Welcome to the talk about CTF capture the flag. These two are from the kid team for CTF and They'll talk a bit about it because they also organize it here at the GPN Please in applause. Thank you. Cool to see so many of you here Yes, we want to tell you about capture the flag which are compared which is competitive hacking as a team sport and Who are we? We are Martin and Liam. We're both studying it. We are both in the kid CTF team and both studying at KIT computer science and yeah as part of intros we do development and security research work So who here has heard about CTFs before we don't mean these CTFs Also, of course, not these CTFs. So quick show of hands who here has heard. Oh, that that's quite a few Still this is an introductory talk So what are CTFs in just a few bullet points? so at their core these are Competitions where it's about finding and exploiting security vulnerabilities These are organized in multiple challenges Containing intentionally vulnerable software. So someone placed a an issue there and you have to exploit it as the title of the talks chess, this is a team competition and Most of the time they run during a weekend. For example this weekend. It's give you and say death and You can always check upcoming CTFs at CTF time.org So what are these flags? We're talking about When you then get to exploit the vulnerable software or break some cypher You will always end up with a recognizable String which is the thing you're down down here and if you and you can then just take this one and Submit it at the contest sites get some point for it and climb the leaderboard a few spots All right What are CTFs not? It's not at all illegal or malicious hacking. It's also not just taking Known exploits known vulnerabilities where there already exists some metasploit module and just applying it And it's also not just proved for us in some password These challenges are organized in like big four categories and Martin will tell you more about these categories Yes As Liam has already said No CTF noted CTFs are similar and there is no No rulebook about what's a valid CTF challenge or what's the valid CTF category, but over the time there has there have been four Big categories that are that are pretty much present at every CTF event The first category I want to talk about is binary exploitation and binary exploitation is about exploiting vulnerabilities in applications written in compiled languages Still nowadays most of these challenges are about exploiting memory corruption issues in C and C++ binaries These issues are still pretty relevant in IT security today So that's why we still find them in in challenges and also While the underlying issues Is is quite old this the still is is a evolving field with new Mitigations coming up and new bypasses for these mitigations being developed so yeah Of course, there are also challenges about exploding other things For example nowadays we have a lot of just in time compiler bug exploitation in JavaScript engines for example This would be an example for more complex binary exploitation challenge The second big field is reverse engineering reverse engineering is about understanding a piece of software that you were given as part of the challenge and There you're mostly not giving source code to this challenge So you just get a compiled artifact that might be stripped and optimized by the compiler So it's it's pretty hard to to understand what's going on there But usually you attack these kind of challenges by using a decompiler disassembler Or some dynamic analysis to like a debugger and try to understand what the software is is doing Here we also find a lot of C and C++ binaries because these are kind of Approachable for for for these these kind of things and also there's a lot of Tooling because these these languages are are standard for a long time But we also find find challenges use challenges just use newer languages like go or rust But yeah, there's less tooling for for reversing these so yeah, it can be a bit of a pain But we also find exotic challenges in this category Like a lot of times people implement custom CPU architectures and compile binaries for these So then you have to exploit or understand some some application that was written for an architecture where no tooling is present for for reversing it and Super obscure stuff like recently there was a CTF challenge where love someone implemented Rubik's Cube based maze as part of a latte document So this is an example for a reverse engineering challenge where you were given source code because latte is not a compiled language But still understanding was what going on what's going on is not a trivial effort Another big category is cryptography we used to call it just crypto, but nowadays that's confusing people because they think about blockchains Crypto is mostly about Crypto is about attacking cryptographic protocols both like known standard protocols like RSA elliptic curve or block ciphers in more in many cases these Algorithms are just implemented wrongly so you can attack implementation or the author misuse them but That's not all there are also a lot of challenges this route that are based on on cutting edge Crypto research you have a lot of challenges that are based on post quantum cryptography things like lattices yeah, so heavy heavy math stuff so and And Lim also always said I'm too excited about this category because that's where I spent most of my time But yeah, there's webpacking And webpacking is anything that involves HTTP or web browser or at least that's how I classified Here you find a lot of Challenges that are based on the ova's top 10 list that you have may heard about They will find the classical web security issues like SQL injection cross-site scripting other kinds of injections Yeah, but also on the on the more difficult side of challenges There are a lot of challenges that are based on newer browser API is pretty much always if some with Chrome ships a new API That's vaguely security related. There will be CTF challenges about it quickly after Okay Now we've talked a lot about what CTFs are where you can play them how you play them what the categories are But we wanted to to give you an example of how Solving a CTF challenge can can look like and turning this into a demo isn't really trivial because they have a 30-minute slot Solving CTF challenges can take a lot of time. It usually does take a lot of time So you can spend a few minutes on a challenge, but you can easily spend tens of hours on solving a CTF challenge So in this demo, I will try to to show you everything else and Spend as little time as possible on the actual hacking so you will understand everything else. So this is this is demo time light so As we have already said previously, we are running a GPN CTF this weekend So this is the website of the GPN CTF You will get it well consider you are up there, but we'll show it show it again later And what I'm doing now is something that's normally pretty problematic So I'm going to solve one of these challenges that I already know the solution to and show it to you while the event is still running Normally, this is strictly prohibited and don't do it. But yeah, since we are organizing it This was all planned that coordinated so Hope hope is going to be fine. So what I'm going to show you is solving the rusty web challenge We can just pick any challenge on the website Here we have a have a have a description for the challenge some information about connecting to the remote instance and We can download some some source code. I Already downloaded the source code here and extracted the archive So as I said, I already know the solution to this challenge But I'm going to walk you through the steps that are usually involved at solving some such a challenge First thing first we can look at the provided files we get Fake flag file. So of course the real flag is not just present in the in the archive We get a talk of fire so we can run the challenge locally. I already did that as well And then we get the source code of the actual challenge and how you would usually go go or approaches maybe first have a look at What's the challenge actually doing in this case? It's it's running a rust web server seemingly and So if you think about okay rust rust web, so where could we could we try to to attack this? I think core server is a file that you probably would have a look on pretty look at pretty early on And of course this is this is fast forward, but you see okay. There's a method. That's handling connections It's having a look at the used HTTP method and it's passing the the u-reader URL we are requesting and then there's this line that May look suspicious if you have some experience with web security because what's happening here is the web server is Constructing the file path that it's going to read and return to the user so it's does this by compiling the static document route where all the web server related files are located and And concatenating the u-read path V as a user requested so for example if we try to load index.html this is going to be Slash was less www index.html and this gets returned to the user now the problem here is that if you try Sending something like this as a u-read the concatenation of the two would be would be this which is still fine Okay index html But if we send this this is equivalent to slash flag which is a path that does not Lay within the original document route So we just trick the web server into returning any file from the from the server In in a real-world scenario you could do something like This to to leak ETC password of any any credential So okay after we found the bug probably in a bit more time than this in this demo We we have to exploit it because CTFS also about exploiting issues so We can do this using using curl the only thing you have to know is the handy As is flag to prevent curl from already resolving these these dot-dot slash directly read traversal thingies So first we try to explore the local instance. We already have running That's all that is needed for for this example, and we get the local fake flag Now the next step is to to get the actual real flag So if you return to the challenge website and connect to the provided Endpoint here, it's not my laptop So in this case we have to solve proof-of-work puzzle to prevent people from just spamming our infrastructure with requests Live demo awesome. Okay. I hope this won't take too long Send this to the remote and luckily the queue is empty and we don't have to wait for five minutes here Okay, now we got a URL where the same rust web server is running but on our GPN CTF infrastructure where there is no fake flag file, but the actual flag So we have to run the same exploit against this instance and we get a real flag So on our last step in the CTF process is to submit the flag so we get get some points for our team Correct now we resolved our first CTF challenge And with that Liam will take us a bit more about more complex and more interesting challenges Okay, these challenges can Cover a very broad spectrum They start by these little introductory challenges, but actually go as far as pushing the state of the art of Like things like browser exploitation or kernel exploitation to give you a bit of a feeling for that I want to give you that the high-level conceptually overview of another challenge from last year's hitcon CTF you had to start by Exploiting Chrome's V8 engine then you had to break out of the sandbox Have a and then exploit the Linux kernel and this whole thing was running in a virtual box and You also had to break out of there Yes, and and you got got extra points for Doing this in one exploit as a and that's why it's called 4 Chain as a full chain and this is an instance of taking popular open soft open source software and Introducing some bucks where it's then some intentional bucks that are for example in in in this example Not dissimilar from things that actually happen in the real world but It could also be that it's just specifically crafted software for the the CTF One thing that is kind of a meme by now is these these simple note-taking apps And the the meme goes like if some IT security professional finds an actual interesting bucks and back in some customer software But they are not allowed to publicly talk about that buck because it's not customer software They re-implement this buck in a simple note-taking app and it ends up in a CTF Also for completeness there Sometimes is also just unmodified Software and then it's called clone in pond Okay, cool But but why why do this we can all only answer the question of why are we doing this and Obviously, it's fun To be honest, it's also very frustrating at times because you don't always Walks in a straight line Through the solution. There's a lot of trial and error and failing involved, but After that, it's even more fun if you if you solve it you learn a lot you sometimes have to Here you're not expected to know every technique or every technology that is present in a CTF but you're More expected to just read up on that on a weekend. So you learn a lot fast You meet cool people Both in your team as well as from the other teams and we'll talk about this a bit more later and all companies want to hire you obviously But that shouldn't be the main motivation. Why do anything? Okay, cool But how and how to get started with with all of this and The answer to this is just Play these CTFs Choose a CTF that features some beginner friendly challenges. For example this weekend at KPN CTF. We have Challenges that are specifically designed for beginners that have hints in them to get you started and There are also other CTFs like Pico CTF or CSCG and Just try to solve them and if you don't manage to solve them That's not not a problem at all because after the CTF There will be write-ups published most likely by other teams who solved it and you can learn from it And it's much better to learn from it and if you try it and just to read the write-up and Following that theme just join your local or online CTF team for example We here at KPN CTF have weekly meetings where we discuss Topics like the challenge categories we we just shown you and the rest of the slide is not here to overwhelm you But to serve as a reference if you look at the slides again, these are just resources That we found valuable in learning certain techniques, so I just won't read all of this, but it's here Okay, Martin will tell us more about the cool people we meet Yeah, so you may ask yourself Okay, who is spending the times in front of the computer then time we get okay, maybe not here people are asking themselves that but Yeah, who are these people that are playing CTFs and of course CTF is it's not a small small sport Depends on what you compare it to but there are a lot of people playing CTFs And so we can't answer that in a general way What we can say is that there are a lot of Academic teams so for example kids at EF is based at KT We also have have non academic people or non students in in our team But yeah, there are a lot of teams that are originally based at some at some university Then there are teams that are primarily Based on or primarily possessed of people that work the same company So for example Google used to have I think used to have a big CTF team with Google security research researchers So that's that's some That's one one group of teams and also there is there are merger teams And I think they're especially interesting for the community aspect, especially for big international competitions teams merge together to form from bigger teams and increase their odds of winning and This is also one cool way to meet other people even outside of your local CTF team because you play This is these CTFs together with with other people Yeah, who who also have good ideas and know know a lot about Exploiting stuff. Yeah, this is this a rough overview And now that we know who's who's playing these events it may be interesting who's organizing them Most CTF events are just organized by CTF teams. So we have big Mostly yearly events like high space CTF played CTF Alice CTF who are run by by these teams We have some CTFs that are organized by by companies So there's a yearly Google CTF and real world CTF or really big and successful CTF events and These are mostly online events. So you can join from wherever you are There are also some CTFs that are part of conferences So I think the biggest is the deaf con CTF at the deaf con conference in Las Vegas There's hitcon CTF also part of hitcon conference There's the CCC CTF at the Congress and of course give NCTF here at give in and these CTFs are cool because of course you can meet people in person also from from other teams Yeah Yeah Already it I think that's that's all we wanted wanted to tell you today I hope we could motivate some of you to to have a look at its CTFs and Try try your own own luck So of course the most important takeaway here is go play GP and CTF as Liam already said we have Beginner friendly questions Challenges from most categories We already mentioned it in the in the far plan so we are trying to do some kind of team matchmaking service So if you think okay CTF sounds cool, but I want to play with someone else Raise your hand now and look around So we're going to give you a bit of time so you can actually try to remember who here else is raising the head Okay Let's see how this works and of course a bit of Q&A. I think we have plenty of time probably You are a bit of time Yeah, and otherwise just ask us if you see us here at get in give NCTF Maybe is still running to tomorrow evenings or more than 24 hours enough time and of course you can just contact us Why email or matrix? Okay, are there any questions First thank you cool Is there a limit of the team members in these? Challenges and these events So I think when Google with this huge amount of people of very high qualified people It's kind of unfair against the team of five or six students at least from my point of view There's some CTFs that have a team member limitation, but most of them actually don't Mainly also because it's hard to enforce also We we've seen these big merger teams and these these growing teams and we're also part of part of one But what you actually can observe is that it doesn't scale linearly It's it's a lot of communication and it's much more about The how how in depth are your players so so there are some with and some without I think I saw a question in the back there Or there in the front Thanks for the talk. I only read about the necromancer Virtual machine. I guess that's also a CTF, but it's not intended to be a team CTF. Is that correct? Have you heard about that one specifically? Maybe I heard the name So so I can just like I can't tell you about this specifically I could tell you in general there are some CTFs like CSCG which are solo events so without teams And what that there's also if you say virtual machines It might be like a crack me crack me is a related topic to CTFs Which are mostly more long longer running? It's not a Timebox competition, but it's like they are always and you can just try your luck and maybe the this one is a solo thing But I can just speculate Hello, do you have some recommendations for some interesting tools for example? I guess that everyone knows cyber chef for example, but do you have some? lesser known tools that you can recommend Which are useful? I Think it's it's hard to give a general answer on that because like as we said there are a lot of different challenge categories And I think most tools are especially useful for for a single categories for example if you do reverse engineering Think you're going to use something like Giedra or or either pro or some reverse engineering tools. I Don't know of me. Maybe I follow up on that so Yes, their cyber chef is cool, and it's like for its own category Then there are decompilers and then there is like a bit of software that makes decompilers better like connecting it with Debugging debug to sync is one lesser known tool. I'm not sure if you heard about phone tools before it's what what we use like day-to-day to interact with servers and Kind of solve these binary exploitation challenges, but yeah It's hard to give a comprehensive list of all these lesser known tool tools oftentimes You just find a github repository with like four stars and it actually does Disassemble this old architecture that you're looking at so yeah Maybe a bit of an unsatisfying answer there What about tools like chat GPT? Can I use that? Is that forbidden or? Generally speaking There is there are very little things that are forbidden at CTFs as though things like sharing flags and or actually Communicating with other teams about solutions. That's that's big big. No. No, but tool-wise I think everything you can use you're allowed to use a chat GPT Chat GPT is fine and I think there are some people are using it and it's especially interesting It is kind of helpful in the reverse engineering context sometimes because it can It seems to understand what some assembler code is doing and can give you a high level Ideas about about it. But yep, you can you can use pretty much everything. Are there any other questions? if not then Thank you for this talk not only for this talk but also for organizing the CTF right here at gpn and The last round of the loss for Martin and Lyon


All right, looks like we've got everything connected, so I think we can probably kick off. I guess the first thing, thanks for joining the session. We'll start by giving some quick intros on ourselves. So my name's Andrew Omarad. I sit within our data engineering group. And on the one side, I look after our business intelligence platforms. And on the other side, I look after our data governance tooling within the alloy ecosystem. I've been with the firm for around 20 years and probably spent the last five years in the data space. Hi, I'm John Pencilow. I've been at Goldman about 11 years. I work in the data engineering space as a developer on the legend platform. I've worked on the legend and pure platforms for around eight years now. All right, so before we dive into the main part of the talk today, we just wanted to give some background for those that are less familiar with legend. Legend is a project that we open sourced through Finos back in October 2020. And one of the goals was to open source some of the technology that we used within our own internal data platforms for a number of years. Internally, those products are known as alloy or legend, so sorry, alloy or pure. So if I use those names, they're largely interchangeable, although it just varies which parts have actually been open sourced and things like that. So there was one aspect that was the technology. The other part was really to actually provide a place or a platform for people to collaborate on financial models and have a way to describe those concepts and use them in a way that is formerly expressing the business concepts rather than describing them in words or documents that people have to reinterpret. So one of the key goals early on was actually around using that as part of the pilot was using that to collaborate and contribute some changes that ultimately were proposals for the CDM data models. So from a code point of view, it's on GitHub and is actively contributed to by our developers each day. So parts of that is open sourcing the existing alloy code features into the legend code base. The other parts of it is actually contributing new features initially going straight into the open source version and then being consumed back internally. So to talk about legend as a data platform, really it's an ecosystem of tools and also a way to think about your data. It takes a relatively biased view and wanting people to formalize the concepts of their data sets and the relationships between them. And really the idea of that is to, well, one, bring trust and understanding to data consumers so that they know what they're working with, but then also from a data producers point of view, make it easier for them to provide data services that can scale to many different consumers who may have slightly different questions or are looking for different insights. The tools aim to help all the way through from discovery, right the way through to governance. And one of the key components within the platform is around, is the data modeling side of things. So the goal is to enable people to express kind of business concepts and map that to the data that provides it. So it's not providing directly to the users the physical way the data is stored, but actually expressing it in a way that makes sense in the business domain. So internally we use legend for both creating models within applications but also for our core enterprise data models where that kind of trust and confidence and traceability in the data sets becomes critically important for those data sets they feed into a number of regulatory reports. So I'll hand over to John to talk about the problem space today as we, oh actually I guess I missed it. The aspect there that we've focused a lot in the past on the models and the existence within Studio but really what today's talk is focusing on is how do we bring the information that's in those models and expose them to other analytics sources and tools. Yeah sure, so thanks Andrew. So yeah, as Andrew just said, a lot of what you've probably heard about legend is very much this model in space and building out strong data models using strong modeling concepts and building out big graphs of models which is fantastic. In the wider world a lot of the tooling that people use work much more in the flat space, in the tabular space. So if you think of pandas and data frames if you think about a lot of BI tools they integrate very well with relation tables and if you think about a lot of other tools you use a lot of what you're visualizing data in is fundamentally grid tables. So how do we bridge that gap? How do we allow people to use the data models, use the power of the legend platform and everything you gain through that but still be able to use the tools that everyone knows and loves and consume your data and visualize it. Now we want, as I said, we want people to just kind of use the power of the platform and really what we're trying to avoid is people kind of just in their BI tools hard coding database connection details and just connecting to raw data. We want them to be using and consuming their data via the models that the data producers have actually provided them. So where do we start? We start, as you'd expect, with a data model, the graph world. On the left here we've got a very, very simple data model but we need to flatten that somehow to get it into these tools. So how do we do that? This is where the pure language and protocol comes into play. The pure language and protocol is similar in nature to something like GraphQL but really here we're gonna focus on what we call the project function. So here what the project functions allows us to do is navigate through that graph and perform complex operations on that graph, filters, expressions, calculations, et cetera, but then be able to actually project a flat table view or tabular dataset, TDS output. So if we look at the example on the screen, the code block, you will basically see the project with a list of eight columns that will end up being your columns in your table. If we specifically look at the fourth column down, we can see there a very simple navigation from the source model and then going through the product information to the manufacturer names. This is a graph navigation ending up with a column. So now we've kind of got this project function. We can actually then wrap this up and bind it to the connection details and the mapping that the producer has provided to make something that's an executable unit. This executable unit can also go through a full software development lifecycle process, review, release, et cetera. So we've got a nice executable well-governed unit. So now we've got that. How do we actually go from that and then using all of our BI tools to get that data? So this is where the legend TDS protocol comes in. TDS is a tabular dataset. Now, the legend TDS protocol is firstly modeled. We have a data model in legend as you'd probably expect. And there's two real concepts within the protocol. One being an input and the other being an operation. An input being, like I've just kind of said, a legend service or there's many other examples of inputs you could put into it. And operations being standard sort of relational kind of operation you'd expect. Things like sorts, limits, filters, joins, et cetera. The protocol itself is designed to be fairly readable. So when we show you some of the examples of the protocol itself, the names of the functions, the parameter names in the payload you see are very readable. And it's very visualizable as well. It forms a pipeline of operations from an input source with all your operations actually stacked on top of that. And so it's very visualizable. We have tools where you can pass it the TDS protocol graph and it will just show you the graph of all what's happening or the specification of what you've asked for. It's also very extendable. It's very easy to plug in new input types and new operation types into the protocol. So that's really the basis of it. It's a protocol for defining pipelines of operations. Now we move to the other two parts here, which are client libraries that are built on top of the TDS protocol. And we start off with the Python library. Now the idea with the Python and the SQL library, both of them really, is to get a kind of natural native feel. So when you're in Python, you're writing Python code as you would normally write. In SQL, again, you're writing SQL or interpreting SQL. So the Python library is directly integrated with data frames. So you essentially create a frame on an input and then push down further operations on top of that using sort of lander expressions on top. And the SQL, very similar, allows you to write SQL expressions where essentially the from statement is from your input source. So it'd be like from the legend service that you want to actually execute. So I suppose, why are we doing this? Why can't people just connect to the database tables? And a lot of it comes really down to separation of concern between the consumers and the producers. The consumers want high quality, trustworthy data, but they shouldn't need to understand the complexities and technicalities of the actual raw data itself, the database tables, the joins, the authentication, the scaling, where the data actually belongs, et cetera. But the producers, the people who kind of own that space know it, and they want to be able to abstract their users away from that behind this data modeler. So a single input or a single sort of interface into their data via a data model and hide the complexities away from the users. The legend platform itself also gives you a lot of other benefits, both for a consumer and the producer. So things like operational metrics we've traced in and usage analytics and lineage calculations, which if you're just directly connecting to the database through all your BI tools or in Python or whatever, you don't get that. So we out the box, by consuming your data through the platform, you get all them benefits. So we can move on. So how does this really kind of work? And the kind of key point I think to this slide really is the TDS protocol being the common interface from all of the BI tools. And the TDS protocol being able to then be pushed into the legend engine to then interpret the pipeline of operations that the user has asked for and be able to push them all back down to the data source. So the user is not consuming all of the data and then doing client-side filtering. Every operation, the filters, the source, the limits, et cetera, are all pushed down through the engine, back to the underlying database, for example. And really here the connectors are to kind of indicate the integration point. So in the BI tools, you might create a SQL connector which enables you to parse the SQL that is generated by these tools into the TDS protocol to really then define this specification of what you're asking for. So let's look at a couple of code samples of in practice what this looks like and Andrew's gonna do some demos on this as well. So the equivalent pure here is really our kind of end goal of what the client is specifying in the UI and the equivalent pure is what we're trying to essentially push down into the database. So if we kind of look at what we've got on the screen, we've got that projection, so the flattening of the model and that really becomes your input. That's the kind of the legend service that's been encapsulated into executable units. And in this example, we want to push down an additional filter on the vehicle speed is greater than 50 and also then restrict it down to these four columns. So that's essentially the pure expression that we are trying to end up with that we then convert to SQL in the engine. So what does that look like from a Python perspective? You'll see here we've got the Python library it's called PyPure here and really that the frame, the input becomes a reference to that service. So this example is car crash is the name that we've given to that legend service. And then the user is writing a filter and a strict operation onto that. And when you go to materialize the frame really that's been interpreted, we're building up the TDS protocol and everything is then pushed down. And exactly if we move to the SQL operations here, again, what you really see in here is the same operation it's select these four columns from the reference to a legend service where the vehicle speed is greater than 50. So you can kind of see how all of these things are one and the same really. And the SQL expression will then get passed in the SQL connector, form the TDS protocol and gets all pushed down. If we actually look at what the TDS protocol looks like from a kind of wire protocol JSON perspective, it's really a very simple graph and pipeline of operations here. So you'll see at the top the first node being a reference to the LO service and then the two operations being pushed down on top of that.  Yeah, so we're gonna move to some demos in a moment. But really, before we move to that, we just wanted to touch on how we've been using it internally of having this tabular or query access onto services. And I guess from my own perspective of looking after our business intelligence platforms, this has enabled us to bridge that world of people that wanted to build their self-service analytics but then from a data producer point of view, the other, the producer side wanting to use the legend modeling capabilities. And so suddenly it now means that we don't have to, there just doesn't need to be a legend specific BI tool. It's you can use your existing tools and connect to that. So I mean, to touch on one example, there are a few written up here, but we had a team within RISC who were within our RISC division who had already created some data services that they were using in their backend analytics and wanted to provide some data reporting or visualizations to their management group. And so rather than breaking the encapsulation of the logic that they had within their data models, they were now able to use those same services and just connect directly to them using their preferred BI tools. So to move to the demos, we've got a few demos here. They all use a common data service for input to sort of keep them consistent. Really the idea here is just it's showing, it's a data service that a producer has nominally created. It's showing vehicle complaints information. There's, the service has one row per per complaint and has about a million rows in it. And then there's different dimensions of where the complaint was created, what vehicle was involved, et cetera. So the first example that we just wanted to show was being able to access this from Python in a kind of a standard Jupyter notebook environment. So this lets a suddenly connect data that's in the legend ecosystem into the Python platform where people may prefer to do more advanced machine learning or other types of analytics. You'll see here it's a relatively straightforward interface of just pulling in the library dependency and then creating a data frame and a query on top of that. People can preview the data as well to begin to get a feel for how that feels. And they can also build more complex queries. So in this case here, it's doing some aggregation, some sorts and limits. And the important part to reiterate here is that that query is actually getting pushed to the server. And so it's pulling back a smaller data set into their Python environment. So we're not pulling back the full one million rows. In this case, we're just pulling back the aggregation terms. And once we've got a pandas data frame, we can begin to use it in the standard way within Python. Like here, we can display it as a table, but we can equally go on to render it as a chart. In this case, showing the number of complaints by state as to where they were. So we begin to get that analytics capability. One of, actually, I guess this is just showing in slightly more detail the code that goes into that query because slightly concerned the text was too small to be able to read. But that's from the client point of view, their experience. But how do we show what's actually happening within the legend platform? Well, within legend, we have observability as a key feature. So we have Zipkin traces through it. So we can actually look at the spans or the activities that are happening as part of that request. So we can see all of the details of how long it took to connect to the database, how long the query took. And most importantly, in this case, we can actually see the requested payload that was sent by the Python client. So to zoom in a little bit on it and call out some of the features, this is the JSON graph. It's a relatively simple one that it built here. But it shows the reference to the service. It shows there's a request for the aggregations going on and the sort and the limit. Now, if we then jump to imaginary later on, looking at another step in that Zipkin trace, we can actually see the database SQL that was executed for that. So really, the reason for showing this is to repeat the aspect that we are taking the original data service that a producer gave. We're taking the user's intention of what aggregates, filters, or sorts they wanted, and then translating that down to the optimal execution to only pull back the data that they need. So you see the features here, again, the top 10, the order by the aggregations, et cetera. To flip to a different example integration that we have here, this is a web app built. So we have a few different integrations that are using the TDS protocol to fetch data. In this case, this is actually just a query building tool. And people can use it as part of exploratory data analytics to get a feel for what's in different data sets or as part of that data lifecycle to understand how they might want to create the model of what the range of values are and things like that. Or they might be exploring to see does it make sense to join two particular data sets here. So in this case, it's doing a very similar query here of taking it, building an aggregation, previewing the results. But it's a very visual experience. So non-engineers or kind of low-code users are able to use it to build those aggregations, filters, et cetera, and still just pull back relatively small result sets for them. And then again, just to show the kind of almost the traceability behind that, you'll see the features here. This one's showing the filter capability, ultimately if we go on to look at the SQL for that, we can see that it's got the same filter being pushed down here. You can see it at the end of there, saying filtering the state, which was the last activity. The final integration or demo that we just wanted to show was more from a commercial BI tool being able to let users connect to those data sources. It's got a native connector for people to be able to easily say, okay, I want to connect to, in our case it's called alloy because that's our internal name, but conceptually it's legend as well. It lets them pull in, they can give the reference to their service, they'll begin to get the natural feel that they would within that BI tool where basically the services from their point of view being presented as a virtual table. They can add calculations within the tool, which would again be translated into SQL, which then gets pushed down for execution. So yeah, really we're not trying to add a layer of large computation in the legend engine. It's all about how can we take the user's intention and translate it down to the best SQL for that. So in this case we've pulled up an aggregate number of the complaints in there. You can do the typical things that you can do in a BI tool where you can break out by your different dimensions to get the details or change the actual chart or visualization that you're using, switching to a tree map here. So essentially this is using the BI tool as a query building tool for non-engineers who know nothing about the details of the data service behind it. The SQL that's built in this case by that tool was relatively simple, but these can obviously get a lot more complex as people do other types of visualizations or compose multiple charts together to actually build their dashboard. And the risk of being repetitious, we see the same, you can call out the same features here we're referencing the common service for the entry point. We can see we're changing or restricting the number of columns. And again, we've got an aggregation going on, all of which gets pushed down to the database. So in terms of these features, we just wanted to, they're ones that we use already internally. Our current focus is on contributing those and moving them from the alloy code base and into the legend code base. The target for getting all of this released is in Q4 of this year currently, and that will include the TDS protocol in terms of the specification, the TDS execution, the Python library, and also the SQL connector. And so by doing this, we think it will help enable people to create more integration that will let them, as we've seen, get the even more value out of those data models that they've created and data services. So with that, we will, I guess, firstly say thank you for attending, I think, and the interest in it. Hopefully we've shown you some of the features that you'll find useful in the future. If you wanna follow more or find out more, there's the legend website on Phinos, or equally you can just watch the GitHub repository and see the code land there. Yeah, so from a sources that legend engine can connect to, it can currently connect to relational queries, as the relational sources is the main use case. It does also have support for fetching from APIs or services. But those source connectors for it are different modules within the code base. So they're relatively easy to extend to contribute new data sources and data types too. And definitely that's an area that ultimately the more sources that legend can connect to, the richer the ecosystem and is helpful. Yeah, thanks, anyone? Yeah, as I kind of said, I think a lot of it is really about separation concerns and kind of really data producers owning the technicalities of everything and having this nice logical business model that's been exposed as kind of the interface into that data. As I said, lots of features around the platform that you get for free and the lineage, the usage metrics, the Zipkin integrations, the monitoring, et cetera, that you, from a producer angle and from a consumer angle, you really benefit from. There's also a sort of a real focus around the SDLC of both the models and the services that people can produce. The tooling as well, so the integration with a different tooling and some of the low code tools that we've shown today. Yeah, I think, and as well, the angle of just connecting to a database table of having your BI tools referencing specific databases and things like that is not great from a data producer perspective around understanding who's using your data and things like that. So the engine is, I guess it's an on-demand query, as in it's a request response. Someone will issue a query, they'll get back to the dataset. It's not a streaming event-based thing, but obviously your data source behind Legend Engine could be caching or listening to streams in terms of it updating, but in terms of queries onto the engine, it's a request response kind of interaction. Yeah, I guess it's maybe worth also just clarifying, emphasizing whatever. Where we talk about models, these are data models rather than necessarily the financial, like the models of how do we calculate risk, et cetera. So typically, the data being returned is pre-calculated rather than actually running the scenario or analysis on demand at that point. But yes, ultimately you are dependent on the response of the database, but Legend does have ways for you to optimize that query routing logic. And that's actually from a platform point of view is one of the helpful features that a user might issue the same query, but if you notice it being slow, you can actually introduce aggregate awareness if you notice their query is an aggregate and you could materialize that as a different table. And so from a consumer point of view, the query doesn't change, but as the producer, you actually can influence where and how it executes. Okay, great. All right, well, John and I will be around afterwards. So if people have more questions, please just stop us and we're happy to chat.


In this module we will be introducing the language of thermodynamics. Now thermodynamics is a pretty wide subject with many different possible applications. So for the purpose of this class we're just going to introduce a number of critical concepts on which a lot of our conversations will be founded. And those critical concepts are the idea of energy, equilibrium and the idea of a system. Behind me is Kinsodam and you can see in here that energy does not have to be a very abstract concept. Here you can see the water that is going to turn the turbines and produce electricity. In other words we're seeing energy in action. It's a very large banner in which it gets a whole geologic superior name after the state. And the reason for this is because of the abundance and the widespread presence of cold beds that form during this same period of time. As you take inland organic petrities and you isolate it from the atmosphere and from the hydrosphere. At that point you're going to cook it at a variety of temperatures and pressures. Depending on the temperature and depending on the pressure under which these materials form you're going to get different grades of cold. Now this would be pretty ideal if you were to be forming only the cold. The complication is that just about every mineral forms as part of a rock. When you have a rock what you have is other minerals. Other minerals that we do not want if you're trying to extract more energy. So what this means is two things. It means that you have to separate those minerals from the coal. And it also means that you're going to be producing a large amount of talents as a consequence of it. The interesting part is that you can stop production of the coal. But those minerals that were present there are still going to be exposed to the conditions in the surface of the planet. And that can create... Outside of the city of Altoona in central Pennsylvania. And you might notice something unusual about these streams. Namely it is orange. This is colloquially known as yellow boy. And it forms by the deposition of iron oxides. How do these iron oxides form? Well this has to do with one of the major drivers of the local economy. And that has been the extraction of coal. As coal is extracted we're moving from a closed system in the crust of the Earth to an open system that is exposed to the atmosphere and exposed to groundwater and to surface waters. So the consequences that that has is that the minerals that came along with the coal are going to react with the water and are going to react with the atmosphere. That will result in the breakdown or oxidation of many of the minerals that were present there. So one of the major culprits for the color of this material is the presence of an iron sulfide called pyrite. Pyrite contains basically two atoms, iron and sulfur. But when it oxidizes it produces iron oxides and it releases sulfur into the water. That results into acidification of the stream and death of the fish that were originally living in it. So you see that moving from one type of system to the other has consequences. And also moving from a system that is in equilibrium under one set of conditions to another system in which you are completely out of equilibrium will result in pretty drastic consequences. So here we have two concepts of this chapter and thermodynamics being represented. The concept of open and closed systems and the concept of equilibrium and disequilibrium.


Hello and welcome to this presentation. In this video I'll be presenting a new approach to linear cryptanalysis. So linear cryptanalysis is one of the most important cryptanalytic techniques in modern cryptography. And what we are interested in here is a linear combination of input bits. So that's something of the form u transpose x, where u is a mask, which is essentially a bit factor. And a linear combination of output bits. And we want to know what the probability is that this linear combination of input bits is equal to that linear combination of output bits for a uniform random input. Now we do this for a permutation or a function f, which can be for example a block cipher or a cryptographically secure permutation. And if this is a strong block cipher, then we would expect that this probability is very close to one half. So we can define a measure of quality as two times the distance of that probability from one half. And this is what we call the correlation of that linear approximation. So well-known fact is that if we have about one over the squared correlation samples, then we are able to set up a linear distinguisher. So it's not so surprising, given the importance of linear cryptanalysis, that there have been a large number of variants and extensions that were proposed. And I list some of those on the slide, but it's not so important if you don't recognize all of them. What I'm interested in in this presentation is the theoretical analysis of such function f. And in particular I want to know for a given approximation what the correlation is, because that also will allow us to search for the best possible masks, u and v. And I want to also do this of course for those extensions and variants. So I'm less interested in statistical aspects such as what set we should sample, the inputs from, or what the data complexity and success probability of the attack is. So in this presentation I will try to give a first introduction to the geometric approach to linear cryptanalysis and I'll do this by discussing three of its main goals. And the first one I want to discuss is how do we ensure that all those different variants of linear cryptanalysis, which are based on different kinds of input properties and output properties, that we can represent them in a uniform way. And after that I will use this description in order to generalize some concepts from linear cryptanalysis such as approximations and trails. So what are inputs and output properties? An input property could be for example that we say that the input is an element of a set S, so we have a subset S of the domain of your cipher G. And then an output property could be that we want to count how often the output is in a certain set R. And this basically boils down to computing the size of the intersection between R and F of S. Another way to think about this is instead of using sets to use indicator functions of sets. So the indicator function of the set S is just a function which is zero everywhere except when the input is in the set, then it's one. And this is a complex valued function, in fact it's just a real valued function, but later on it will be convenient to consider also complex valued functions. And here I just want to introduce one notation. So I will say that this function, this indicator function is an element of C superscript G. And that is basically the set of all functions from G to the complex numbers. And that's actually a vector space. So what is the output property then? Well, we have a set R, so we could say, okay, that's also just the indicator function of R, but that's not really what we want, because what we actually want is we want to count how many values are in R. So that means that if we think of the output as being itself an indicator function of some set, which just means the output is in some set, then we want to be counting how many elements of that set are also in R. So actually we need a function from C superscript G to the complex numbers. So this maps functions to complex numbers. And in particular for this example, what we will do is we will make a function that maps a given function f to the average of that function over the set R, average up to a multiplication by the size of R. And this can also be expressed as taking the inner product of the indicator function of R with f. So if we apply that function to the indicator function of f of s, then indeed we get the size of the intersection between R and f of s. So generalizing this, we could say that an input property is like a state. It represents what the state is. And this is mathematically represented by a function from G to the complex numbers. So this is like saying our input is a collection of values and for each of those values we assign a given weight and that weight is a complex number. And the observation of the state is then what corresponds to an output property. So the way we represented it above was using a linear functional. The important part here is that this is actually going to be always a linear function. That's the requirement that we impose. And so this is an element actually of this CZ star, which is the space of linear functionals or the dual. And there is actually a way of simplifying this because for any G star we can find a G such that G star of f is the same as taking the inner product of G with f. So that means that we can actually identify G star and G by choosing an inner product. And this basically means that both input properties and output properties can be represented by functions from G to the complex numbers. So something else that we need of course is we need to know how certain properties and input property transforms when we apply a certain function. And in fact this just means that we need to track how every value in this collection is mapped to another value and we then need to keep track of what weight was assigned. And there is a simple relation between f and the output state which is just a multiplication with a matrix or in other words a linear operator. And what does that operator do? Well it maps the delta function delta x which is just 0 everywhere except when the input is x to the function delta f of x. And this completely defines that operator. One thing that I want to mention which is not so important for this presentation but it's very useful in practice is that we can represent this matrix df in a different basis. So we can just take for example one change of basis is the Fourier transformation. And if we take the Fourier transformation then this matrix df should be replaced by a matrix cf which is also known as the correlation matrix. So what is the basis that we use in the case of the Fourier transform? Well it consists of group characters which are homomorphisms from G which we now assume to be finite a billion group to the complex numbers with multiplication. And so Fourier transformation goes from the delta function basis to the basis of group characters because we don't want to give an arbitrary labeling to those group characters. We simply index the basis functions by elements of group g hat which is the group of all the group characters. And the big advantage of this in practice is that if you have a constant addition, so a translation, so f of x is x plus constant d, then the corresponding correlation matrix, so this matrix cf will be a diagonal matrix. That's because of the properties of these basis of group characters. So far I've discussed only one dimensional input properties, but in fact we can generalize this. We can say the input property or output property is a subspace of functions. And that just means that we consider in the case of the input all possible states in the subspace at once. And similarly we consider inner products with all possible functions from the vector space for the case of output properties. And this is necessary for example for multiple linear cryptanalysis and also for a broad class of input output properties which are known as projection functions. And I'll discuss those on the next slide. Before that I just want to mention that everything I will say in this presentation is independent from the choice of the basis for v. And this is very important because sometimes two different properties or different seeming properties are actually the same, but they are just represented by a different basis for v. So what are these projection functions? So it's a framework introduced by Wagner at FSE 2004. And Bernier at all at AsiaCube 2004 used this to provide a general statistical analysis of optimal distinguishes. So for this projection function based distinguishes. So what does it do? It says that we are building a distinguisher based not on the values of input and output itself, but on the projection of that and that projection is just a function, a sort of compression from the domain of the cipher to much smaller set S. And what I will want to do here is I want to show that these projection functions can all be described within the geometric framework. So we need to associate a vector space of functions to them. That accurately represents that property. And this is the space that I'll be making correspond to that, which basically is all the functions from S to the complex numbers composed with the projection. So just to illustrate what that means, let's take a look at the case of linear cryptanalysis. So in linear cryptanalysis, P is a Boolean function, a linear Boolean function from F2 to the end to F2. And then this V is just a span of delta 0 and delta 1 composed with P. So this for the input property, for example, means that we can apply both the set where P evaluates to 0 and the sets. So it's a hyperplane and then the complement of that set, those can both be applied to the cipher.  So this is what this V looks like for linear cryptanalysis. So one note actually about this is that usually in linear cryptanalysis we do not consider this chi 0 because for permutations this is always preserved as it corresponds to basically the uniform distribution. And so it doesn't provide additional information. Other examples include multidimensional linear cryptanalysis where then you would have a projection function from F2 to the end to F2 to the M, where M is usually much smaller than N. So that would be a linear function as well. But multiple linear cryptanalysis as opposed to multidimensional linear cryptanalysis does not actually follow that framework because of a subtle difference that in multiple linear cryptanalysis while we have several linear combinations that we observe, the distinguisher is not able to combine them in an arbitrary way. So now this provides a way of describing different variants of linear cryptanalysis in a uniform way. So especially those input and output properties, all of them can be represented by vector spaces of functions from G to the complex numbers. And now based on that we can generalize the notion of a linear approximation and then give some links between different types of approximations. So an approximation is just a pair of subspaces, one U corresponding to the input property and one V corresponding to the output property. And for this kind of a pair we can define an approximation map which is a map from U to V and it consists of three composition of three maps. So the first is an inclusion map just from U to C superscript G. Then there is this transformation by the transition matrix for F and finally we do an orthogonal projection on V. And this combination of three maps has the underlying idea of essentially computing all the inner products between vectors in U transformed by F, also functions in U transformed by F and then the inner product of those with functions in V. So this is the basis free way of expressing that. Of course it can also be expressed in terms of the correlation matrix if we take the Fourier transformation. So the first thing I want to mention about this is the notion of principle correlations which is a concept that generalizes ordinary linear correlation. And it's defined as the largest, so certain, the singular values essentially of the approximation map but we only take the largest few because some of them are necessarily going to be zero. And what this means geometrically is that we look at, if the case that F is an injection, we look at the principle angles between T, F, U and V. So in this example there is a common line here so that means the first principle angle will be zero and that means the cosine of that angle and the first principle correlation is going to be one. And then there is a second principle angle, so that's sort of a minimal angle which here is something non-zero but positive. So let's take a look at that in the case of linear cryptanalysis. So here we have this vector spaces U and V of the form that I described before. Let's assume that there is a permutation just for simplicity. So now the approximation map is going to look like this. It's a two by two matrix when we express it in the basis for U and V that's consisting of the scribe functions. And then the off-diagonal elements are zero because of the balance of linear functions and the on-diagonal elements are one and C, so some constant C. And that means of course the singular values are one and the absolute value of C. And this C actually is the correlation of a linear approximation because it is equal to this expression which is indeed exactly the same as the correlation of that linear approximation. So this means that indeed principle correlations are a strict generalization of ordinary correlations. So now I want to discuss a few possible geometric situations for approximations. The first case I want to discuss is that of perfect approximations where we have a situation where the space Tf times U is included in the output property space V. And if F is a permutation this is the same as saying that all the principle correlations are equal to one. So one interesting case here is when V is equal to U, that case is what I'll call invariance. And this includes among other things invariant subspaces and nonlinear invariance. One interesting thing to note here is that if T superskipped F is diagonalizable or equivalently the correlation matrix is diagonalizable which is normally the case, then any invariant subspace must split into one dimensional vector spaces spanned by the eigenvectors of the superskipped F. And after taking a free transformation this means that invariants are a span of eigenvectors of the correlation matrix of F, which is a characterization of invariants that I introduced in previous work at Asia Crypt 2018. So those are perfect approximations. Now I want to discuss the opposite case which is zero correlation approximations. So what we have here is we have a situation where TfU is perpendicular to the output space V. And this is again equivalently in terms of principle correlations all of them are zero. And I just want to mention, so this is for example zero correlation linear kip analysis. I just want to mention one interesting result about this. Namely if UV is a zero correlation approximation then UV perp which is basically replacing V by its orthogonal complement is going to be perfect approximation. So this is clear if you look at this figure if you take the orthogonal complement of the plane V here that's just a line perpendicular, sorry parallel to TfU so it's a perfect approximation. So this is very simple result but it's very powerful and one of the special cases of this for example is the well-known link between multi-dimensional zero correlation linear kip analysis and integral distinguishes. So those are kind of edge cases which are closely related by this link by taking the orthogonal complement. Now I want to discuss the general case in the remainder of this presentation. The general case basically depends on what the approximation map is so it includes then a description of nonlinear approximations and multi-dimensional and multiple variants of that as well as some things like partitioning kip analysis. So here the important thing is that we are talking again about probabilistic approximations. But the big question here is how do we compute that approximation map? So we now know that approximations are pairs of subspaces with an approximation map but in general we need to know what that approximation map is. And the way to do this for most ciphers is using trails and then we need a corresponding piling up principle. So what are trails in ordinary linear kip analysis? So the idea is essentially that we have a sequence of intermediate masks and these define a number of one-round approximations. So we assume that our function is actually a composition of smaller functions fi that are called round functions. And we have a linear approximation for each of those with a known correlation and now we want to glue them together in order to obtain an approximation for the composition of all those functions. And then the question is of course what is the correlation of that approximation? This is not a simple question in general to answer. In our general setting we have something very similar. We are asking for the approximation map over the composition of those functions given the approximation map of approximations over one round of those round functions individually. So here we also will call the sequence of subspaces u1 up to ur plus 1 a trail through this structure. So the traditional piling up principle is the way to glue together these one-round approximations. So what we do there is, first note that we are interested in knowing the probability of the left-hand side of this equation. So we want to know the probability that this is zero. So we can write that as a sum of similar expressions for one round and then everything drops out except the first and the last term. So let's call these terms zi. Now if the zi would be independent, which is not true, it cannot be true, but if they were independent then the correlation for this approximation over r rounds would be the product of those one-round correlations. But as I said they cannot be independent because they are all basically deterministically, so they depend on this xi and these xi are just deterministic functions of x1, all the same x1. So how can we motivate this if this is not true? Well, there have been two main ways. One is the Markov-Cypher assumption. The Markov-Cypher assumption is essentially equivalent to saying that we can say on average over independent round keys the correlation of this approximation is equal to the product of the one-round correlations. But this requires us to put a mask on the key because otherwise the average would be zero. But of course the downside of this is that first of all round keys are not necessarily independent and second of all, and this is more important, we are not really interested in the average correlation. We are always interested in the correlation for a fixed key. So that's the downside of the Markov-Cypher assumption. Also especially if you think about cases such as kptographic permutations where piling up is also regularly used but where of course there is no key. The second approach to this has been the dominant trail hypothesis and this essentially follows from a result that first appeared in Johan Daman's work on correlation matrices. So the result is that the correlation of a linear approximation is the sum of the correlations of all linear trails. So you need to consider all possible linear trails to get the exact correlation of the approximation. But if one of those trails has a much larger correlation than the others then it can be considered to be dominant and then this piling up principle might be true. So this is quite a nice motivation but the problem is that in a nonlinear case it's not so clear what all trails means because there's no unique way as for linear approximations to represent all the trails. So that is one issue. Another issue is that for some of the extensions this dominant trail hypothesis is also kind of underdeveloped. So for example for multiple linear cryptanalysis. So the general piling up principle proposed in this paper is that the theorem that says that the approximation map for the composition of f1 up to fr is equal to the composition of the one round approximation maps. So for each of the approximations in the trail plus an error term e and that error term can be computed explicitly if we want and that is also written in the paper. So in this case the motivation here sort of is very similar to the dominant trail hypothesis but it has a geometric flavor. So in particular we call that at the end of each approximation map we have an orthogonal projection on the output space. So if we start with something in u1 it will get transformed into something after tf1 which is not in u2 but we will project that orthogonally on u2. Now when we do that there is also part of the output which is not in u2 but which is in the orthogonal complement of u2. And that part will be essentially ignored in the sense that we will move that part to the error term e. And we just continue with the part which is in u2. We transform it into tf2 and then we get something which is not in u3 but again we project it orthogonally on u3 and then the part which is in the orthogonal complement is moved to the error term. So this essentially motivates piling up as a process of successive orthogonal projection and it's of course possible that something goes wrong here in case that there is a good approximation between one of those orthogonal complements and the output space. But this, similar to the domain and trail hypothesis tells us where to look when something goes wrong. So to conclude I've given a rough overview of the geometric approach to linear cryptanalysis so the first step here was to represent different kinds of input and output properties all by vector spaces of functions. This provides a uniform description for them and then based on that we can generalize the notion of a linear approximation to a pair of subspaces and for such a pair we defined an approximation map which then had some properties such as its singular values behave like a generalization of ordinary correlations. And then there were several different types of approximations such as zero correlation perfect approximations but in the general case it's necessary to compute that approximation map or at least to estimate it and for that we need trails and the piling up principle and so as I discussed this piling up principle in the general setting takes the form of a geometrically intuitive process of successive orthogonal projections. So as I said this is only a brief overview and there are more results and more details in the paper with also some specific applications. All the source code for the results in the paper can be found at the link that's shown here on the slide. Thank you for your attention.


U.S. Navy and Japan Maritime Self-Defense Force Sailors stationed around Japan came to Yakosuka to take part in a three-day bilateral, non-commissioned officer leadership continuum. It is the second time the conference has been held and aims to build relationships between Japanese and U.S. sailors. Many of the challenges that we face are very similar. Many of the ways that we attack those problems are similar. And so being able to come together and use the best traits from both countries to get after some of these challenges has been really, really remarkable. It taught me a new perspective on the Japanese military and I'm really grateful to be selected for this class. Now everything took place in a classroom. After hours, they played softball to further build camaraderie and tour de ship from each Navy. Reporting from Yakosuka Naval Base, I'm Petty Officer Chase Holly.


So far we have covered current, voltage, resistance and ohms law, so now it's time to start putting all this knowledge together and start analyzing some circuits. So if you have a look here, I've created a circuit here, it's a very simple circuit that contains a 9 volt battery, which is connected to using this breadboard here. It's just a component that I can use to connect other electronic components. I've got two resistors, so there's one resistor which is then connected to another resistor and then back to the negative terminal. So it's positive terminal of the battery, first resistor, second resistor to the negative terminal of the battery. So if I wanted to draw a circuit diagram of this circuit, it would look like this. So here we go, we have two one ohm resistors that go, so current would flow from the positive terminal straight to the first resistor, then through the second resistor and finally come round to the negative terminal. So how can I predict how much current is going to flow through this circuit here? Well the way that I can do that is I can use a very special, well there's two very special rules and they're called Kirchhoff's laws. But the key thing is they derive from two fundamental concepts in physics. The first one is conservation of energy. The second is conservation of charge. So these two principles lead to two Kirchhoff's laws. Conservation of energy states that if there's any loop in the circuit, so in this case our circuit forms a nice loop, then the total voltage, if you start at one point in the loop and you go all the way around, you must end with the same energy that you started with. So I'm going to start at this point here, I'll highlight it with yellow. If I start at this point in the circuit, if I go across the battery I gain nine volts of energy. So if I gain nine volts here then as I go around I must lose nine volts of energy across those two resistors. So that there is what we call the loop rule and that derives from conservation of energy. However there's also conservation of charge. And this is what we call the node rule. What that means is if I have a particular point in the circuit, maybe let's choose this point here. Then the amount of current that flows through this particular point in the circuit, the amount of current flying into it, must be equal to the amount of current flying out of it. So this is called the node rule. And all that means that there is going to be no charge building up at any point in the circuit. Therefore the charge going in must equal to the charge going out. So using these two rules I can make all sorts of predictions about circuits. And in this case here I'm going to use them to predict what the current is going to be through this circuit here. So let's see what do we know. I've got nine volts on this side. So that means that at this point here I must still have nine volts. And at this point here I'm at zero volts. So as the charges move across these resistors here they must lose nine volts of energy. And I also know that the amount of current that's going into this resistor must be equal to the amount of current going out of this resistor because of the node rule. So I know the current through each of these resistors must be the same. Let's put this into equations. I'm going to call this resistor, resistor one, and this resistor, resistor two. And I know that the voltage drop across both resistors, so the voltage across resistor one, plus the voltage drop across resistor two, must be equal to nine volts. And I also know from Ohm's law that the voltage across one of these resistors is going to be equal to the current times the resistance. So in this case I would have, then using conservation of charge or the node rule, I know that the current going across resistor one must be equal to the current going across resistor two. So I1 equals I2. So now I have a series of four equations. I can use all these equations together to find the current that's flowing through the circuit. So first of all, I'm going to substitute, first of all, I'm going to substitute equation two into equation three into equation one. So that will give me, and now I'm going to substitute equation four to get rid of I1. So now I can rearrange this to solve for I2. And in this case I know that both R1 and R2 are equal to one Ohm each, so that gives me, excuse me, nine volts over two Ohms, which is equal to 4.5 amps. So now I've worked out the amount of current that is flowing through this circuit.


The physical fitness session served as a culminating leg of the HART's original training workshop and the non-communicable disease NCD framework monitoring meeting which were held in San Lucia on May 16th to 17th and May 18th to 19th respectively. Representatives of over 17 countries converged in San Lucia over the four days to dialogue on the current realities associated with non-communicable diseases and to map the way forward as governments in the region look to improving healthcare. The workshops were held in collaboration with PAHO and WHO. HART is a program aimed at blood pressure control and cardiovascular risk reduction. Physical exercise is one of the recommended daily activities in combating hypertension, also referred to as high blood pressure, often a lifestyle-related medical condition. Dr. Melia Del Riego, PAHO, WHO representative for Barbados and the Eastern Caribbean countries, applauded San Lucia and other regional territories for their efforts at implementing the HART's initiative. Dr. Melia Del Riego, PAHO, WHO representative for Barbados and the Eastern Caribbean countries, of a health, wellness and elderly affairs, Honourable Moses Jabatist, who delivered the feature address at the opening of the workshop, spoke on strengthening primary care for advancing the management of non-communicable diseases. The minister added that as the region slowly recovers from the COVID-19 pandemic and embraces the lessons learned, it will do the region well to focus on primary healthcare which forms the foundation of the entire healthcare system. From the experiences gained during the COVID-19 pandemic, we see the need for change and the need to come together as we use best practices to build stronger primary healthcare systems which respond to the challenges posed by NCDs and their risk factors. As mentioned previously, primary care must be patient-centered. Patients must be at the core of what we do. As we move towards decreasing the burden of NCDs, we must ensure that no family is driven into poverty because of illness. Healthcare must be affordable and the necessary partnerships through social insurance schemes must be fostered and strengthened so that everyone has equal opportunity to care and to get essential drugs and services. In St. Lucia, NCDs contribute to 82% of mortality annually. According to the health minister, through St. Lucia's implementation of the performance-based financing project PPF, different health regions will have free access to medication and lab testing during the first level of care for people living with NCDs. During the workshop, several healthcare practitioners received training in the heart's modules and cardiovascular risk management CVRM facilitated by PAHO. From the Communications Unit of the Ministry of Health, Wellness and Elderly Affairs, Chulita Peter reporting.