call it digital disruption or digital transformation. So it's not necessarily new. I think the thing that's really accelerated in 2020, as a consequence of the pandemic is really the word distributed in that customers are undertaking their digital transformations, understanding what it is to modernize processes, modernize the customer experience. And then they're finding that actually they don't meet in a boardroom and discuss the performance of the business. So they now need to have distributed access to data. And I think the topics that we see very prevalent is the distributed nature of the workforce. And obviously there's always been a field workforce and we've had systems, CRM systems and other systems that were built for a distributed workforce. But now we have to think about our supply chain management systems and our HR systems, the P and L and all of the activities that a business undertakes with an entirely distributed workforce. And it's quite abnormal. And I think what we've learned is where is the data? And how do I amalgamate data from distributed systems? And so I see, and we're doing a lot of work with our clients relating to digital transformation, but really about how do I join data from system A to system F in a distributed manner? And most importantly, securely, timely and in an interface that is usable. And it sounds really easy. It's like, oh, great. Yeah, it's just two different data points, connect them together, make it secure, make it visible, create transparency. But we all know that the world is full of, you know, technical debt, legacy systems and platforms, very expensive and significant historical investments. And those things don't modernize themselves overnight. And quite often the dollars to modernize them don't justify themselves. So we then end up layering on, you know, new technology. So, you know, what I'm seeing in digital transformation is really about how do we handle distributed data, distributed decision-making and how do we do that in a secure manner and through an interface that is user-friendly? Yeah, we obviously know that there's had to be some prioritization. You know, the joke I've had, everybody came into 2020 with, okay, here's what I'm gonna do for the first half of the year. Here's the objectives that I have. And we kind of throw those in the shredder rather early on. Number one priority I still hear, it was probably that the number one priority coming into the year and it stays there. And you've mentioned it multiple times.  Are there certain projects that just go on hold? Are there certain ones that get front and center? Obviously, you know, that distributed work from anywhere, telemedicine, you know, teach and learn from anywhere have been top of mind. But any other key learnings you're finding or prioritization changes, some of which are gonna probably stay with us, you know, for the long term. Absolutely. We've definitely seen to you customers reprioritizing. And I think there is obviously an inevitability to this as a consequence of the pandemic. I mean, if you were undertaking, you know, a campus upgrade, you might just put that on pause for the moment and we've absolutely seen that. But what we've really seen as a prioritization has been how do we get our information to our users, whether the user is a customer or whether the user is an employee. You know, there's examples where there's lots of companies who say they've got like online detail, great. But now they've got to do curbside pickup because they've actually got inventory in the stores but the stores couldn't open. So what you've seen is a reprioritization to say, well, when we look at our inventory management and the supply chain systems, are we factoring in that the inventory we have in a store could also be seen as inventory across the stores. And in fact, what we've really got now is a distributed warehouse. We've got inventory in the warehouse like wholesale ready for distribution. And then we've got inventory in a store retail ready for consumer consumption. Well, we don't want that to be separate inventory. We want that to be holistic. And then how do we enable any consumer anywhere to be able to arrange for curbside pickup which we didn't used to do because we would come into the store or arrange for mail order. But the inventory may come from, I may send something from San Francisco to somebody in Boston because it was in a store in inventory in San Francisco. Now, sure, it's got some freight cost but I've also got some other efficiency savings and I'm reducing my working capital and my inventory expense. So we've seen prioritization for really how to take advantage of this. I come back to it, this word distributed is very simple in principle but everything is now working on a new dynamic. So that's some of the prioritization we've seen. You mentioned one of the things that might get put on hold is, wait, if I was doing a corporate network update that might not be the first thing. We absolutely, we've gotten some great data on just the changing traffic patterns of the internet but the network is so critically important. Everybody from home is dealing with children doing their Zoom classrooms while we're trying to do video meetings. NTT obviously has a strong network component to what its business is. So to help us understand the services that are important there, what you're working with customers and how has this kind of transformed some of those activities? Yeah, sure, thank you. You're so right. I mean, I have to say I'd just like to pay my respects to colleagues and fellow workers around the world who are not just working from home but also homeschooling in parallel. Our kids are fled the nest, they're working from the cells now. So we don't have the extra activity of homeschooling but I can really have a lot of respect for colleagues who are trying to do both. It's a real fine art. And we've seen a lot of, actually just talking of reprioritization, we've seen a lot of companies including ourselves. So say to our colleagues, look after your children, homeschool them, do everything you can to support your families and then get to your work. So that reprioritization just in behavior has been a key change that we've seen a lot of people do. That flexibility to work is something you do, not somewhere you go. And therefore, as long as the work is done, we can flex around your needs as a family. So that's one prioritization we've seen actually. But to your point on the network, it's quite amusing to me that we've been for years now talking about cloud on demand, subscription services and actually the one asset that you need to really enable cloud is the network and it's historically been the least cloud like that you could possibly imagine because you still need to specify a physical connection. You still need to specify a bandwidth about the value. You still need to specify the number of devices you're going to attach to it. I think this is really a monstrous change that we're going to experience and really are experiencing the network as a service. I mean, we talk about IaaS, Paz, SAS, but what happened to NAS? I mean, really, did we just think that everything was about computing software? The network is the underpinner and so really we see a big change and this is where we've been very busy in the network as a service, enabling customers to have dynamic reallocation of resources on the network so that they can prioritize traffic, prioritize content, prioritize events. A lot of customers are now doing activities such as hosting their own event, their own digital conference and you want to prioritize what the user experience is when you host one of those events over perhaps a back office process that can quite frankly wait a few days. So we see a significant opportunity. This is where we've been very busy the last few months in really building out much more dynamic network as a service solutions. The cloud network and I think the whole software defined network agenda has materially accelerated. That's one major area. And then the other area has just been the phenomenal shift to IP voice and soft phone and actually almost the deletion of the phone in its entirety. Everybody using teams or Skype or Google Hangouts to really use as their collaboration mechanism. And then we're providing all the underlying transportation layer, but as IP voice creates a much more integrated collaboration experience and it creates a cost saving because you're taking away the classic voice services. Yeah, Simon, boy, I'm excited for that. I remember when I got my first blackberry and they were trying to sell me some things. I'm like, wait, this is an internet endpoint. I can do all of these things there. And of course, it's taken the last dozen years if gone a certain far, and we always joke. It's like smart phones, we don't use them for phones anymore. We use them for all the messaging and all those services. So the data and the network are so critically important. Simon, I want to turn to, you know, upgrade 2020. And I want to be excited about this, you know, we've talked about, you know, the major impacts of what's happened in 2020 and we're looking at the here and now. But it's great in technology when we get to be able to look forward and look at some of the opportunities out there. So I'd love to hear from your standpoint some of the areas, what's exciting you, what's exciting that we can look forward to some of the areas and pockets of research that we see at the event. Yeah, thank you, Stu. You know, I think what I like about our event is the investment that we make to work with, you know, scientific community, academia and really invest in, you know, forward-looking, future-proofing, you know, how physics and different technologies might play a role in the future.  I think the areas that particularly appealing to me on a personal level, just the whole thing of quantum computing, this is, you know, I know we're already exploring the capabilities of quantum computing in, you know, some labs and some academia centers and really to understand and go, how can we take advantage of that? But I think if you then say, and you take another area that we're exploring through the event, you know, biosciences, if you then take the two together and you think, okay, how do we take quantum computing and we take biosciences and you think about healthcare and then you think about the pandemic, you know, are there things that we can do with simulations and technologies in the future that really would give us a greater comprehension and ability to accelerate understanding, understand, accelerate testing and then really contribute to, you know, the health and welfare of society. And I think that's really quite an exciting area for us. So that's a specific topic that, you know, I'm particularly interested in. I'm glad to see us doing a lot in that space, quantum computing as well as, you know, biosciences. And I'd say, you know, one other area where I still think we're all trying to ascertain, you know, how it serves the business is really the area of blockchain. I think this is intriguing. I'm still mentally trying to master the subject. No amount of white papers has managed to overcome the topic in my brain yet. So I'm still working on it. And then I think cryptography, I come back to the same subject security. I mean, we are dependent as citizens, businesses and nations on technology now. And our data is available, how we secure it, how we make sure that it's encrypted is absolutely gonna be critical. You see an increasing push nationally and globally to ensure that there is, you know, security of data. And I think the subject of cryptography and how we go forward with, you know, beyond 128 bit is gonna be a very difficult and critical subject. So these are the areas I'm very impressed with. Wonderful. Simon, I wanna give you the final word from Upgrade 2020. Yeah, thanks, Joe. Just thanks very much to anybody that's attending. What you'll find through various workshops is lots of insight, you know, from strategic partners, from research scientists, from academia, from ourselves. So thank you very much for participating. You know, we always value your feedback. So please tell us what we could do to improve the content to help you with your businesses. And we look forward and hope that everybody stays safe. Thank you for connecting with us virtually. Well, Simon Walsh, thank you so much. Great having a conversation and glad to have you in our CUBE alumni now. Thank you very much, too. Have a good day. All right, and stay tuned. More coverage from Upgrade 2020. I'm Stu Miniman and thanks as always for watching theCUBE.


Hello, everyone. I'm Yu Hao from the University of California, Riverside. And I'm excited to share with you our paper titled This Describe Principle Automated Static Generation of Cisco, Description of Kernel Drivers. Currently, I'm a final year PhD candidate at the UC Riverside under the supervision of Professor Zhiyun Qian. And I focus on the Linux kernel security kernel filing, symbolic execution, and static analysis. And I have published some paper in the top academic conference of computer security, for example, SNP, CCS, and DSS, and the software engineering, EECC, and FIC. As we go deeper into our presentation, I would like to provide you with some background and motivation for our work. First is the CCS color, the state of the art operating system kernel father, has found more than 4,600 bucks in the Linux kernel over the past few years. One necessary component of CCS color is a collection of CCS call description, which includes the CCS calls, the argument of them, and the dependency between them. So however, to our knowledge, current CCS call description are largely written manually, which is both time consuming and the error point. So now I would show an example CCS call description for the QVM driver, which includes the following necessary components. The first thing is the CCS call interface, which allows user space application to interact with the driver. For example, we can see the open CCS call open and the CCS call error control here, which are the most common one. And there also can be read, write, and others. The next is the device file name here, which is used as an argument in the CCS call open. For example, here is a slash dev slash QVM. The next is the command value, which decides the subinterface of error control. And it's the value of the second argument of the error control. Treating them as separate CCS call interface allows CCS caller to generate a test case more effectively. Then next is the argument type, which are other arguments to the CCS call interface. For example, the third argument of error control. Here is, for example, the QVM underscore user space underscore memory underscore region, which is declared in live file. The last one is the explicit dependency between those system calls, mainly involving file descriptors being returned from one CCS call interface. For example, here is a return value of CCS call open. And used in another one, for example, the first argument of the error control. Explicit dependency allows CCS caller to generate valid test cases. Note that the file descriptor can also be returned by CCS call interface other than open for some complex driver. For example, here, this error control could also return file descriptor, which is fd underscore QVMVM here, which will be used as the first argument of next error control. So we refer to such dependencies specifically as non-open file descriptor dependency. Note that it is almost impossible to fuzz those CCS call interface correctly without knowing this non-open file descriptor dependency. So since current CCS call descriptions are largely written manually, and not all kernel drivers have manually created CCS call descriptions, especially compared to the kernel driver. The kernel driver accounts for about a 70% line of code of the kernel. So the goal of this work is to replace this step. So for those human, we would like to replace with our two CCS describe. We design a new tool, CCS describe, which is able to statically, accurately, and automatically generate CCS call description for the Linux kernel driver. CCS describe only needs a comparable kernel or even single module. And it can directly generate CCS call CCS color compatible CCS call descriptions. And the generate CCS call descriptions are better than manually created CCS color description in some degree and closest to the ground truth. So the key insight of the CCS describe is that we summarize and model the programming conventions regarding the kernel driver development. This allows us to understand how a kernel driver is initialized and how it shows or it interface construct. At a high level, we can then statically reconstruct the initialization of a kernel driver by first following the summarize initialization process. Now, let me take a closer look at the device driver in the Linux kernel. There are three first level type of device in the Linux kernel, character block and the map. And in our work, we consider character device and block device because they can be accessed from user space by the device file in the slash style. The figure shows the results of LSAL in the slash style, which lists the device files. And here, the B and the C here means the character device or the block device. And the two number, the two number means for each device file as a major number and as a minor number. And there's a combination of major number and a minor number. It's called the device number. The device number not only uniquely identify a device and its file name, but it's also associated with a set of Cisco handlers. For example, the IO control. So with those device numbers, we can know the target function of the IO control. So the stream likes, for example, PDMX and PPR the device file names. So then, we go a little deeper into the south code of the device drivers. In Linux, driver are in the kernel modules. And each kernel module have well-marked entry and exit point, usually defined by macros. Such as the module in the here. And the module exit is for the exit point. A single driver is usually defined within a single kernel module. By the way, it's also possible that a driver is defined across multiple kernel modules that have a dependency between each other. Here, we only show a simple example. We can see that a driver's device file is initialized in the module interface function at line six to the line 11. So which involves the creation of two objects. One object corresponds to the, we can call it driver, which is a strike CDL here. And another is corresponding to the device, which is a strike device here. And for the strike CDL, which would define the related Cisco handler later. For example, here, the CDL we used in this function. And finally, it would define a related Cisco handler. And the device file name would define the device structure. So for example, the device object would use here. And finally, set the device file name. So another important thing is each device must have a unique device number. For example, the line six. We can say this is the device number for the driver. And so this device number can decide both the device file name and the Cisco handlers. And we can also use this device number to pair both the driver structure and the device structure. And then if we use two Cisco, for example, to open this device file and then have control. So if there are two Cisco like that from user space, and finally, they would call to the Cisco handler here. So if they open this device file, the Cisco handler would define here. That's how the device driver works in the South Code level. Next, I will show you the CCD-Scribe design. The core design of the CCD-Scribe is based on the modeling of a well-established contract between the core kernel and the driver size we just introduced. So we have two analysis phase. In the kernel module analysis phase, we can recover the Cisco handler and the device file name. And in the Cisco handler analysis phase, we can recover the command value, argument type, and additional Cisco handlers. First is the kernel module analysis phase. CCD-Scribe can detect the kernel module by their initialization function by this micro module unit. And then CCD-Scribe recognizes the existing of any kernel driver and recovers the basic interface created and exported to the user space, which is the supported CCD-Scribe. For example, in this driver, it supports the open and idle control. And also, it would recover the device file name. As we show in the figure, we know that there are two types of objects that are defined during the initialization of a kernel driver. And they collectively defend the basic driver interface. Our goal is to identify the two types of the objects and associate them. So one is what we just called the driver object, which, for example, the CDEV structure for the character or genetic for the black device. Another type is the device object, which is the device structure device. And to pair those two types of the object, we rely on the device number assigned to each type of object. Now we can track both driver and the device object by the type as Josh mentioned. And we can simply expect their relational critical fields at the time when the object are registered to recover what we want, what we need. So CISCAL handler are stored in the file operation structures and which are assigned to the driver object. And the device file name are stored in the device object. And for each discovered CISCAL handler, CISCAS describe attempts to recover additional detail about those interface. This includes the command value under the argument type supported by the L control handler. And in addition, CISCAS describe can recover additional CISCAL handlers, which can be needed to recover the non-open file descriptor dependency we just mentioned. And finally, CISCAS describe can translate to those things we just found into the CISCAL description directly used by the CISCALer. For most counterdrivers, the main driver logic is encoded in the IOControl CISCAL handler. So we identify the command value of IOControl by checking their use in switch case statement if condition. For argument type, we model the common function, common counter function such as a copy from user or copy to user to achieve this in the line 30 or 34. We can see the destination argument type of the copy from user is the structure, is this one structure xx underscore type. So which should be the, which under the command value are same d underscore one. So this allow us to infer the argument type. Then the next thing is to recover the additional CISCAL handler. So in addition to the module interfunction, CISCAL handler themselves can also create and register additional CISCAL handler. This is the most common in IOControl handler where additional structure file object are created. And inside our structure file object, there is a pointer points to the structure file operation. So which is corresponding to the set of CISCAL handler associated with this file object. So in addition, as shown in the figure above, we can see that typically a structure file object is paired with a file descriptor that will be returned to the user space. And for example, in the figure below the line 37 and 41, we can say that IOControl handler with the command value are same d underscore two as create a file descriptor and file object and pair them through a function called file fd underscore install. And then it returns the fd to the user space. So next I would show you the evaluation results of the CISCAL describe. First, we presented overall results of the CISCAL description generated by CISCAL describe. Later, we would also compare them against the results from other static solution, for example, DPUs and dynamic solution, for example, KSG as well as CISCAL description, which is a manual created CISCAL description from the official CISCAL report. And here the CISCAL configuration is from CISCAL and tries to enable as many as possible drivers in QMU. As we know that kernel without yes config cannot boot but dynamic solution need a bootable kernel. So we compare results at a CISCAL config also. Before we compare CISCAL describe with other static solution, DPUs, I first briefly introduce overall workflow of it about how to generate a CISCAL description. First, DPUs would identify CISCAL handler structure from a per-defender list of structure type. For example, the figure in the left. Second, DPUs would identify the corresponding device file name, which is any constant string used near the reference of the structure. For example, here, the string in the right figure. Finally, DPUs would apply an inter-procedure static analysis to CISCAL handler to recover the argument. So in the high level, there are some advantage of this describe compared against the DPUs. The first and the most important difference is the modeling of the kernel driver. Instead of use a per-defender heuristic list of structure type, CISCAL describe is based on the well-established contract between the core kernel and the drivers. So this describe could recover CISCAL handler and the device file name reasonably, which means the last positive or first negative for the CISCAL handler and the device file names compared to the DPUs. Another benefit is that CISCAL describe against a more accurate indirect CAL resolution from the kernel module analysis phase, which improves the results later when recovering the argument of CISCAL handler. Since DPUs do not handle indirect CAL, so it would miss some command value and argument type, which located in some indirect CAL. Another issue of the per-defender heuristic list of the structure type is the list is likely not compatible with the newer kernel. Meanwhile, the contract CISCAL describe based on is unlikely changed. So it can work on the newer kernel. And another thing is CISCAL describe could recover non-open file descriptor dependency, which means more CISCAL handlers. Besides CISCAL describe directly generated CISCAL compatible CISCAL descriptions. Since our evaluation is based on a new version of Linux kernel, which is 5.12, we had to port DPUs to a new version of LVM, which is required by Linux 5.12. We also fix some issues in the DPUs under the fixed version. It's marked as DPUs underscore F. The issues are mainly under two categories. First is correcting hard-coded offset for certain types that have changed in the early in the kernel 5.12. Second is fixing failed tracking of copy from user destination object due to changes in compiled LVM bit code. So we can say that CISCAL describe recovers less CISCAL handlers structure than DPUs or DPUs fix. But however, in fact, most CISCAL handlers structure found by DPUs or DPUs fix are actually false positive. Given that they require only 48 or 60 device file name, typically it should be almost one by one. And in order to understand the correctness of the generated CISCAL description of different solutions, we manually collect the ground truth and take a deeper look at those details. So we randomly pick 100 kernel driver as database for the compression against the DPUs. And for the ground truth collection to mitigate the potential errors we make during the process, we always cross validate with the CISCAL description, generate with CISCAL describe and from CISCAL, which is manually once, and to see whether we missed anything. Overall, it takes more than one person months to collect the ground truth for 100 drivers. To our knowledge, no other work has built a ground truth data set for the evaluation. And we can say the results are expected as our high-level compression. CISCAL describe has a significant advantage in all aspects compared to the DPUs. As for the finding compression, we pick the 30 out of the 100 kernel driver based on whether they are compelled and available in the QML. CISCAL describe has a significant advantage in both coverage and the number of crash, which is expected given the accuracy results. It is worth noting that CISCAL describe achieve much more coverage and number of crashes for QBM than the DPUs, because CISCAL describe recovered three non-open file descriptor dependency for the QBM. Then we would compare CISCAL describe against the dynamic solution, for example, the KSG. Again, I first introduce our workflow. First, the KSG would scan all the device file available under the slash dial, for example, the figure in the left. And the second, they would hook the CISCAL open on those device files and get the CISCAL handler structure, for example, the figure in the right. Finally, they would apply an intra-procedure symbolic execution to CISCAL handlers to recover the argument. In the high level, there are also some advantage of CISCAL describe compared against the KSG. The biggest differences between CISCAL describe and the KSG is that CISCAL describe is static solution and the KSG is a dynamic solution. So KSG requires a compatible portable kernel, and which can run in a QML also or some physical machine. And dynamic instrumentation is also necessary, since it requires a whole kernel. So it cannot work if there is only a single loadable module. Besides this fundamental difference, the dynamic solution also needs modeling of the kernel driver. It's the same as the static solution. And the KSG, however, only has a limited modeling, which brings some false negative or even false positive of the CISCAL handler recovered by KSG. Another limitation of dynamic solution is it does not support all-compiled modules, which requires additional dependence. For example, we need to plug in some related hardware, and then the kernel module would the device file would appear under the slash dial. Dynamic instrumentation also means that KSG cannot directly work on the kernel with some fixed configuration, for example, the Android kernel. The lack of the inter-procedure analysis make KSG have a lot of false negative when recovered, command value, and the argument type. So we can say in the CISCAL configuration, CISC describe can recover 185 CISCAL handler while KSG recovers 88 CISCAL handlers. And the region of more CISCAL handlers found by CISC describe belongs to what we just mentioned, the region we just mentioned. We also take a deeper look after those results. To be fair against the KSG, we choose to include a subset of the 100 drivers that are compiled with CISCAL configuration, which is 70 drivers, and the other three are compiled only under the OES configuration. We can say the results are also expected as our high-level comparison. KSG has a false negative in all aspects, especially for the command value and argument type because of their lack of support of the inter-procedure analysis. And because the CISCAL description generated by KSG, in many cases, incorrectly associate different drivers with the same set of CISCAL handlers. So we compare against KSG by finding the whole kernel during all available descriptions. And CISC describe had better results in both coverage and the number of crashes again. And we also try to compare a CISC describe with the CISCAL description. And because 57 drivers are missed completely in the CISCAL description, so to be fair against them, we choose to include a subset of drivers that are covered by them, so which is 43 drivers. And the overall results CISC describe generate either more command values or more argument types for 13 drivers. And so we try to analysis those 13 drivers to understand why we generate more. And we found some bugs in their CISCAL descriptions, which is generated by humans. So we summarize the results by the type of bugs for those drivers, which is identified by their conscious funding of control handlers. And then we can say that CISC describe driver 78 missed command value or argument type across a total of 13 drivers. In addition, we see manual CISCAL descriptions have three positive with regard to the argument type across two drivers. And so the result means that ongoing human maintenance is needed, but however, it's almost no one to do that. And we also find that only one of those bugs, this one, is eventually fixed on January 2022 before we started to report it to them. And this analysis shows that those CISCAL description bugs can persist over sometimes. And so far, we have reported all the bugs to the CISCAL and all which are fixed. And we also shared our generated CISCAL description to them. Then we inspect the gap between the CISC describe and the ground truth. And summarize the reason which will be helpful for the future improvement of the CISC describe. For CISCAL handler, the major reason for the false negative is that CISCAL handler structure take dynamic construct variables. For the device file name, the main reason for the false negative is the device file names are also constructed dynamically. As for the false positive, the reason is that their major number or device number are generated dynamically, so we cannot match the driver object and device object accurately. For the command value, the false negative of the CISCAL handler would bring a false negative of the command value. And the second reason is the non-trivial use of the command value, which bring both false positive and the false negative. For example, in the figure above, there are some calculation on the command value before the use. And another example is the figure below. There is a function pointer array for each command value, so we cannot trigger, we cannot track them. For the argument type, the main false negative is from the false negative of the CISCAL handler of the command values. Besides the incomplete data flow tracking of the failures to model the additional functions, which is defined in the inline assembly code. For example, the getUser, which could also, which is similar like the copy from user. And for the finding results, CISCAL still make significant improvement in our coverage compared with the CISCALer descriptions. However, more code coverage makes sense, but not means more code coverage would directly means find more bugs. So CISCALer achieves a fewer crashes than the CISCALer description, because the manually curated description can include things that are out of scope for the current CISCALer. And overall, the ground truth results are better with a sub aspect to both coverage and the number of crashes compared with CISCALer. This is what CISCALer describes. We would also try to generate the CISCAL description for the Android kernel for Pico 6. But however, one thing is, when finding Pico 6 kernel crashes are captured by the RAM dump model in the Pico kernel. And there's no, not any public document about it. So we don't know the root cause of those bugs. And here are some examples of the bugs during the finding of the Pico 6 kernel. And then the next is the limitation and the future work. First is for the argument, there would be some specific value or value range. We haven't handled this in our tool now. And then we only support the most common CISCAL error control, so we would support other CISCAL, like the read, write in the next step. Besides, there are some other explicit dependencies. Besides, we would also consider CISCAL for other components in the kernel. For example, the network device file system BPF and something to fuzz them. So we open source over to in this repo. Finally, there are three take away of our presentations. We designed new tools described to generate CISCAL description for Linux kernel driver, and which can significantly improve the effectiveness of the fuzzing test for the device drivers. This can help identify more bugs in the device drivers. We evaluated the accuracy of CISCAL to describe against other solutions, such as manually created CISCAL description and showcase its effectiveness in drill world. Based on the data gathered after analysis, analyzing hundreds of kernel drivers. And we also open source the implementation of CISCAL described, and this can help other researchers or people in this field to build upon our work. That's all, thank you, Sarah. Any questions or discussion? For the new CISCAL definitions that were built, did those get fed back to CISCAL? Sorry, Chris, to be loud, I cannot hear you clearly. Oh, the new CISCAL fuzzing descriptions that were generated, did those get sent upstream to CISCAL for use generally? You mean the CISCAL description we generate can directly use the CISCAL? Right. Yeah, the CISCAL description we generate can almost directly use the CISCAL, because in CISCAL there are documents about how to add a new CISCAL description. So we need to at least generate some command value in the CISCAL side to make the new one to work. So it's almost directly used in CISCAL. My question is, is this a static tool or a dynamic tool? I see in the previous slides, you construct the relationship between some runtime objects. But I think if you use static analysis, maybe you can get the structure of the input of core modules. This, you mean whether this tool is a totally static solution? Yes. Yeah, our solution is totally static. In fact, when we try to design the tool, we have some consideration that... So if there is, for example, maybe we can use some dynamic solution which may be more straightforward and accurate, but it sometimes needs more engineering work, so we choose not to use them. So in order to make the solution as simple as possible, which can be used in real world, so we only choose the most basic things, and we only use the static solution. So if you have the source code, compatible source code, and then you can generate a physical description without any other requirement, any hardware or something. But I see in your slides, there are some relation construction such as struct file, struct device, right? Yeah. How to do that? You can find the name screen of the driver. Yes. So we can perform a static analysis on the... Our tool is based on the LVM also. So it's a static analysis based on LVM. So we can perform some static analysis on the LVM IR level. And so we can get the type information and some other necessary information we get and perform inter-procedural analysis and track the data flow and something. So for the kernel crashes that you found on the Pixel 6, I'm wondering if you've reported any of those to the Android bug bounty program. In fact, I sent the picture to some employee of them, but they said that in fact there are some files in the phone very fast. And if they can get that file, they have some internal tool to read some information and know the root cause. But for those information, they can do nothing. Okay. Who mentioned that a bunch of the false positives that you got were because the device numbers were dynamically being generated in some cases? Oh, yeah. Do you all have any ideas of how you would address that in the future if you continue to work on this? It's dynamically means... Here means, for example, there are some... Typically, it's possible that there is a function, something like generate a new device number or a major number or something. And then the code would use that number in some other place. So the traditional static analysis is... Maybe it's possible to track the data flow, but it's hard to be very accurate. So in our future work, in fact, I'm doing that now, is I want to apply a symbolic execution, which is more... Accurate, but maybe face the positive solution issue. But since we already have a static analysis, so we can perform symbolic execution based on the results of static analysis. So we only explore limited paths of the driver, and then we can track the more accurate data flow or even value flow of those dynamic construct value to get more accurate results. And in fact, I'm currently working on that now. So that's all.


You know, we've got Matt Zander and we're going to talk about cloud systems, I think, so you know I love the Beatles music and I'm looking forward to the concerts, but yeah I'm a technology guy there and you know clouds big so first of all Matt welcome. Thanks. Thanks very much I actually have to fly home tonight. Oh missing Paul McCartney. I was trying to figure out if I could hawk my My wristband out in the parking lot Absolutely, so we were just talking to Jeff Kenyon, you know two guests ago about about virtual systems and now we have cloud systems as I said It's sometimes tough to kind of squint through all the different marketing terminologies So can you maybe share for us as to how? Cloud systems fits with the you know matrix and virtual and app systems and all these other pieces sure sure So the overall umbrella is something called converge systems, right? And within that you've got vert system app system and cloud system So cloud system can be thought of the single platform on which to build ploy and manage Cloud environments right public private and hybrid cloud environment So it's a it's kind of unique in the industry in that it has a single approach to all various flavors of cloud And it's very open and flexible to meet various customer needs So but at its core we're still talking about a converged infrastructure where I've got compute network and storage, correct? That's correct It's based on converge infrastructure as a foundation element and then we layer on top and integrate with that cloud service Automation software okay, so this is the IMC Software or is this something else? No, it's something different Okay, so it's comprised of some capabilities that folks are used to in the marketplace today like server automation Okay, so this is this is really getting to the heart of what it takes to move from just Infrastructure automation with converged infrastructure all the way up through the application stack for cloud enablement Okay, so when we talked to CIOs, you know, you know management is definitely, you know Maybe security might be the top of mind issue, but management is really kind of one of the chinks in the armor of clouds So can you give us a little bit more color as to how HP? What are you doing in-house? What are you doing through partnerships and alliances to really help, you know manage in a new way? Yep So management is critical right one of the things most CIOs are concerned about is they understand the benefits to start Transitioning the cloud, but they're definitely afraid of sort of leaving in islands would exist today in their environment Right, so you have to be able to bridge from a management perspective into their traditional IT environment and be able to seamlessly collect that In a hybrid environment, which is comprised of traditional IT Public domain resources as needed and as appropriate as well as new private cloud Right, so so so this is a true hybrid cloud environment. So I've got some stuff in my my internal database I'm sorry data center, which called private cloud my external typically service provider I would think that we're doing there or other public cloud provider. That's correct Does it have to be HP product in all of these environments? No, it doesn't that's one of the benefits that HP is bringing to market is we try to build things on an open basis, right? So we're not we're not locking customers into a certain flavor of hypervisor We're not locking customers into a certain flavor of us and we can even work with heterogeneous infrastructure, okay, so so you know the standards for cloud are just starting to you know come out and How are you doing interoperability then between the various environments? So you're right today that the idea of bursting out to a public cloud for example is very pre-standard, right? So what we're what we're doing is working with service providers to create special connectors Okay, that allow us to say if you have a cloud system in your private cloud You can then burst out to a service provider much like we demonstrated yesterday with Savas Okay, and we'll build that out over time as standards evolve to take over that connecter So Savas has a great story Are there any other the service providers that you're talking about here that you can share? You know what options are there out there in the ego so I won't share any specific names today But the rest assured that with our new cloud agile provider program right that will help formulate the basis of a priority list And then you can you can fill in the blanks with some of their names in the industry that will obviously be working with okay So so excellent service providers, you know very critical important and we talked about management Maybe we can touch on security. It's been a real hot-button issue with especially some of the recent outages You know is there we're security fit into this security from our standpoint has to be pervasive throughout a cloud solution Right, and we really encourage folks to ask some challenging questions There's a lot of a lot of PowerPoint floating around explaining how everything's done in the cloud now and everything's taking care of from various vendor approaches Ask the hard questions like what do I do with my physical and virtual environments from a security perspective right many times applications can Be moved to a virtualized environment, but they reside or they rely on a physical instance of a database Right you have to consider security holistically physical virtual Application infrastructure, and we're working all that capability in the cloud system Okay, so so we all know if you've been in the industry, you know in IT for years technologies come and go There's the latest fat, you know cloud and virtualization big big data is a big one But at the end of the day it's all about the people yeah, so the role of the IT administrators traditional silos And you know HP has you know a large workforce and a huge community So I've liked what I've seen on the expert one program that HP has and I'm curious how you know HP really sees the role of the you know traditional IT administrators Fitting into the role of where cloud plays and what you're doing to help you know educate and train that workforce So it's a really good. It's a really good point. I actually just left a session by FICO one of our customers here That's explaining to folks how they've successfully deployed a cloud system And they went into detail about how they've actually created a new role Okay, and their IT organization called the solution administrator, right? So it's it's a combination now of the the world's blurring between storage Networking and server to really enable cloud and HP is working to develop Education programs and certification programs alike to help sort of fuel that new workforce if you will to take advantage of cloud Excellent good So let me see from a cloud standpoint, you know, where do you feel we are from a maturity standpoint? You know, are we past the peak of hype?  Sure I think there's a huge amount of hype right and a lot of confusion that goes along with the hype of the marketplace today I think once you can explain to customers that they may already be on the path to cloud today without realizing it if they're Highly virtualized environment right that's sort of step one to get there And then they could see it as an incremental step right and they realize the benefits I think we're far away from being mature But there's definitely capabilities available today for you to go do a private cloud start small grow tall You know take a workload that you know will be optimal for a cloud environment Prove success within your organization with that and then grow from there great Are there any you know work workloads or specific applications that you'd recommend starting with so certainly test and dev It's itself extremely well to cloud right it's something that most people have in their environments that they're wrestling with Oftentimes tends to be a very rushed service request from a line of business to go do that So that's a natural place to start where you can carve something off start a cloud and it shows it Reminds me a lot of where we were with server virtualization You know many years ago start and test dev move up the stack to higher level environments And you know where Amazon started out is companies that I didn't have to build that infrastructure So I guess the question I have is you know Amazon anybody can take a credit card and kind of just go buy it So you know how is HP making sure it you know transitioning to a financial model that that's more flexible to be able to deploy cloud See what we want to do is armor customers with the flexibility to have their cake you needed to right? So if you build a if you build a cloud system Right you have the on-premise private cloud footprint to take advantage of those workloads that either through compliance or regulatory Concerns you are obligated to keep on premise right you cannot send it off But then when you need to burst for additional capacity and for workloads that maybe it aren't as sensitive and constrained You have that flexibility to go Essentially do the credit card model and burst through through a public domain right so that's the that's the way we see the world We don't see it as an if but a win for hybrid cloud and it's it's all about transitioning our customers to get there No, no, I definitely agree with you there. It's definitely there's many options I mean if you look at the interviews we've done here at the show You know HP has a very broad portfolio and it's not about one or two solutions But there's many environments and many avenues to be able to get that To into your environment, so I guess you know possibly could you share with us?  Yeah, I was pretty excited to see the bursting. Okay capability I mean bursting's a it's an area for HP that for the marketplace in general It's been a lot of people talking and not a lot of people doing. Yeah, that was a particular So I mean I'm a networking guy So when I look at cloud bursting, you know, there's a limited amount of bandwidth that I have between here and there And it's tough to get data from here to there. So so why is this different from, you know, some of the reasons why the you know You know XSP is back in the 90s failed. So what's different? Why can I really get from here to there and share information? Well, you know There's there's a lot of technologies that can limit the effects of bandwidth, right? And you have to ask yourself how is Amazon today so successful by being able to move Capabilities off to their their workloads right and do infrastructure as a service essentially when you burst from a private cloud You're you're creating a similar linkage to what Amazon has to their customer base today Not everybody has a 10 gig pipe out the back, right? And it works quite well with if the application makes sense for it, right? But expect way in optimization is pretty critical for some of that cloud bursting technology Absolutely, absolutely. It's a little bit further up the stack You know and it's something that we're trying to work into the ecosystem as we move forward Yeah, so is there any partners you were working with that you can share on the way in optimization side or not? Not specific to bursting today, but you know HP has relationships with all of the major players there through our alliance This is you know, we saw a demo. So I mean this is not vaporware. This is not, you know proof of concept This is something shipping today. It's scheduled to ship later this year in production But it's something that we can go in and do from a proof-of-concept standpoint and we've proven it out with with Savas Great. So Matt appreciate you sharing with us on cloud systems. Glad we can fit in here exciting technologies here Cloud bursting which is really one of those you know use cases We've been talking about for cloud for the last couple of years, but real deployments of you know How technology can really transform IT. So pretty exciting. Thank you for joining us here in the cube. Thanks very much


Hi everyone. This talk will be about hardness of the learning with errors problem on general and traffic distributions. I am Nico and this is joint work with Tsvika Parkersky. One of the motivations of this work is leakage-resilient cryptography. What happens if the secret key of a scheme was chosen using bad random coins or somehow additional side information about the secret key was later leaked to an adversary? In this talk, we will consider this problem on an assumption level. That is, we will look at a hardness assumption which has built-in leakage-resilient. In effect, many constructions from this hardness assumption will inherit its leakage-resilient. The hardness assumption we consider in this talk is the learning with errors problem, which can be phrased as follows. In the search LWE problem, you are given a uniformly random ZQ matrix A and a vector SA plus E. That is, a noisy vector in the row span of A. The goal is to find the vector S. So we can say that the LWE problem asks you to solve a noisy linear equation system over ZQ. In the standard version of the LWE problem, the vector S is chosen uniformly at random from ZQ to the N and the error vector E comes from a short distribution chi. When A is an N times N matrix, we call N the dimension of the problem and M the number of samples. If we are given O of N log Q samples and the distribution is, say, Q over 4 bounded, then the system will have a unique solution S, except with negligible probability. So it's fair to ask that an adversary recovers the same S that was used to compute SA plus E to win the experiment. In the entropic version of the LWE problem, the vector S is not chosen uniformly at random but rather from a distribution S. The only guarantee we have about S is that it has a certain amount of min entropy. So we might actually think of the distribution S as being chosen adversarily with the only guarantee that it does have a certain amount of min entropy. In the decisional version of the LWE problem, the goal is not to recover the secret vector S but rather to distinguish SA plus E from a uniformly random vector U given the matrix A. Same holds for the entropic version. Let's briefly talk about the error distributions we consider.  Notably, for Gaussian errors, we know reductions from worst case lattice problems to LWE. The approximation factor of the underlying worst case problem relates to a quantity called the modulus to noise ratio alpha. Smaller values of alpha are better as they correspond to harder worst case problems. Furthermore, for Gaussian errors in the regime of m greater n log q, the problem allows re-randomization at the cost of a small increase in alpha. For the techniques in this work, it will be important that the error distribution is Gaussian. So for the rest of this talk, we will entirely focus on Gaussian distributions. By now, LWE has turned out to be one of the most versatile standard assumptions in cryptography. To name just a few, we have constructions of public key encryption, oblivious transfer and multiparty computation, fully homomorphic encryption, attribute-based encryption for all circuits, and non-interactive zero-knowledge from LWE. Offuscation aside, there are rather few primitives which have instantiations from other standard assumptions but not from LWE. In fact, LWE is essentially the only standard assumption from which we know FHE and ABE for all circuits. Another reason for the popularity of the LWE problem is that it is conjectured to be post-quantum secure. That is, we believe that this problem is hard even for efficient quantum algorithms. The problem of LWE with entropic secrets or more generally LWE with secrets that are not chosen uniformly has been studied in literature. All the results in this list are obtained by a reduction from standard LWE to entropic LWE and we'll discuss how these reductions affect the modulus-to-noise ratio. We're interested in the modulus-to-noise ratio for the underlying LWE problem. Applebaum et al. showed that the secret can be chosen from the same distribution as the error without affecting the modulus-to-noise ratio. This is often referred to as the hermit form of LWE. The notion of entropic LWE was first studied in a work by Goldwasser et al. They showed that LWE remains hard if the secret is chosen from a binary entropic distribution of sufficient min entropy. They prove, however, relies on a statistical drowning step and this affects the parameters in an undesirable way. Namely, the modulus-to-noise ratio of the underlying LWE problem increases by a super polynomial factor. Two works of Brachersky et al and Mitiancio provided improved reductions for the case of binary entropic secrets. Their reduction causes only a small parameter loss for the modulus-to-noise ratio. Alvan et al provided a reduction for the slightly more general setting where the entropic distribution is ball-bounded. Their reduction causes a polynomial loss in the modulus-to-noise ratio. All these works left open the case of general entropic distributions. That is, whether entropic LWE is hard for general entropic distributions. This brings us to our results. In this work, we provide a new characterization of the hardness of entropic LWE in terms of a quantity we call noise lossiness, new delta of S. Now, assuming the hardness of standard LWE with dimension k modulus q and Gaussian parameter gamma, we get that entropic LWE with dimension n m samples, same modulus q and Gaussian parameters sigma is hard if the noise lossiness of S is at least k log q plus something super logarithmic in the security parameter. Here delta is a parameter which depends on gamma, m and sigma. Instantiating this, for general distributions, we will find that the noise lossiness of S is lower bounded by min entropy of S minus n log q divided by delta. And we get that entropic LWE is hard for general distributions if the min entropy of S is greater or equal k log q plus this expression in n q, gamma, m and sigma. For our bounded distributions S, we show that the noise lossiness is lower bounded by the min entropy of S minus a constant times square root n times r divided by delta. This constant C is just squared of 2 pi times log E. Consequently, we find that in this setting entropic LWE is hard if the min entropy of S is lower bounded by k log gamma r plus C times gamma squared and m times r divided by sigma. And note that here in the bulb in the bulb bounded or r bounded regime, the entropy bound is actually independent of q. These parameters here are for the search version of the problem. For general min entropy distributions S, hardness of decisional entropic LWE follows directly with the same parameters if q is prime. For our bounded S, we can use a search decision reduction. Now, especially the entropy requirements for general distributions are far from desirable. As h of S is at most n times log q, we need to choose sigma of a similar order as q to get something meaningful here. So one might ask if this strong entropy requirement is actually an artifact of our proof technique maybe. It turns out that this condition is in fact inherent. Our entropy requirement is tied up to an additive term of O of n log security parameter. For the case of composite moduli, we provide matching attacks. This will provide an entropic distribution of secrets with slightly less entropy than what the positive result asks for, for which entropic LWE turns out to be easy. For the case of arbitrary moduli, that is, including prime moduli, we show a black box impossibility. That is, we show that no reduction which only makes black box use of an adversary can establish hardness of entropic LWE from any falsifiable assumption, not just LWE. So completing a table, our work gives a tight characterization in terms of entropy for which distributions of secrets entropic LWE is hard. Now I'll give you an overview of the techniques we use to obtain these results. The central idea in this work is to look at how noise affects the entropic secret directly. So fix an entropic distribution S and at lower case S be chosen from this distribution and let E be a Gaussian error we add on top of S. The noise loss in us is defined as the average conditional min entropy of S given S plus E and it measures the amount of information lost about S when we add Gaussian noise to it. A nice way of thinking about this is in terms of the success probability of a maximum likelihood decoder. For flat distributions S, this decoder decodes S plus E to the S prime in whose VOR noise cell it lies. So if we ask the noise lossness to be large, we essentially require S to be to be a bad error correcting code against Gaussian noise. Our goal will be to show that a sufficiently high noise lossness implies hardness of entropic LWE. So here's an intuition on how we compute the noise lossness of general distributions. The basic question amounts to how many spheres of radius O of delta can you pack into CQ to the N with very little overlap.  That is the min entropy of S minus N log Q divided by delta. In the language of coding theory, this bound on the noise lossness is in fact a strong converse coding theorem for general channels. In the ball bounded setting, the support of the distribution S is confined to a much smaller space. Hence, there will be a much higher overlap of the spheres. So the noise lossness here kicks in a lot sooner. That is, we get non-trivial noise lossness once the min entropy of S is above this constant times square root square root N times R divided by delta. Modulo a small simplification, this is consistent with the converse coding theorem for power constrained Gaussian channels where the power constraint corresponds to the radius R or rather it's square. Essentially all prior works on entropic LWE use lossness arguments and so will we. So let's recall the main ideas. We will replace the uniformly random LWE matrix A with a pseudo random matrix. Then we'll show that adding noise to SA loses information about S. That is, S is not fully specified anymore by A and SA plus E. To construct this pseudo random matrix, we'll take the product of two low ranked matrices B and C and add a discrete Gaussian matrix F. So our pseudo random matrix is the sum of a low ranked matrix BC and a short matrix F. Here this matrix B is either chosen uniformly from ZQ to the N times K or chosen from a discrete Gaussian, whereas the matrix C is chosen uniformly at random. Such a matrix is indistinguishable from a uniformly random matrix under the standard LWE assumption via a simple hybrid argument. We're going to use the following facts about Gaussian distributions. It is well known that the sum of two independent Gaussians is again a Gaussian, though with a different covariance matrix. Adding two independent Gaussians amounts to adding the two covariance matrices. We will take a reverse perspective of this, that is, we want to express a spherical Gaussian as the sum of a target Gaussian and a residual Gaussian. More specifically, for a given matrix F, we want to decompose the spherical Gaussian E with parameter sigma into E1F plus E2. Such that E1 is also a spherical Gaussian, though with a smaller Gaussian parameter sigma 1. And note that if E1 is Gaussian, then E1F is also Gaussian. We can show that such a decomposition exists if sigma is greater or equal the spectral norm of F times sigma 1. On the last slide, I chose such a matrix F from a discrete Gaussian and that's the same distribution or the same F which we will use for this decomposition. So choosing F via a discrete Gaussian will allow us to bound the spectral norm of F by O of gamma times square root of M. We're now ready to sketch our reduction for the hardness of entropic LWE for distributions with a sufficient amount of noise lossiness. So as a first step, as in prior works, we replace the matrix A with the lossy mode BC plus F. And as discussed above, this change goes unnoticed under standard LWE. So instead of giving the adversary matrix A and SA plus E, we choose the matrix A by computing BC plus F and the sample by S times BC plus F plus E. Now we just rewrite this by distributing S on the right hand side. So we compute the right hand side by S times BC plus SF plus E. As we've seen on the last slide, we can decompose the Gaussian error E into E1F plus E2. And as we've just discussed, this is possible as the spectral norm of the matrix F is sufficiently small. Rewriting this again, we obtained the expression S times BC plus S plus E1 times F plus E2. We will now show that S has high min entropy given this information. So from the view of an adversary who sees BC plus F and SBC plus S plus E1F plus E2, S will have high min entropy. Recall that we said earlier that we require an LWE search adversary to find the unique secret S. Thus, if S has high min entropy, any even a computationally unbounded adversary will only have negligible success probability in guessing the correct S. So let's compute this min entropy. Let's for now assume that the matrices BC and F are fixed. Then the information that we give the adversary BC plus F and SBC plus S plus E1F plus E2 can actually be computed from SB and S plus E1. The term E2 doesn't matter anymore because it's an independent Gaussian. It's independent of E1. Now, the matrix B is has rank K. That is, we can describe the term SB with K log Q bits. Therefore, we can apply the min entropy chain rule and compute a lower bound for this conditional min entropy by H of S given S plus E1 minus K log Q. But now the first term is exactly the noise lossness of S with parameter sigma 1. So we can conclude that the entropic LWE search problem is hard if the noise lossiness of S is greater or equal K log Q plus something super logarithmic in the security parameter. Now, we remark that the K log Q term can be improved to something that is actually independent of Q if we have the guarantee that both S and B are short, which will be in the case of our bounded secrets S. So to wrap up, we have seen that LWE with general non-short entropic secrets is still secure, given that we only have a small entropy defect of the distribution of secrets or likewise that we only have a small amount of leakage about the secret. We have identified a property of distributions called noise lossiness, which characterizes under which parameters entropic LWE will be secure. Furthermore, there is an inherent reason why we can only deal with small entropy defects for general distributions, namely they are both matching attacks and a black box impossibility. Finally, LWE or entropic LWE with short secrets tolerates a much higher entropy defect or much higher leakage. Finally, here are some open problems. What can we say if the leakage includes information about the noise term E? Does the black box impossibility result extend to the quantum setting or to quantum reductions? After all, quantum reductions are a staple of lattice-based crypto. And lastly, what about structured variants of LWE, such as ring LWE? Can we prove anything meaningful about entropic variants of these problems? That's all. Thanks.


All right, thank you very much Actually, I think the job that I have first is to ask Ulrich to come up here because he wants to make some announcement for those of you Who will be attending proofs and there should be slides for that somewhere on this laptop? All right here you go Thank you just very quickly So for those of you who have Haven't had enough There's two things coming so tomorrow. There's the proofs workshop in parallel with the FDTC workshop Just two remarks. So after the closing session, there will be a registration desk already open here So if you're registered or if you still want to register come over and Yeah pay for the registration and get your back and Secondly tonight. There's a welcome dinner which will take place in a restaurant This is just to show you where where you can find us at 8 o'clock. It's like 10 minutes walk. I think in this direction Okay, that's also see you Tonight. Thanks. We would like to thank you for being here in Amsterdam. We hope you enjoy the conference and And yeah, well this conference wouldn't have been possible without a whole lot of support that we had First of all, of course from all the personnel here at Berserl-Berlache in particular Vanita who unfortunately had to leave early today So otherwise I would have asked her to come up here and thank her and then even more than that We would like to thank the team of students from Radboud University and riskier who helped at the Registration and help with the microphone. So we would like to ask you to give a round warm of applause for them Yeah, and then I think the one task left for us is to close chess 2018 I hope you all enjoyed it. We hope that you all enjoyed it here And now we can hand over to to Vincent who is one of the people who will be running it next year Vincent here you go Yes Yes, so I'm Vincent Mooney Associate Professor of Electrical and Computer Engineering at Georgia Tech in Atlanta And we're very very happy to be hosting chess in 2019 The website is active so you can find information there. The Sheraton Atlanta hotel will host chess It's a seven-story hotel with over 700 rooms Plenty of space. The martyr train is direct from the airport. It's the 10th stop It's a few blocks from the train. So it's very convenient like a European city Linna Airport is the most busiest airport in the world by volume. So You should be able to find a flight. No problem We've booked the Martin Luther King Center. He's a national hero for civil rights There'll be an exhibit on nonviolent protest techniques available during the conference Banquet on Atlanta was host of the 96 Olympics. There's a lot of sites to see Fox Theater was symphony orchestra Atlanta was the center of railroad production During the US Civil War was burnt down in 1864. There's a lot of museums to see interesting information, but the 20th anniversary year of chess will be in Atlanta there'll be special events and please come with a Sunday session on August 25th and Conference 26 to the 28th. Thank you very much. Yeah, so that's it