Hello and welcome to this talk. My name is Mark Simkin and I'm going to present the paper Blackbox Transformations from passive to covert security with public verifiability. This is joint work with Ivan Damgard and Claudia Orlandi from Ohus University. In this talk we will focus on the setting of secure computation where we have two or more parties each of those parties holding a private input and they would like to jointly compute some function such that at the end they all learn the output of the computation but none of the parties learns anything that is not trivially revealed by the output. So in particular the parties would really like to protect their inputs as much as possible. In this setting we commonly consider two types of adversaries. We consider passive adversaries which will follow the protocol specification honestly but they will still try to learn more than what they are supposed to learn by simply observing the messages that they receive and then we consider active adversaries which may deviate from the protocol description in an arbitrary fashion so they can send incorrect messages they may not respond to certain messages and such an adversary can not only potentially learn more about the private inputs of the honest parties it can also try to reduce an incorrect output of the computation. Now both of those types of adversaries have their disadvantages. Protocols that are secure against passive adversaries make a strong assumption about the behavior of the adversary and thus such protocols may not be secure enough for real world applications where we do actually want to prevent an adversary from misbehaving. On the other end of the spectrum we have active adversaries and protocols that are secure against such a strong adversary don't come for free so such protocols usually incur some computational and bandwidth overhead so actively secure protocols tend to be at least an order of magnitude slower than their passively secure counterparts. This was already observed in 2007 by Aumann and Lindell and there the authors suggested a new notion of covert adversaries which basically requires a protocol to detect any active misbehavior with some constant probability. As such the notion is placing itself in between passive and active security because it is a clearly stronger notion than passive security but because we allow the adversary to successfully cheat with some constant probability it is weaker than full active security and the hope here was to generate a notion that is good enough for real world applications but for which we can still hope to construct more efficient protocols than the ones that we have for active security. In 2012 Ashraf and Orlandi observed that we would actually like something that is a little bit stronger than just the notion of security against covert adversary. We would additionally like that the protocol is publicly verifiable which means that if the honest parties detect cheating so if the adversary does not successfully cheat in a protocol execution then the honest parties should obtain some publicly verifiable certificate that they can show to some outside observer to convince this observer from the fact that the adversary did indeed cheat and the motivation here was to disincentivize the adversary from cheating by potentially incurring a financial penalty in case cheating is detected. So what do we know so far about such protocols? In 2008 Goyal Mohaslin Smith showed how to construct garbled circuits and the multi-party version of garbled circuit based protocols called BMR with better efficiency by only requiring security against covert adversaries rather than security against active adversaries. Dungard Geisler Nielsen showed how to compile certain secret sharing based protocols that are secured in an honest majority setting into protocols that are covertly secure and in 2013 Dungard et al showed how to construct a very efficient pre-processing phase for the speech protocol that is also only covertly secure and very recently in 2019 Hong et al showed how to actually achieve very efficient garbled circuits with covert security and with public verifiability and here it should be pointed out that the first three protocols described here do not have public verifiability they just achieve the first notion of covert security and furthermore if we look at those four results we can see that three of those results provide specific protocols and only one of those results is a generic compiler and there is actually some advantage to studying compilers because if in the future we come up with some more efficient and new way of doing passively secure protocols then using the compiler we can potentially immediately obtain a covertly secure protocol or if we had such a compiler a covertly secure protocol with public verifiability and the only existing compiler that we have has some disadvantages because first of all it makes some specific assumptions about the underlying passively secure protocol that it compiles and it does not work for the two-party case because it does need an honest majority so in this work we focus on compilers that take a passively secure protocol and transform it into a protocol that is secure against covert adversaries and has public verifiability the first compiler that we present is a compiler that takes a passively secure two-party protocol that takes no private inputs from the parties and constructs a covert protocol with public verifiability and at first it may seem that a protocol that doesn't take any private inputs is useless but actually we will show that such protocols have applications in particular they are very useful for setting up correlated reminisce and using this compiler we can then construct the most efficient two-party speeds protocol with public verifiability that exists in the state and furthermore we show how to use the first compiler to obtain a second compiler that works for arbitrary two-party protocols and constructs covertly secure protocols with public verifiability by just making black box use of a passively secure protocol and oblivious transfer and lastly we also show how to extend these protocols to the multi-party setting but this is not something we will discuss in this talk so let us start with the compiler for protocols with no inputs so we have Alice and Bob they have black box access to some passively secure functionality that computes whatever they would like to compute so to execute this protocol the exchange messages according to the protocol description and at the end of this execution Alice will obtain some output a1 and Bob will obtain some output b1 because the protocol is only passively secure Alice could potentially send a maliciously form message and this would result in Bob producing an incorrect output now our first idea here is to do the same thing that virtually every single paper on covert security does namely execute the protocol many times in parallel with the idea to use some of those executions as check executions that check whether the parties behave honestly and use the last execution to actually produce the output that we want to use and here the hope is that for example Alice can do no better than just randomly guessing which execution will be used and thus has a probability of one-third of successfully cheating so what do we mean by checking an execution more concretely how such a protocol will run is both Alice and Bob will first generate commitments to a random tape for Alice and a random tape for Bob or a and rb then they will run the protocol where all random decisions that Alice or Bob will make will be deterministic functions of their random tapes after the protocol is finished the parties will reveal the random tapes that they were supposed to use by opening the commitments and then each party can check whether the messages that the parties received are consistent with the random tapes that were opened and to make this approach publicly verifiable we also would like the parties to sign the full transcript so after running the protocol both parties signed the transcript and then proceed to open the commitments and now if Alice cheats and still opens the commitment then Bob will have proof of Alice's misbehavior and can show the signed transcript and the opening of the commitment to a third party who will then be convinced of Alice's misbehavior the problem however is that Alice may simply decide to abort and to not open her execution if she doesn't like which of the executions is being checked and to avoid this we will do the following instead of publicly revealing which execution the parties will check each party will check some execution by itself so for example Bob randomly selects the first execution to check and Alice randomly selects the last execution to check but neither Alice nor Bob know which execution is checked by the other party and here the important part is that if each party checks less than half of the executions then we are guaranteed that at the end there is still at least one execution which we can use to produce the output of the computation so what does it mean to check an execution secretly Alice will use oblivious transfer to obtain the random tape for this execution and Bob will do the same and then we proceed as before so the parties execute the protocol and after the execution they can check whether everything was fine if this is the case they show which execution they checked and then they use the last execution to obtain the output and now importantly since Alice doesn't know which execution Bob checks she can only guess and if she cheats in an execution that is checked by Bob then Bob will obtain a certificate that he can show to a third party so now let us proceed with the compiler for arbitrary protocols here Alice and Bob now have private inputs x and y and our compiler will work by using something that is known as the player virtualization paradigm which works by letting Alice and Bob imagine some virtual parties in their head and then using those virtual parties in some way to execute a protocol on their behalf so what Alice and Bob will do is they will secret share their input each of the virtual parties will get one of the shares of this input and then the virtual parties will execute a passively secure protocol such that Alice and Bob in the end obtain the output of the computation since the protocol is passively secure we again have to deal with the fact that potentially one of Alice's virtual parties will misbehave and send a bad message to one of Bob's virtual parties the important observation here is that if Alice wants to cheat in the overall protocol execution then Alice has to necessarily cheat in one of those virtual parties there is no other way of misbehaving in this protocol so the idea here is again to use oblivious transfer to check some subset of these simulations of these virtual parties so for example Bob in this case will try to check the first virtual party and Alice will check the last virtual party of Bob and since Alice doesn't know which virtual party is checked the hope is that we can detect misbehavior with a probability of one-third but now we need to clarify what does it mean to check a virtual party so for this Bob needs several things Bob needs to see the random tape that this party will use Bob needs to see the input of that party and during the protocol execution Bob will need to be able to see all of the incoming and outgoing messages of this party the input and the random tape we can do via OT as we did it before and we will show how to deal with the incoming and outgoing messages in the following so recall that these are virtual parties they don't actually exist so now we need to specify what happens if a virtual party of Alice is supposed to send a message to a virtual party of Bob in this case we can let Alice faithfully simulate this virtual party and send the message directly to Bob if Bob checks this virtual party he can check whether this message is generated honestly and complain if this is not the case and implicitly here we again assume that every message that is sent by Alice also is sent along with the signature the more difficult case is when Alice has to send a message from one of her virtual parties to another of her virtual parties and the issue here is that if Bob checks either the sender or the receiver then he should be able to see the message because if he checks the sender he should be able to check whether the message is valid and if he checks the receiver then he needs to see the message to be able to check the execution at a later point because as we said before for checking a party Bob needs to see all incoming and outgoing messages of a party however if Bob does not check the sender or the receiver then Bob should have no information about the message so how do we solve this problem we for the moment assume that somehow magically Alice and Bob have some symmetric secret keys which they will use to encrypt all communications between the virtual parties and in addition we will assume that somehow Bob and Alice magically get all keys that are associated with communication channels that are connected to the parties that they check so in this case Bob checks the first virtual party of Alice so he will obtain the two communication keys that are used for talking to the second virtual parties and talking for the third virtual party and now what we will do is that Alice will encrypt the message that the first virtual party should send to the third virtual party and Alice will send this encrypted message to Bob now since Bob is checking the sender Bob has the corresponding secret key and he can decrypt the message however if the second virtual party sends a message to the third virtual party then Bob will obtain an encryption of a message under a key that he does not possess and thus he cannot see the message in the previous description of the compiler we have assumed that the parties have quite a lot of correlated randomness set up between each other so for instance we assumed that the parties all have honestly generated random tapes for all the virtual parties we have assumed that we have these symmetric keys and that Bob knows some of the symmetric keys of Alice and so on so here we'll just give like a very high level overview of how we generated this correlated randomness and for this we simply assumed that we have a passively secure functionality that generates this randomness and a bit more concretely this passively secure functionality generates commitments to all of this correlated randomness so it generates one commitment per secret key and one commitment per random tape and then it provides Bob with all of the openings that are related to his virtual parties and Alice with all the openings that are related to her virtual parties and in addition they also get the openings for the values that are related to the parties that they will check and here they don't actually choose which party they check by themselves we simply let the passively secure functionality pick a random party for each other and because this functionality doesn't get any inputs we can use our first compiler to make sure that this functionality will have covert security with public verifiability and here the important point is that now we have commitments for all of those things so we will let both parties sign those commitments before they start the protocol executions and this has the purpose that if Alice or Bob cheat during the execution then the other party will have a message with a signature which is not consistent with a random tape and in addition it will have a signature of the committed random tape and an opening thereof so it can convince a third party that this cheating did indeed happen I would like to thank you for your attention and I welcome you to read our paper which is on eprint which contains all the details that I have skipped in this talk


Good morning to all of you, myself Manish Kumar Joshi and presently I am working as post-doctoral researcher at Research Center for Climate Sciences, Busan National University, Busan Korea. Well, first of all, I would like to thanks Dr. Fred Kucharski and other organizing committee members like Professor David Strauss, Kristiana, and Dr. Andrew for inviting me to attend this advanced school on topical, extra-topical interactions on interstitial time scales. Well, today I am going to talk on the fidelity of state-of-the-art models, climate models in simulating the observed teleconnection between the tropical, South Atlantic, and Ismar. Well, this work is done in collaboration with Dr. Fred Kucharski. And in fact, he is the lead author of this work. And I am very pleased to have this opportunity to present this work in front of you all. Well, this work has been recently published in QJRMS and the outline of my talk is as follows. First of all, I will give a short, first of all, I will discuss the main objectives of the present study, followed by the methodology. Then I will discuss some of the important results of the present study. And finally, I will discuss in short, the main outcomes of the present study. Well, the objective of the present study is to evaluate the fidelity of 32 CME-5 models in simulating the tropical, South Atlantic, Ismar teleconnection. This study addresses the following issues. Are CME-5 models under consideration capable of simulating the tropical, South Atlantic, SSG variability? Do CME-5 models have capability to reproduce the tropical, South Atlantic, and Ismar teleconnection? Are CME-5 models capable of reproducing the atmospheric circulation and convergence, divergent patterns associated with tropical, South Atlantic? And what are the key features that characterize the teleconnection in good compared to the poor models as measured by the tropical, South Atlantic, and Ismar teleconnection? Well, this table shows the list of 32 CME-5 models under consideration along with their modeling groups and resolution. Well, to examine the tropical, South Atlantic, Ismar teleconnection, the tropical South Atlantic index, which is defined as the area average sea surface temperature anomalies over 30 degrees west to 10 degrees and 20 degrees south to the equator is used. Now, because of the possible co-variability with ANSO, the linear relationship between the two, which is obtained by regressing the tropical, South Atlantic index onto the NENO-3.4 index, has been removed from tropical, South Atlantic. Well, the resulting time series is linearly independent of NENO-3.4 index. That is, there is no correlation between the two time series, and therefore, it can be used as ANSO independent index that could influence the Indian muscle. I may remove this. Just slow down. First of all, we will see how the precipitation is simulated in CME-5 models using two Taylor diagrams based on the fidelity in stimulating the annual cycle as well as this representing the climatological monthly mean or precipitation area average over monsoon co-reason and the spatial pattern of climatological seasonal mean precipitation over Indian monsoon region. Well, the Taylor diagram of annual cycle depicts that except these two models, all models are showing correlation greater than 0.9, but some either underestimate or overestimate the variance. In terms of both magnitude and trace, the models which are lying close to this observation line simulate the best annual cycle as compared to other models. On the other hand, the Taylor diagram of spatial pattern of climatological seasonal mean depicts that most of the models show correlation, good correlation, but some either underestimate or overestimate the variance. Now, in order to identify the models that reasonably simulate the climatological seasonal mean precipitation over Indian monsoon region, we defined a criteria that the correlation should be greater than 0.6 and the normalized standard deviation should lie between 0.75 and 1.25. Well, based on this criteria, these two models have the lowest correlation while these models are highly overestimating the climatological seasonal mean precipitation. Well, it is to be noted that the models are not selected based on the above criteria for the analysis of tropical South Atlantic ISMAR teleconnection because all models are to the some extent able to reproduce the ISMAR seasonal cycle and climatology and also a selection would involve the risk of excluding models from further analysis because of ad hoc and subjectively chosen thresholds. Now, we will see how the tropical South Atlantic pattern is simulated in CME5 models. For this, the JJS sea surface temperature anomalies are regressed onto the standardized low-pass filter, standardized tropical South Atlantic index for the observation and 32 CME5 models. Well, most of the models show well-defined spatial pattern of tropical South Atlantic, localized over the South tropical Atlantic and having magnitudes quite comparable with the observed ones. Well, out of 32 CME5 models under consideration, more than 65% of models also show the negative anomalies over the South Atlantic region and this as a combined can be referred to as South Atlantic ocean dipole which will be discussed in the further slides. This figure shows the Taylor diagram of spatial tropical South Atlantic SST regression pattern over the Atlantic domain and this Taylor diagram also shows that all the models show good correlation that is greater than 0.7, but some either underestimate or overestimate the variance. Well, on close observation, it can be seen that these three models are highly overestimating the variance while these five models are highly underestimating it. But overall, the SST regression patterns and its Taylor diagrams reveal that the CME5 models are capable of stimulating the tropical South Atlantic pattern. Now, we will see how the tropical South Atlantic ISMA teleconnection has been reproduced in the CME5 models. Well, for this, the JJS precipitation anomalies are reversed onto the standardized tropical South Atlantic index for observation and 32 CME5 models. Well, the observed precipitation shows, observed precipitation shows, observed precipitation shows the negative anomalies over most parts of India, especially over the Central Indian region and the positive anomalies over the Eastern India which implies that the warm sea surface temperature anomalies over tropical South Atlantic is associated with the reduction of rainfall over Central India while it causes enhancement of rainfall over Eastern India. Well, on the other hand, the models show a diverse behavior. For example, some of the models show the similar regression pattern as seen in observations which are shown by the tick sign while some show the opposite pattern which are shown by the cross sign. While there are also some models which are showing the weak responses which are shown with no sign. Well, consistent with the observations, the multimodal ensemble which has been obtained by averaging across all models also show a dipolar pattern that is the negative anomalies over all India and positive anomalies over Eastern India but the signal is very weak because it has been averaged across good and poor models. Well, this shows the area average of tropical South Atlantic residual precipitation regression maps shown in the previous slide over Indian land points excluding North East region. Well, based on the sign of average regression coefficients, the models are categorized into two groups, good having the negative average regression coefficients and poor having the positive average regression coefficients. Well, this figure shows the ensemble mean of tropical South Atlantic precipitation regressions patterns for 17 good and 15 poor semifinal models. Well, the ensemble mean of good models also closely resembles to the observation as they are showing the negative anomalies over most parts of all India and positive anomalies over the Eastern India which implies that the, during the warm tropical, warm SSG is over the tropical Atlantic, most parts of India will receive below normal rainfall while Eastern India will have above normal rainfall. Well, the ensemble mean of poor models shows just an opposite pattern. Well, it is to be noted that the classification of models into good and poor categories is solely based on the metrics of tropical South Atlantic isomer regressions and it is not related with the overall model performance. Now, in order to get further insight of the crucial elements in the model tropical South Atlantic pattern, the ensemble mean of tropical South Atlantic residual SSG regressions for good and poor semifinal models are constructed and it can be seen that consistent with the observations, both models show a dipolar pattern over the South Atlantic that is warming over the tropical South Atlantic and the equatorial region and cooling over the Southern South tropical Atlantic which has been referred as South Atlantic Ocean Dipole. Well, it can also be seen that the negative pole of this dipole is likely more pronounced and closer to the observations in good models as compared to poor models. Looking at this tropical South Atlantic SSG pattern, it is difficult to guess what actually distinguishes good from poor models. Therefore, the atmospheric features are also examined to get some clue. Now, we will see the capability of semify models in reproducing the atmospheric circulation and convergence divergent patterns associated with tropical South Atlantic. Well, this figure shows the regression of JJS seasonal anomalies of zonal and meridional winds at 850 at Tapascal onto the standardized tropical South Atlantic residual. Figure B and C are same as figure A, but for the average regressions of 17 good and 15 poor semifinal models. Well, the observed regression pattern shows that the warm SSG anomalies over tropical South Atlantic is associated with the westerly anomalies along the equator, which is located slightly northward in observations as compared to good and poor models. Well, you can also see that this response is stronger and more closer to the observations in good models as compared to poor models. Well, the observed regression pattern also shows the easterly anomalies over Africa and in the Somali jet vision, which is consistent with the gilt type response due to the heating induced by tropical South Atlantic warming. Well, as compared to good models, poor models fails to show this response and show stronger response over the Indian, over the Eastern Indian Ocean region, which is consistent with increased convergence over India. Well, this weekend Somali jet reduces the rainfall over India through the divergence and due to the reduced lifting over the western parts. Well, the observed regression pattern also shows also shows an interesting feature that is a cyclonic feature in the extra tropical South Atlantic region, which is a part of South Atlantic ocean dipole and this feature is quite well captured by both good and poor models. Well, at upper levels, the equatorial, at upper levels, the equatorial response is reverse, consistent with the baroclinic response that the westerly anomalies over the tropical Atlantic and the easterly anomalies over the Africa and Somali jet region at lower levels is replaced by the easterly anomalies and the westerly anomalies at upper levels. Well, this feature is also well reproduced by both good and poor models. Well, as compared to poor models, the assembly of good models shows strong signal, strong signal over the western Indian Ocean, which may be related with the above normal rainfall over India. Well, the observed wind regression pattern also shows the extra tropical wave frame feature in the northern hemisphere, which is absent in both good and poor models. This extra tropical path may be the cause of the reduction of rainfall over northwest India as seen in the observed precipitation regression maps. As you can see that, that the observed precipitation regression map shows less rainfall over northwest India, which may be related to this extra, this wave frame. Well, this feature is not well captured by both good and poor models and you can see that such type of feature is not well captured over the northwest India. Now, to examine this further, we have regressed the journal wind shear on the tropical South Atlantic residual. Figure B and C are same as figure A, but for the average regression of good and poor model. Both observation and good models shows a substantial and statistically significant wind shear over the Somali jet region, which is consistent with the reduced rainfall over India. In poor models, this response is weaker and maximum amplitude seems to be shifted over the central equatorial Indian Ocean region. Well, on the other hand, if a large scale dynamical western Yang-Mansun index is used, then all CMIFI models and observations shows negative regressions except MPI ESMP. This indicates that large scale responses are not that different in both good and poor models and therefore the regional details, metals are lot for this tropical South Atlantic and ISMART teleconnection. Well, this figure shows the regression of JJ's and number of ADD stream function at 200 hectopascal from ENCEP and CARi analysis onto the standardized tropical South Atlantic. Figure B and C are same as for the average regression of good and poor CMIFI models. Well, ADD stream function at 200 hectopascal is a good indicator of will type response. As you can see that the observed regression pattern shows the guild type quadrupole response, which is up to the sum extent captured by both good and poor models. Compared with poor models, the good model also shows the pronounced and localized quadrupole response over the Saudi Arabia and Peninsula region as compared to poor models. In poor models, it seems to be shifted. The lower levels, the tropical South Atlantic ADD stream function regressions also shows a quadrupole response, which is consistent with the baroclinic guild type response. Well, both observation and good model shows the low level anti-cyclonic stream function over Arabian sea. That will induce the sinking motion over that region and a low level divergence that causes the reduction of rainfall. Well, poor models also shows the quadrupole response, but the center over the Arabian sea extending towards India is missing. And this center is basically present over the Eastern Indian Ocean region and the Western Pacific, which is consistent with low level wind responses. To further verify this, we have regressed the velocity potential regression pattern onto the standardized tropical South Atlantic residuals and figure B and C are same as figure A, but for the regressions of good and poor models. Well, velocity potential is the measure of divergent flow and is often used as a proxy of walker circulation. Well, at upper levels, a region of negative potential has diverging winds that exemplifies strong convection or rising motion at the lower levels. Well, the observed wind regression pattern shows that the warm SSD anomalies over tropical South Atlantic is associated with anomalous convergence over Indian subcontinent, Western Pacific and far Eastern Pacific and divergence over the tropical Atlantic as well as over the Central Eastern Pacific region at upper levels with anomalous divergence and convergence over respective regions at lower levels. Well, the ensemble mean of good models also shows exactly similar feature as being observed in the observations. Whereas the ensemble mean of poor model fails to show the convergence over Indian subcontinent and also the divergence over the Central Eastern Pacific. In fact, it shows the strong convergence over the Central Eastern Pacific and weak convergence over the Western Pacific. Such differences in large scale features may be responsible for the difference in tropical South Atlantic iso-mart teleconnection in good and poor models. To further verify this, we have plotted a scatter plot of tropical South Atlantic precipitation regressions averaged over Indian land points excluding North East region versus the Western and Central Eastern Pacific ocean velocity potential gradients at 200 hectopascal. Well, the negative correlation between the two indicates that larger the Western Central Eastern Pacific ocean velocity potential gradient produces larger negative Indian land rainfall responses. This implies that there is a strong relationship between the quality of reproducing the velocity potential regression pattern and the tropical South Atlantic iso-mart teleconnections in models. So the conclusion is generally all the models show well-defined spatial pattern of tropical South Atlantic, but out of 32 semi-fine models under consideration only 50% are able to capture the tropical South Atlantic iso-mart teleconnection. Well, both good and poor models show large scale responses which is quite consistent in observations. Large scale walker circulation adjustment to the tropical South Atlantic SSDs is identified as one of the factors that accounts for the difference in the low level stream function response. Results revealed strong relationship between the quality of reproducing the velocity potential regression patterns and the tropical South Atlantic iso-mart teleconnections in models in particular with respect to the western and central eastern Pacific ocean velocity potential reagents at 200 hectopascal. Such relatively subtle changes in the response leads to the reversal of the signal over India. That basically raises the question about the robustness of tropical South Atlantic and iso-mart teleconnections. Thank you.