Okay. Great. All right, so this is joint work on zero knowledge IPs with linear time prover and polylogic time verifier and joint work with Alessandro Keezer at EPFL and Sikilu from UC Berkeley. Good to the next slide. Not using the pointer. Okay. So this talk is about zero knowledge proofs and arguments. In the setting of zero knowledge proofs, of course, we have a prover and a verifier, and the prover wants to convince the verifier that statement is true. So in this case, we're going to consider MP statements, arithmetic circuits over a finite field, and the prover wants to convince the verifier that these circuits are satisfiable. So the prover knows a secret witness which feeds into this circuit and gives the stated output. So the prover and the verifier are going to interact, exchange a lot of messages in a conversation, and at the end of the conversation, the verifier is going to accept if they were convinced that the prover really knows a witness and the circuit is satisfiable, and if not, they're going to reject. All zero knowledge proofs should have three important properties. We've got completeness, which asks that if the prover is telling the truth and they really know a witness to the circuit, then the verifier should accept. On the other hand, sadness, so if the prover is cheating and the circuit is not satisfiable, then the verifier should reject. And finally, zero knowledge. So throughout the course of this conversation, the verifier shouldn't learn anything more than the fact that the circuit is satisfiable, and in particular, nothing about the witness. So we can ask, what's the ideal zero knowledge proof system in terms of efficiency properties? What's the best that we could possibly do? We'd want a zero knowledge proof which worked for circuits over any finite field, F, and we'd want proving costs for the zero knowledge proof to be roughly the same as the costs of computing your way through the circuit. So it costs n field operations to compute your way through this arithmetic circuit. The prover should cost o of n field operations as well, ideally. And if proving is as fast as computing, we want verification costs and communication costs to be just minimal. So we can set targets for polylog n bits of communication between the prover and the verifier, and polylog n field operations for the verifier. Now, of course, you could try and do better maybe with constant size proofs, but those require really strong assumptions necessarily. So polylog n is a good target under standard assumptions. Now, there's one thing here. The verifier actually has to read the statement that is being verified in full. So to achieve this polylogarithmic verification time, we're also going to add an indexer who just preprocesses the entire circuit once for the verifier so that the verifier doesn't have to read the whole thing. And after this preprocessing has been done, we allow like linear time preprocessing again, then the verifier can run in, say, polylogarithmic time. So this would be our target. Now, people have done lots of work on reducing the proof size and the verification time for zero knowledge proofs. And the really difficult thing has been to get o of n field operations for the prover. And this has been really difficult because lots of popular proof systems use tools like fast Fourier transforms, large fast Fourier transforms with polynomial multiplication for large polynomials, o of n degree polynomials where n is the number of wires in the circuit. And so proof systems like Frey using big read solenoid encodings, other proof systems like what's 16 using like large polynomial multiplications, which means o of n log n field operations from fast Fourier transform algorithms. On the other hand, maybe some other proof systems like bullet proofs are using algebraic commitments, like big medicine commitments where you do a group exponentiation for each wire value in the circuit. And o of n group exponentiation is o of lambda n field operations. So, you know, a lot more than the o of n field operations that we're aiming for. There are some prior works which do achieve this o of n prover time. There are a few of them and I'm just going to show the one with the best verified complexity and proof size here. So, so far, before this work, when you had to achieve o of n field operations prover complexity, and for any epsilon, we could achieve n to the epsilon verified complexity and proof size so you could have any sublinear verified complexity and proof size that you wanted. But this is still only sublinear. It falls short of our target and this proof system didn't achieve zero knowledge either. And, you know, notably, there's only one strategy so far for constructing linear time zero knowledge proofs of this kind. So, this argument system came from an information theoretic proof system, an IOP with very similar complexity parameters, and then was converted into an argument by applying a hashing transformation using some special hash functions which only incur constant computational overhead. So, you can hash n things using o of n field operations. So far, this is the only strategy for constructing linear time zero knowledge proofs to go via this information theoretic and hashing path. So, then the question for us becomes, you know, can we look at the information theoretic IOP construction at the bottom and can we improve the verified complexity, query complexity and add zero knowledge so that we can apply this hashing transformation and get an argument of the type that we would like. So, that was our main challenge in this work, reducing the query complexity, verify complexity and adding zero knowledge. So, here are our results. Of course, I'm talking to you now. So, we managed it. So, we successfully constructed a zero knowledge IOP with a linear time prover. We reduced the verified complexity to poly logarithmic and the number of queries to logarithmic. And, you know, via the same hashing transformation, this gave us an argument with similar complexity parameters. And then, subsequently to our work, people have optimized a little more. Our work is very focused on achieving these goals asymptotically and then, subsequently, people have come up with some more concretely efficient proof systems with the same asymptotics, but something that you will be happy to actually run on your computer. So, let me talk a little bit about how we achieved our result. First, I'll tell you what interactive oracle proofs are. These are very similar to normal zero knowledge proofs or interactive proofs, except that, instead of the verify reading the prover's messages in their entirety, the prover sends proof oracles to the verifier, which you can think of like committed data. And then, the verifier makes queries to all of those proof messages instead of reading them. Now, other than that, the prover and verifier just interact exactly the same as before. And depending on what type of IOP you'd like to construct, we can allow different types of queries on all of the prover's messages. So, our main result is a point query IOP in which the verifier reads different positions of the prover's messages. But as a stepping stone in the construction, we also use tensor query IOPs in which the verifier can request structured linear combinations of the prover's messages. And these are a special case of linear query IOPs where the verifier can request any linear combination. Okay. So prior work used an approach where there was a tensor query IOP with a linear time prover and a somewhat good sublinear verifier. That's the thing you can see in green on the left hand side of the slide. And then, this had to be converted into a point query IOP with a sublinear complexity. So that transformation from a tensor query IOP to a point query IOP makes use of a linear error correcting code. And a special consistency test which checks that, you know, when the tensor query IOP is converted into a point query IOP, you know, nothing really goes wrong in this conversion process. And then after we had the point query IOP, we could just apply this hashing transformation that I mentioned before to get an efficient zero-knowledge argument. Now, the tensor query IOP was pretty good. That wasn't the bottleneck in the final result. But unfortunately, the sublinear verifier complexity in this consistency test in this compiler process led to the sublinear verification costs in our point query IOP. So everything else was fine. Like the proof of time was good enough. There are good enough error correcting codes to make this transformation efficient enough for the prover. But we had to improve the verifier complexity and the query complexity of this point query IOP. So we did that by applying some some proof composition techniques to improve the efficiency of this consistency test. And then once we've had this new improved consistency test into our compiler, we were able to get the verifier complexity that we wanted. We also had to add zero-knowledge to the ingredients in our construction in order to make the final result in zero-knowledge. So we had to make the original tensor query IOP zero-knowledge. And the codes that fed into this compiler procedure, we had to construct some special zero knowledge linear error correcting codes with the right efficiency properties. And this was enough to make our final construction zero-knowledge. So for the rest of the talk, I'm not going to go into much detail about how the underlying ingredients from the previous paperwork only as much as necessary. But I am going to describe how we added zero-knowledge to the tensor query IOP and the error correcting code. And a little about how we applied these proof composition techniques to improve efficiency. So first I'll talk about the tensor IOPs. So in this prior work, we constructed tensor IOPs for circuit satisfiability over a field via the ONCS problem. So this is an MP complete problem that's used to argue about circuit satisfiability in lots of, say, practical zero-knowledge proofs. It involves three matrices, A, B and C, which encode the wiring information from the arithmetic circuit and a witness vector Z, which basically encodes the wire values from the arithmetic circuit. And this circuit satisfiability problem is transformed into a set of linear algebraic conditions with Z and some other vectors ZA, ZB and ZC. So in this tensor query IOP for prior work, the most important thing about this construction is that the proof starts by sending all the witness values from the ONCS instance to the verify who gets to make tensor query access to those. So the first step is pretty basic. And then afterwards, there's some other stuff going on that we don't really care about for the purposes of this talk. Now, if you look at what a tensor query is to any of these witness elements, it's a linear combination of elements and the witness. So obviously a linear combination of witness elements gives you some information about the witness. So the tensor query IOP as it was in this previous work just trivially leaked all kinds of information about the witness. The way we solved this was by making all of the tensor queries just look uniformly random. So our first step was to pad the ONCS instance and witness with randomness. And we did this in a careful way so that after padding, we still had something which satisfied a new augmented ONCS instance. And then after that, we could just run the same protocol as before with minimal changes because we'd maintained this ONCS circuit or circuit satisfiability. So to pad carefully, we introduced some ONCS gadgets, so some tiny ONCS instances, very simple for which we could sample random solutions by sampling AMB uniformly at random. And then you can repeat this many ONCS instance s times according to the number of queries that would have been made to the ONCS witnesses. And then we can pad the original ONCS instance and the original witnesses with vectors that come from these ONCS gadgets. And now, the presence of this peak concatenation on the witness and the PA that you can see on the slide mean that there's a random component to the ONCS witness. So every tensor query that you make looks uniformly random. And if we chose an s large enough, there are enough random parts of this augmented ONCS witness to make all the tensor queries independently and uniformly random. So that was zero knowledge for the tensor query IP. And next I'll talk about modifications that we had to make to the error correcting codes in our construction. So prior work involves this code based compiler where you take the tensor query IP that we had before and then you convert it into a point query IP. So we had to do this by encoding every single message in the tensor query IP using a suitable code. And after this, after we've converted to a point query IP, the verifier is no longer allowed to make the tensor queries that they made before. They can only make point queries. So to simulate the entire tensor query IP protocol, the verifier addresses the tensor queries directly to the prover who just responds with the answers to these queries. So now we have two new problems. Firstly, we have to trust that the prover encoded all the tensor IP proof messages correctly. And secondly, we have to trust that the prover actually provided the correct tensor query answers now that they're sending them by themselves. So in prior work, this is done via a special consistency check like another point query IP. And this was the problem point query IP whose query complexity and verify complexity was too large. But before going on to that, we have to look carefully at these encodings. So what choice of encoding did we use in prior work? We chose a tensor code. You construct a tensor encoding by taking a linear code and then if the original tensor IP proof message was arranged in a hypercube, you could encode each dimension of the tensor IP proof message in this hypercube like one at a time using a base code in every different dimension. So with an error correcting code C. And then we'd get a collection of tensor code words and on the slide, you can see like a collection of tensor code words of rank two, which have been encoded in two different directions. And as part of this consistency check, the verifier would query this new encoded cube in a stripe. And then the efficiency properties of the protocol are directly inherited from the side length of whatever hypercube we chose to begin with. So O of n cubed on the slide, we would get O of n cubed query complexity and verify complexity. So if the original tensor query IP ran in linear time, we want this simulated point query IP where everything's encoded to run in linear time as well. So we need this tensor code to be encodable in linear time. We also want zero knowledge. So queries to this encoding shouldn't leak any information. Now the first requirement is pretty easy to satisfy. If we have a linear time encodable code for which we know constructions by Spielmann or Drucker-Schei, then if t is a constant, this tensor code C to the t is going to be encodable in linear time as well. But the zero knowledge property that queries to the encoding don't leak any information, that part wasn't so obvious. We fixed this by constructing some linear time zero knowledge tensor codes, starting with a zero knowledge base code where if we encoded a message with some appended randomness, then up to B queries of this encoded base code word would just look uniformly random. So starting with a linear time zero knowledge base code, we showed that in a tensor code where the message is arranged in some kind of square or cube, if you arrange the randomness in the right way, then zero knowledge of the code is actually preserved under tensor products. So you can make the same number of queries to the tensor code word that you would have made to the base code and they still look uniformly random. We proved this by investigating some characterizations of what it means for a code to be to be zero knowledge. And as a result of studying these characterizations, we also came up with a new construction of linear time encodable, zero knowledge base codes based on this druckish code. Okay, last, I'm going to talk about how we reduce the query complexity of the consistency test from prior work to get a more efficient verifier and smaller proof size. We've already seen that if you arrange the tensor query, the tensor op messages in our hypercube, then the verifier complexity and communication complexity is just the same as the side length of this cube. And we can only choose a constant dimension for this cube, otherwise we run into problems with with proof of time and your other issues inside the proof. So if we choose to your constant, we can get any sublinear verifier time, but this is still too much. We want logarithmic or polylogarithmic. So what do we do with proof composition? We use another proof system to show that the would have accepted in the original consistency test. And this is going to be more more efficient and use fuel queries and have a more efficient verifier. So in particular, we run the BCG 20 consistency check minus this problematic sublinear number of point queries. Our new instance is the verification equations from from this consistency check. The new witness is the answers to those queries that the verify would have made. And we have a new prover and a new verifier, and they run a very powerful construction of point query IOP or even PCP from 2009, which only makes a constant number of point queries. We have to be a little bit careful here because we know that the original protocols we were dealing with, the original consistency check and tends to query IOP run in linear time. But if we look at the new instance that we have, we only know that the prover time for this new constant query IOP that we were using that runs in polynomial time and not necessarily linear time. So we had to be a little careful here and note that we can choose the size of the new instance to be any constant root of the number of wires in the circuit. And we could choose this small enough so that it counteracts any polynomial blow up caused by invoking this new proof system, which runs in poly time. So in that way we could get, we could maintain a linear time prover. We also showed some extra results that we needed like the fact that the zero knowledge property is preserved under proof composition, some basic facts that might be useful in future in different works that try and use proof composition of IOPs. So let me summarize the contributions of our work. We reduced the query complexity and verify complexity of linear time prover IOPs from any sublinear value to logarithmic and poly logarithmic and added zero knowledge. And this gave us a succinct zero knowledge argument with very similar properties using hashing transformation. We also developed some new tools which should be useful in future works aiming to construct zero knowledge IOPs such as these own CS gadgets. The fact that zero knowledge codes are preserved under tensor products, which is going to be useful because at the moment some kind of tensor codes are present in all constructions of linear time IOPs. And finally we investigated the properties of zero knowledge under proof composition. So that's the end of my talk and I'll be happy to take any questions. Thank you very much. Awesome. Could you come up to the mic? So for the people on Zoom, can hear you? Right over there. Does it work? Oh, perfect. So one of the properties you claimed as the whole grail at the beginning was that you would like to be able to do proofs over any field. But in this result, for instance, you showed that your field size needs to be of the same order as the circuit size. Can you indicate where the bottleneck for that is in the proof? Is it like in the IOP, the original IOP that you use? And how you could potentially try to get around it? Sure, the bottleneck there actually comes from the very beginning in the tensor query IOP before most of the compiler stuff. The conversion from tensor query to point query IOP I think it worked just fine over small fields. But in the tensor query IOP, we actually use some high degree polynomials of degree N and the Schwartz simple lemma as part of the proof. And this gives us soundness errors like N over the size of the field. And that's the reason. So the way to improve that is to try and use fewer high degree polynomials in the proof system. Okay, thank you very much. Awesome. So I think we're running a bit behind schedule, so maybe we'll take the rest of the questions offline and thank Jonathan again. And I believe our next talk is via zoom slash video. So it might take a minute to get set up. So I'll say the title while they're while they're working on it. It's Noninteractive Zero Knowledge Proofs with Fine-Grain Security by Yu Yu Wang and Josh N Peng.


The Abbot and Costello program starring but Abbot and Luke Costello, but tonight's guest star Elsa Maxwell, brought to you by Camel, the cigarette of costlier properly aides tobaccos. The Abbot and Costello program with the music of Alan Roth and his orchestra, a singing star Amy Arnell, and spotlighting that chubby chubby little cherub, who went caught putting a toothbrush in his Uncle Artie Stevan's lunch pail, because he heard him say he was going to work on George Worsten's bridge, calmly said. On our second week in New York and you show up late for the broadcast. Now look, where have you been? Huh? Where have you been? Oh, I've been over at Paterson Abbot. Now that's ridiculous. Eight hours? And how could it take eight hours to come from Paterson here on a greyhound? Well, my greyhound got interested in another greyhound. Ah, yeah. Lou, are you paying any attention to me? Ah, pay the slills again, old boy. Well, that's a pleasure, please. You realize you were invited to a big party at Elsa Maxwell's house tonight? Yeah. Why aren't you wearing your tuxedo? It's ruined. I was wearing my tuxedo last night and the dog bit me. Where did you bite you? Well, if I was wearing license plates, you would have got the last three numbers. All right. All right, Bluff. Put your please dog sense. Are you taking your girl, uh, lean against the- No, no, no. We ain't speaking. Well, now, what's the matter with you and lean again? Well, yesterday she bought some brand new shower curtains and she asked me to hang them up on-to hang them up. And by mistake, I hung them over the front door. Well, that's not so terrible. Oh, no. Last night when she went to take a shower, she slipped off her bathrobe, pushed aside the curtains, and stepped out on the front porch. All right. Tell me, Godzilla, were you born- What if it was? Wait a minute, I want to ask you- What if it means? I know that. Listen, I want to ask you one little simple question. Were you born-were you born dopey? I could say not. I'm a self-made dopey. All right, so now- Hold up. Hey, now, wait a minute while I think of it, Lou. I'll bet you didn't even get any flowers for Elsa Maxwell. Yes, I did. I bought her a great big orchid for her hair. An orchid? An orchid for her hair. You dummy. For $30 a piece, you could have bought a pair of pants for that.  No. Please, stop. I'll take the freers in the pocket. And, uh, never mind the orchid. Why didn't you get her a corsage? A what? A corsage. I don't know her size. No, no, no. Now, you dummy, I- I'm- I'm- You don't seem to understand, though. I mean some flowers to wear on her dress, you know. Oh, yeah. I bought her a bucket of chameleons. A bucket? A bucket of chameleons? You mean a bouquet, not a bucket. B-O-U-Q-bucket. B-O-Q-bucket? All right. All right, so- What is it? Bucket or bouquet? Bouquet. But if it'll make you happy, make it a bucket. All right. I bought her a bucket of chameleons, and do they smell beautiful? You- Why, you idiot? Chameleons have no odor? Well, these do. The bucket I brought them over in had fish in it. I- I- I- I hope you don't make a fool of me at Elsa Maxwell's party tonight.  Oh, dancing? Well, I love dancing. I- I used to be a lifeguard at the Rosalind Dancehall. A- A lifeguard at the Dancehall? Yeah, I kept the wolves. I'm getting too close to the waves. Well, look. What kind of dancing do you do? Oh, I mean, I do the shimmy. The shimmy. The shimmy is a back number. Oh, I can start mine from any place. Oh. All dogs say it's Castella. Do you- Do you conga? Huh? Conga. Were you ever in a conga line? Ha-ha. I tried to get in a conga line once, but I must have gotten the wrong line. Now, what do you mean by that? I never got to dance. But I came back with an arm load of paper towels. I- Look, I- I can tell that you know absolutely nothing about modern dancing. Who don't? You don't. I come from a family of dancers. My Aunt Minnie. She was a famous balloon dancer on the stage. Who tell? One night a mouse went across the stage, and then Minnie screamed and dropped her balloon. Yeah, what happened? The mouse fainted. The mouse? Oh, look, I- I'm not going to take any chances.  In other words, I'll give you a lesson. Oh, you don't have to give me any lessons. I took lessons from Martha Murray. There's only one thing wrong. He taught me the woman's steps. So what's wrong with that? I'm the only wallflower in the history of dancing that uses the men's smoking room. Yeah, look, look, never mind that. I'm going to teach you how to dance right now. Right here. Right here? Yeah, right here. I'm a beautiful society girl. Now, this is my first party, incidentally. I'm coming out tonight.  I'm a beautiful girl. What's your name? What's the difference? Let's say my name is Laura Doome. Your name is what? Let's say Laura Doome. Oh, I know your sister. Nothing, Doome. No, I never- Do you please stay and dance? Wait a minute. Listen to me please. Now, here I stand. Here I stand already to dance. Now, I'm dressed in a strapless evening gown and you asked me to dance. No, I can't dance with a girl with a bare back. Why not? Why, it always makes me feel like I'm patting a bald man in the head. Never mind that. Now, let's dance. Now, here we go. Come on out. Now, slide, glide, slide, glide. Mike, that's wonderful. I like the way you dip. Who's dipping?  Oh, isn't this lovely? We're dancing past the orchestra. What's the matter? I dance too close to the trombone player. Ophthalmologists, cardiologists, gastroenterologists, otolaryngologists. No folks, I'm not practicing tongue twisters. Just listing different kinds of doctors covered in the Great Cigarette Survey recently made by three leading independent research organizations. Yes, they covered doctors in every branch of medicine. 113,597 doctors. From Mexico to Canada, from the Atlantic to the Pacific. Doctors in every state of the Union were asked, what cigarette do you smoke, doctor? And the brand most named was camels. Rich, full-flavored camels, the cigarette of costlier tobaccos, superbly blended camels, the cigarette with the cool, throat-welcome mildness. Sure, doctors like all you folks smoke for pleasure. Camels' flavor and mildness register with their tastes and throats, just as with yours. Now, this impartial factual evidence shows that... According to a recent nationwide survey, more doctors smoke camels than any other cigarette. Alan Roth and the Camel Orchestra feature the popular rhythm-favorite doctor, lawyer, Indian chief. Mrs. Niles, what are you doing in New York? Oh, I just flew in from Hollywood. I wish you had been there. Then they could have rolled out the blame. I'm dead tired from my plane trip. I'm bushed. Bushed? You look more like something that's been treed. And already I've been taken for Lana Turner and Rita Hayworth. You've also been taken for $200. Mrs. Niles alone.  Another studio kitten caboodle. Mrs. Niles, you may kick my kit. Mrs. Niles, will you go with Costella to Elsa Maxwell's party tonight?  I said that, Mrs. Niles. We could be very dear friends if you would have faith in me. Have faith in you? Everybody has faith in me. Even my dog has faith in me. Oh, dog-faith Costella way. Mrs. Niles, why don't you go with Costella? Oh, very well. I'll go with Costella in one condition. I insist that he drive me to the party. All right, I'll drive you to the party, but you have to bring your own harness. Well, Costella, at least I tried to get you a woman to take to the party, didn't I? Try to get me a what? A woman. You want a bet? Come in. Ah, good evening, gentlemen. Costella, Costella would say, Professor Mellonhead, well, what are you doing here? I'll tell you what I'm doing here, Abbott. I just read in this newspaper here that Costella was going to Elsa Maxwell's house party. It's an outrage. I will not tolerate it, after all. I have jurisdiction over this. I happen to be Miss Maxwell's right-hand man. I'm her major domo.  There you go, Costella, making remarks about my bald head again. I am proud of my bald head. My head looks like a baby's. Like a baby cereal bowl with shredded wheat around the egg. Mellonhead, why do you object to Costella going to Elsa Maxwell's party? Why, if Costella were to appear to Miss Maxwell's party to be a catastrophe, it would be... A cat for the spree? No, no, no, no. A catastrophe. I'll explain a catastrophe. Costella, suppose your cat had kittens in your hat. What would that be? A miracle. My cat's name is Jake. Don't worry about Costella at the party. Please, I'll take care of them. All right, Abbott. I warn you, Costello. Don't partake of any edibles or vions until the butler announces dinner. Well, who? The butler, the butler. Look, I'll explain the butler. At your house. How do you know when it's time to eat? Well, my mother takes the iron bars off the dining room door. She ain't going to do the cooking tonight at Elsa Maxwell's. She makes the world's worst pancakes. I never mind about... Wait a minute, wait a minute. I don't want you to make any more remarks about my wife's pancakes. What?  You mean every time I mention the word pancakes? Weird! I certainly don't like your wife's stuff anyway. What? You don't like what stuff? I don't like that. The word, do you want me to say it? What word? What word? When they hit me on the head, if I say it. What word? Pancakes? Something you're not supposed to say. Well, I won't say that word no more. What words? That pe-pe-pe-pe-pe-pe-pe-pe-pe-pe-pe-pe-pe-pe-pe. In fact, you should never eat them again. You pancakes? At the end of the page. Alright. That stuff she makes. Why? You know why? Why? I'm going to tell you why. Why? Because there was a war once. A war? What do you know about the war? Plenty about the war and it's got something to do with what you were talking about when you're hitting me on the head. Is that so? Yes. This war, I was going over. I had it go. And down I was going to fight I was gonna fight for our country over there, and I was right where the bullets were the bullets were the thickest Where was that underneath the ammunition truck? Be serious finally I come up out of there and there was a bullet Coming right at me a bullet coming at you and it hit me a bullet hit you right in the heart right in the heart And before I left home my father gave me a good book Yes, and he told me to pull up by my heart the good book and you know I saved me from being killed a good book Of course. Oh, no one of your wife's pancakes It's an amazing instrument intricate sensitive a miracle of chemistry physics and all the assorted sciences and you own it It's your own t-zone. That's tea for taste and tea for throat And it's also the greatest cigarette testing machine in the world the most critical laboratory for any cigarette So just try camels on your t-zone See how your taste responds to the rich full flavor of camels superbly blended and costlier tobaccos See how your throat reacts to camels cool mildness Perhaps as with millions of other smokers your t-zone, too will report that camels suit you to a tea Oh and another thing did you know that when three leading independent research organizations put the question? What cigarette do you smoke the one hundred and thirteen thousand five hundred and ninety seven doctors all over America the brand Most named was camels. Yes, that's so according to a recent nationwide survey or doctors smoke camels than any other cigarette The girl with personality The madam has a cute Personality and think of all the books about the berries look was it made her the toast of Perry He had a well-developed Personality what did Romeo see in Juliet? Oh Jupiter and when so lonely dance and have the boy easy to see That she knew how to you what did Harry Jay see in Betty G or Garcin G in Gable C or Bing and Bob in Dot Lamore To you. I've got the grave. Oh great. I've got a great face except. I've had it much longer than G if I only had her Personality personality, this is some party Costello. What a crowd. Hey, hello boys Costello. It's Elsa Maxwell Do you realize that this is the one and only Elsa Maxwell? Yes, here I am in the flesh Who's is it? You better give it back.   Is there anything we can do to help entertain your guests tonight? Yes I'd like to have you boys put on a play. I have a wonderful vehicle for you. Mr. Abbott And what about a vehicle for me a vehicle for you, Castello?  Hey, you know why but this thing's got better jokes than I got Have you something in mind first? I know you have produced some big Broadway shows and oh, yes But I've been on the stage, you know, I've also appeared in a few Western pictures In fact, I played a regular Western girl.  Oh, that's all right, but I think Castello's only pulling my leg pulling it. I couldn't even lift it You know boys, you know, I've written a little sketch that we can do tonight. It's called Anthony and clear Patra It's a lovely play Costello. You will be Anthony and I will be clear Patra as iron of the Nile You sound more like a fog on on the Hudson If you don't understand castella Elsa will be clear Patra the most enchanting lady on the Nile Yes, Costello in this play I am the sorceress sorceress.  I fall madly in love with you. I get you in my cutches Yes, but you break away. Yes again. I get you in my cutches. Yes, and again you break away Looks like my breaks are okay, but my clutch is slipping Let's get on with the play Mellonhead will you set the scene?  Yes, Julius There is no country in the world as beautiful as egg white egg white. Wait a minute Costello Where do you see egg wiped on the script right here in the script? What do you mean white egg white? Egy pt. I don't know that's Egypt you read the straight lines kid. I'll get the land. Yeah, quite Ah Anthony we are approaching Cleopatra's camp. Oh, who goes there God tell Cleopatra that Julius Caesar and Mark Anthony are here Which one is Anthony? I am Mr. Anthony, I have a problem I've been going with a girl for eight years and You got the wrong program Play about Sahara. That's my girl's name Oh Look this Cleopatra's scowling at anchor. Let's get aboard. Okay.  Let's get on with the play.   I'll have to make free trips there Tell me Anthony. What are you thinking? I'm thinking how wonderful it would be to have this much butter You shouldn't talk Why don't you take that flower out of your lapel and wear it in your vest? Why should I wear my flower in my vest be nearer the pot? Come you two you're supposed to be in love. Yes, Anthony Remember that old adage all the world loves a lover. Oh, yeah, the weather to have cops a simple part But mark my sweet this night was made for love. There are lovers everywhere. Listen to that couple on yonder bench I'm getting on the board.  Oh mark Anthony. I am here to serve you What can I do for you?  Oh kind sir.  Yes mark Anthony. This is an insult You are making love to this slave while I am here. Oh, what's the local when you can catch an express? Out of here away. I clear Patrick will dance for Mark Anthony. I will do my famous Fan dance you do a fan dance. Yes, what are you's when milk? Let Miss Maxwell do her fan dance. Will you please? I'd rather see you do a hula dance. Oh You think I could do a hula. Oh, you can do a hula certainly all you do is walk out on the floor fast Stop quick and let nature take its course That's all you think of the play now now comes the big love scene as the barge floats down the river Nile under the Egyptian moonlight Miss Maxwell is sitting on your lap. Oh goody goody Well costello here. I am on your lap costello speak to me. Where are you?  I can't do that. I bet miss Maxwell and I we can be nothing but friends Oh, please please costello. Don't say that. Call me anything, but just a friend. I'm afraid. I can't Here I'll put my arms around you now. Am I just a friend? Yes, you're just a friend. I'll put my cheek against you Now what do you want to call me?   Then what will you call me grandma? Costello will be back for camel cigarettes in just a moment And now tonight salute to the men on the armed forces who won through to victory Tonight we hail the 99th division heroes of the romagen bridgehead Since the beginning of the war the makers of camels have sent more than 150 million free camels to our fighting men overseas But now with the mobilization in progress free camels are sent to servicemen's hospitals instead This week the camels go to veterans hospital Mary in Illinois US Army Cushing General Hospital Framingham, Massachusetts National Naval Medical Center Bethesda, Maryland US Marine Hospital Savannah, Georgia and veterans hospital Northport Long Island, New York in your honor men of the 99th division I'll go out to the United States twice a week a Re-broadcast to practically every area in the world where our men are stationed and to our good neighbors in Central and South America And now here are but avid and Luke Costello over the final word. Well Costello This is our last night in good old New York City.  Oh get this corny guy with that broken down joke What's the matter with that joke? That was one of my father's jokes. What are you? To you by camel cigarettes and remember try camels in your T zone See if they don't suit your taste your throat to a T See If you smoke a pipe It'll really be a red-letter day when you switch to that big red tin Prince Albert Yes more pipe smoke Prince Albert than any other tobacco in the world It's crimped cut to burn cool and it gets a special No buy treatment that takes out all the parts and sting that leaves in all the rich mellow wonderful flavor So switch to Prince Albert today Saturday night be sure to listen to Prince Albert's Grand Ole Opry You'll hear Red Foley Grand Ole Opry's sensational new romantic singer. Remember Grand Ole Opry Saturday night on NBC with Red Foley Perhaps you've seen pitiful pictures of starving people in your newspaper recently these scenes are being repeated over and over throughout Europe and Asia Many of these people especially the children will die without our help You can't help by avoiding all food waste by preserving food through home gardening and canning And by giving canned food and money to your local emergency food collection share a meal save a life Be sure to listen at this very same time next week for the Aberdeen Costello show for camel cigarettes Which will come to you from Hollywood Thursday night is all star night on NBC Stay around now for Rudy Valley over most of these stations. This is Bert Parks in New York wishing you all a pleasant good night for camel NBC