Good afternoon. I'm here to present the talk on we the government are here to help. What we're gonna do is talk about the FIPS 140 standard and take a look at take a look at it. So the agenda here as you can see I want to give you a little bit of who I am then we'll talk about the background of the standard get into FIPS 140. I'll go through the validation process and then we'll look at some of the requirements. It's kind of hard to talk about the the good and the bad of the standard without actually knowing what's in there. We'll also take a look at some of the future kind of give you an idea of what's what's to come. I've also allotted a little bit of time hopefully for some Q&A in a year if necessary. There's also the Q&A room after the talk as well. So who am I? I am Joey Muresca. Some people may know me as lost knowledge as my handle on Twitter and what I go by a couple other places. I work directly with FIPS 140. So I have experience in the area for the last five years I've been doing FIPS validations. I presently run a FIPS validation lab and I have seen hundreds of validations in that in that time period. So I've seen a lot of different products and seen how a lot of different vendors implement their requirements. Outside of work I have other interests. I do programming. I'm a lock picker. I'm just a general security enthusiast. I think it's you know I think it is one of the areas that gets overlooked a lot by some people because it's hard to convince people that they need security until it's usually too late. One disclaimer and I added this at the last second because I realized there are a few people here who probably know who my employer is. So just the standard disclaimer that any views and opinions in the talk are my own not that of my employer or anybody else for that matter. So that question is why am I here? So I wanted to shine a new light on security standards particularly some of the government standards. I hear a lot of people who talk about negatively about the standards. They complain about the processes. They complain about the requirements and having to implement them without having a lot of knowledge about what's actually within those standards and what actually goes into them. So the hope was that you know to give a new look at these standards you know the important thing to remember is that no standard is going to protect against everything. You know they standards become dated because they all take a long time to develop. Their enforcement is always going to vary and so that has a great impact on the security as well. The last thing is that they do provide sometimes they do provide a false sense of security and that can also be a negative issue you know that no matter how much I talk about it is always going to be something that's going to exist. So what is the FIPS 140 standard? It is the federal information processing standard number 140. This defines the requirements for cryptographic systems that are to be used within the government for protection of sensitive information. The program is actually managed by both NIST here in the U.S. as well as the Canadian government and through their CSEC which is the Computer Security Establishment of Canada. There are two groups at NIST that actually handle the management of the program, the CMVP and the Cryptographic Modular Validation Program and the CAVP, the Cryptographic Algorithm Validation Program. And they're the group who are responsible for the kind of for all the algorithm testing that's required as part of the FIPS process. The last kind of thing is as I mentioned it is you know largely a federal government standard, though it does have acceptance in other areas. We've seen cases of other standards bodies who have required FIPS validations as a pre-wack, pre-wack, pre-wack, yeah. Yes, I can't speak this morning. Yes. Well I need a world drink so if anybody has them. So the past, present and future of FIPS. So the original version of the standard was 140-1. It was originally published in 1994 and was eventually replaced by FIPS 140-2. The currently is a development for a new revision of the standard 140-3. It has been in draft since 2005. You know, I always tell people you know it's going to be coming, we're going to be seeing it eventually. I've been saying that since I started doing this work. So how does the process itself actually work for validation? So there's actually three main parties involved in the validation process. There are product vendors. Somebody has to create the product to be sold that is going to be validated. There's the accredited labs. There are over 15 at present. I think the actual number is maybe 18 or 19. And then there's the CMVP. The ones who are responsible for issuing the actual validation certificates. What's important to remember is that the government doesn't do much beyond review reports from the labs. So there's a lot of variance in testing because each lab, even though they're following the standard, they may have different methods of actually performing testing to verify requirements. So we're going to start taking a look into the actual standard itself. There are kind of three key components to FIPS 140. There's the standard itself, which is kind of the core document and what was originally developed. And there are two kind of ancillary documents that they've created. The derived test requirements. The derived test requirements and the implementation guidance. Do I even want to know what it is? Yeah. I'll wake you up in the morning. So the requirements are actually divided up into 11 sections. And I'll take a look at each of those a little bit later on. And there are four increasing levels of security. And so you definitely see within those four different levels, you will see kind of the difference. You know, a level one validation from a security perspective isn't gaining you a lot. All the documents, all three of these documents are available on the CMVP web page. I've included a link in the slides. I do not know for sure that the slides made it into the DVD or not. But I will post them on my web page after DEF CON. So they'll be there even if they're not on the DVD. So the FIPS 140-2 standard. As I mentioned, this is kind of the original, the core document from which the other two documents are derived. This defines all the requirements and it also defines all the terminology. One thing that you'll learn not with just FIPS but with most standards is that they have, they like to come up their own words. And so it can be a little bit of a pain sometimes to correlate that terminology to the words that we all use, you know, normally. Now the document can be vague. This has been one of the issues I think with implementations is that the standard will read one way and then it's up to an individual to actually interpret that, you know, requirement. The derived test requirements is a much longer document and actually the one that kind of breaks out what needs to be tested by both the labs as well as what needs to be provided by vendors. So it's organized kind of as I've shown here using assertions which are direct quotes out of the standard and then underlying vendor evidence items or what you'll hear me refer to as VEs or test evidence items that are referred to as TEs. And these two items are usually counterparts to each other. For a vendor evidence item, there's usually a matching test evidence for that we have to perform to verify it. So the implementation guidance, this is the smallest of the documents and it actually is intended to clarify the requirements in the other two documents. It's said that it's not supposed to introduce new requirements. However, that's not really always the case. There are times where the implementation guidance can be said to extend or even introduce new requirements that aren't currently existing in the standard. But it does tie back into both the standard and the derived test requirements. So as you see on this slide here, I've tried to provide a mapping and I hope it comes out pretty well. But as you can see in the top, the top portion is taken from the standard. I've tried to underline the I've tried to underline the quote from the standard. And as you can see that same quote appears in the assertion in the line below. The middle picture is taken from the derived test requirements. On the bottom is an implementation guidance. And again, you can see the relevant versioning and information that is provided to identify what assertions, what sections of the standard that these requirements apply to. So as I mentioned, there were 11 areas of security. They're all outlined here. And for those, I've actually kind of taken out the ones that are largely documentation. As you can see, there are four sections there that are mostly for the most part documentation. Most of the requirements simply boil down to verifying that something is being done properly. For the other sections, there are actual requirements that need to be tested and that aren't really covered anywhere else within the standard besides in those sections. So I'll just kind of briefly go through each of these. And there's some more detail in each of them as we go through. But the cryptographic module specification is actually the section that kind of defines what the product is, what's being tested. The cryptographic ports and interfaces is a very kind of black box look at a validation module. The role service and authentication is pretty straightforward. It's, you know, who can use the module? How do they authenticate? And what can they do? Physical security is just as it sounds. The operational environment is operating system requirements. Those are really only applicable when validating software. Cryptographic key management deals with key life cycles from the time they're generated to the time they're destroyed. And then the self-test section, which is probably one of these sections that is missing from most modules that haven't been FIPS validated because they're very FIPS specific requirements for self-test implementations. So as I mentioned, the cryptographic module specification defines the validating module. The biggest weakness in this section is at lower levels where the configuration and use of the module in an approved manner is dependent on user configuration. So for low level validations at level one and two, it's up to the operator to ensure they're not using weak algorithms that might be detrimental to their security. At higher levels, this gets a little stronger because at levels three and four, it's all enforced by a module. So at level three and four, the module or the product has to actually be, has to actually have a switch essentially. That it either always has to work in a compliant manner or it has to use a, it has to have a switch that basically turns on the FIPS mode of operation, thereby kind of preventing users from misconfiguring the device. As I mentioned, the cryptographic module ports interfaces is a black box kind of testing. It defines the requirements for the types of data that flow. At level one and two, there's really, the only requirements differences are that at levels one and two, physical data and there's no need to have physical or logical separation of critical data. So essentially keys, passwords and other kind of sensitive information can go through the same physical reports as normal data. At level three and four, there either has to be some physical or logical segmentation of this data. And also, if there's plain text data, then you either have to have what they call a trusted path or a directly attached cable. The trusted path is a little vague. You know, it creates and actually has created a bit of a catch 22. One thing that was originally viewed as a trusted path was a mutually authenticated TLS session. Well, the problem with that was that now your data is encrypted, so you no longer actually are sending stuff in plain text. So you had a trusted path, but you also didn't have to meet that requirement. As I mentioned, section three, as rule service is an authentication, like I said, the name pretty much says it all. At level one, there is no authentication requirement. So basically, there's no need for an operator to authenticate. This is probably the most common level for software validations, because for the most part, software applications and particularly software libraries don't implement any sort of authentication. At level two, there's what's referred to as role-based authentication. And so the downside to this obvious are there's no real accountability. You basically have a set of authentication roles, and 20 people may all have that login information. So you don't particularly know who's actually performing the, who's actually the one logging in, who's actually doing the changes. And the other thing is that, obviously, password links can be enforced by policy. So, again, it's up to the operator to ensure that they're using properly strong passwords. At level three and four, it gets better. Again, this is kind of a common theme of the standard, for the most part, is that higher levels of security gain you a little bit more security. So they have identity-based authentication at these higher levels that includes some user accountability, because now each user is uniquely identifiable. You know, what roles they can assume is based on, you know, credentialing. And so you would have individual username, password combinations, or individuals would have their own unique certificates. So each person would be uniquely identified when accessing the module. So the password requirements are probably some of the, are relatively weak. And I think this is actually a result of age, more than anything else. As I mentioned, the standard is almost, is actually 10 years old now. So its strength requirements are, you know, that there's a one in a million chance of an attacker being able to brute force the authentication information. Well, a simple four character alphanumeric password is enough to meet this requirement. So obviously nobody's going to think a four character password is secure.  So it's, it's a very weak requirement in that sense. There are no restriction on the types of passwords.  The one in a hundred thousand chance is based on multiple successes within a minute. So, you know, in addition to being able to prevent a single brute force attack, you have to find a way to limit people from just pounding away until they can successfully get a password that matches. So this is normally, um, enforced via lockouts. It's the most common method. Um, this kind of ignores long term attacks though. Um, so, but again, I think one of the reasons that they've focused on a single minute is that the goal, the idea is that if, you know, for a long term attack, if somebody has your hardware or has that much access to your hardware, you're pretty much SOL anyway. Uh, the future might be a little better. Um, and that's, that all depends on what the final version of 140-3 looks like. Um, that's something that, um, we can discuss. Um, I don't know if we'll have time to get through it today, but if, um, if you have questions about that, we can, you know, look into that a little deeper. So as I mentioned, physical security. Um, this is not really applicable to software modules. Uh, again, because they're all reliant on computers. Uh, the requirements are actually broken down not only by level, but also by the type of product that's being validated. So single chip modules or single chip products are, um, you know, like integrated circuits or smart cards are, have a different set of requirements than multi-chip standalone or multi-chip embedded devices.  At level one, there essentially is no physical security. The requirement essentially is that it be a production grade component, be made of production grade components. Essentially we're just, uh, the testing is limited to ensuring that, uh, that it's not just a bunch of, uh, components that have been soldered together and, you know, in somebody's garage and it's actually been, you know, commercially produced. Uh, level two, uh, they moved to opacity and tamper evidence. Um, so this level, what they're looking for is that, you know, you can't view the internals of the module and that if somebody does open up the enclosure, that you actually can tell that they've done so. Uh, level three is tamper response. So in this case, if you have an enclosure that's actually removable, they're looking for, uh, a response to be taken, a response to be taken when, when somebody opens the enclosure. Uh, and in that case it's zeroization of the, of the keys within the module. At level four they have tamper detection and, uh, level four is very rare because, um, in part because of the level four requirements. Uh, the tamper detection essentially means that you have an envelope around the product that any attempt to puncture, drill, mill, the enclosure would actually result in the zeroization of the keys within the module. Uh, thereby securely destroying any sort of, you know, plain text keys that might be used by that module. So what is opacity? Um, it's actually a very subjective requirement of the standard. Um, and so that's part of the reason why I wanted to take a little bit deeper look at it. Uh, the ventilation, uh, can be a little bit tricky especially for networking modules which are the most common level two validations. Um, and the interpretation has kind of changed over time and I'll show you an example of that in the coming slides. Um, previously in order to actually fail this requirement you had to be able to make out manufacturer information and part number information off of the integrated circuits. Um, and the components within the module. Uh, no longer is that really required. Uh, now they will even take outlines of components, um, or, um, you know, uh, silhouettes as being sufficient to fail this requirement. So it is very subjective, um, and it comes down to, in part, the government, uh, reviewer as well as the, uh, testing laboratory. So in this example here, uh, I've shown an example of a, of an obviously failing case and I don't know. And it actually does show up, uh, pretty well. So as you can see there, um, the one circuit that you can make out and it's kind of blurry. Um, but, uh, it's actually an Intel chip and, um, and it was actually a surprisingly good picture considering I had to use my cell phone to take it. Um, so, uh, you know, typically we have a, we would use a better camera than a cell phone camera to actually capture these images. And obviously what you can usually make out with the human eye is a little better than what you can get with a lens because we can't really poke it through those grates that you can, uh, clearly see, uh, inhibiting the, um, inhibiting the camera. And so in this case, you have an obviously failing case, both under the old methods and the new methods. And this example, we have a case that's a little bit more vague. Uh, it's the same device but taken at a different angle and from a different location. Uh, so in this case, really the only integrated circuit you can make out is this, you know, uh, side of a, of an integrated circuit here. You can't really tell what it is. Um, actually even when using, just holding it up and actually using the human eye, it's very difficult to tell or make out any parts or information from that, uh, from that chip. Now under the old system, that would be, that would be acceptable. Under the new one, it's a little more vague. Um, and typically this would be considered a fail, um, because, because you can see the component even if you can't necessarily make out what it is. Um, one of the big complaints about this requirement obviously is that what does that really gain you? And you know, uh, if an attacker really wanted to know what's inside the product, they can go buy most of these. Um, pretty much every hardware device that's been validated is, you know, the same off the shelf, um, item that vendors, uh, that vendors sell. Uh, this last one that looks like a giant gray box is the top of the case. Uh, this is a pretty apparent pass. Uh, if you can see through that, then you have X-ray vision and superpowers are good for you. Um, so obviously in this case, there is no opacity concern. So, uh, tamper evidence in response, uh, level two, it's an apparent, it just needs to be apparent that an attacker has, you know, attempted to compromise the system. Um, there's a little bit of weakness on this because one, um, there's limited testing that can be performed by the labs. In particular, they're not allowed to add new materials.  That, that, that might be a little excessive for testing. Um, particularly for what they're trying to capture at level two. Um, however, you know, there's some, there's some modules that, uh, honestly could probably be failed with nothing but a Sharpie and filling, filling in a little bit of, you know, space with a matching color. So, it's a little bit, you know, since you aren't allowed to do that as part of testing, it's a little bit kind of disingenuous to think that, that you're actually gaining much from the tamper evidence. Um, obviously sometimes the labels fail so magnificently that, you know, it's not an issue. Uh, level three, um, as I mentioned, you have to respond to tamper events. When a door or cover is removed, you have to actually, um, you actually have to zeroize all the keys. Um, essentially destruction of the keys. Zeroization is one of those nice terms that they decided to invent. Um, it's all about key destruction. So, for the operational environment, uh, at level one, a single user mode is defined, and this is actually a definition that's changed over time. Um, again, about four or five years ago, the definition used to be that you had to, in order to be validated as a software module level one, you had to be tested and validated on a system that could only log in a single, um, person at a time. Um, they went so far as to actually provide guidance to the individual labs on how to configure a UNIX based system to operate in a single user mode.  Um, the, this definition has changed a little bit.  You know, using the concept, you know, under the concept or thought process that, well, when you load an application into memory, if different operators are loading that application, they have, they supposedly would have their own instances. Obviously, this has its own weaknesses, but it's kind of satisfied the server architecture requirements. And again, for level one, what you're trying to get from a validation is a little different than at levels two, three and four. At level two and higher, they have a requirement for a common criteria-evaluated operating system. Uh, and so in these cases, it actually limits the platforms that can be validated because you have to tie to specific validation platforms. Uh, and so for each common criteria validation for, for operating systems, there's actually a list of hardware platforms on which they can, um, on which the testing for that was performed. And so you have to match that as part of this and that greatly limits the, the usability and portability of some of the, um, level two software modules. And that's why you don't see a lot of level two software modules. And for some reason you don't see any three in four, level three or level four software modules. So cryptographic key management, this is actually probably one of the two sections of the standard that has the most requirements related to it. Uh, this deals with everything, um, uh, everything to do with the key life cycle. So this includes random number generation, the key generation itself, how keys are entered in output as well as their establishment. Uh, the key storage requirements, uh, which as I say here, they're mostly meaningless and key serialization. Uh, random number generation and key generation are both, um, required to use approved standards. So, um, for random number generation they've got a set of approved deterministic RNGs that are acceptable. Um, for symmetric keys obviously they just must use these approved RNGs. Um, asymmetric key generation methods actually have to follow, uh, the sets of approved standards. So for asymmetric keys, um, there's two, there's two or three standards that are acceptable, uh, for the methods and it varies based on which key generation, which asymmetric policy you're using. Um, for DSA, ECDSA, and RSA, uh, this methods are defined in FIPS 186-2 and 186-3. Um, additionally the, the key generation method for RSA keys and ANSIX931 is also acceptable. So key establishment and entry and output, um, these are really the only requirements that vary, um, based on kind of behaviors that the products don't necessarily control. So manual distribution are, uh, are considered largely impractical, I consider them largely impractical methods, but they're considered relatively secure. Essentially if I wanted to, uh, assign the same key to a series of devices I would walk around and punch in the same key that into each device, either using a key loader, um, you know, verbally telling it to somebody else, um, which you know, passing around hex characters is, that way it would be real fun. And, um, or, or using tokens, which is probably the most practical method of the manual distribution methods. Electronic distribution are keys over what they call unsecured media. And so in this case, this is both your local networks, your wide area networks, the internet, any time that you don't necessarily have, um, pure, you know, verification of what, uh, of the network, um, these are considered unsecured methods. And so in those cases they have to be encrypted. You have to use methods like TLS, SSH and Diffie-Hulman, um, in order to actually protect the, um, protect the key methods. So for key storage and zeroization, uh, as I mentioned, the key storage requirements are pretty weak. Um, there's no real requirements, uh, for the form of stored keys. So it's not required that you, um, encrypt keys, even at higher levels. Uh, the other requirements for storage are, at best, a little vague. Uh, they have what they call an association of a key and an entity. And so in this case, a lot of times it boils down to, well, a key is associated with the product that it's in. Or maybe it's tied to a specific user. Um, but there's no real, um, there's no real requirement on how that key is stored. Uh, the zeroization, which boils down to just the destruction of keys, um, involves actually overriding keys. And that's one thing, um, that's important a lot of times for software validations, um, in particular because most of the time they just do simple free operations, which may not necessarily be destroying the data. Um, so they actually require that they be overwritten with zeros, ones, or random data. Um, it needs to exist for all plain text keys, but it can be done procedurally. So there's no requirement necessarily for when it's performed or how it's done. Um, it, it doesn't need to be automatic for any reason at all except for a tamper response, uh, with physical modules at levels three and four. So the self tests, uh, the, there are two categories of self tests, uh, the power-up self tests, which are basically boiled down to, um, a series of known answer tests for approved algorithms and a firmware integrity test. The conditional tests are done for specific services. So they have a, uh, continuous random number generation test, um, which is designed to ensure that you aren't generating the same value over and over again. Uh, the funny thing is, um, that, you know, there's still some probability that you should generate, that you could potentially generate the same value twice. Well, you technically can't with a continuous RNG. Uh, there's the pair-wise consistency test, which is designed to check the validity of, uh, key pairs that are for asymmetric keys. Uh, the firmware load test, which is designed to, um, for when you actually have hardware modules that can load and upgrade their firmware. Um, bypass tests, um, which we'll go a little bit more into because it's a little bit more complicated. And the manual key entry tests, which is essentially to ensure integrity when you're, um, when you're doing manual key entry, which basically is very rare. Um, the only time you do manual key entry is if you're actually punching keys in through a, through a touchpad on the product itself. So as I mentioned, take a little bit more of a look at the bypass tests. Uh, the exclusive, uh, there are two types, an exclusive and an alternating bypass. Uh, the exclusive bypass is basically, um, basically having a switch where it's either encryption is either on or off. So you're either encrypting all data going through the product or you're, um, letting it all pass through without doing any processing. Um, an alternating bypass, you actually have, um, differing channels where some data might be, um, configured to go in plain text and other might be configured to go encrypted. Uh, the most common example would be with a router where you might have data going in multiple, um, directions. And some of that may be, um, through an IP sec tunnel. And so again, the configuration determines, uh, which of those are actually, um, being encrypted in which are plain texts. Uh, the bypass test has one common theme. Um, and, uh, basically it's not to accidentally pass plain text data. Um, there are a couple of steps to this process. They have a couple of requirements related to it. However, um, it's most commonly accomplished using a test fire. Um, essentially sending a date, sending a data packet and ensuring that, or sending a test packet, um, for network devices is usually through a loopback and verifying that it's being encrypted, um, that you're not just, you know, spitting out plain text data when you should be encrypting it. So what are the best and the worst of the requirements? Well, from, uh, from the good side, um, there's the enforcing of stronger algorithms. Um, you know, one thing that you would, that I was very surprised about is the number of people who actually, when you talk to them, still use, uh, algorithms like MD5 and DES to do data protection. And it's, and it's one of those things that the standard does do is that it does try to ensure that only, um, strong, um, algorithms are being used. The physical security at higher levels, um, is, is actually very good. Um, at level three and four, you're getting what you would expect for physical security. An operator at level, at level three and four, you know, you're going to have a module that, you know, is going to be destructible, that's not going to retain, um, information, you know, after it's been tampered with. Uh, the bypass test, um, while it can be a little cumbersome, I actually think it's a very good policy in and of itself, even without the standard, um, you know, you never want to actually accidentally be sending data in the clear that you don't want to be. So it's a very common sense test in that sense. And then the, in crypto electronic key entry, again, you know, passing data, passing keys and playing text over a wire is, you know, never a good idea. But again, you'll be surprised how many people do it. The worst, well, the limitations on physical security testing. Uh, as I mentioned, the limitations on what you can actually do from a, uh, from a physical, from what the labs can actually do from a testing perspective on the tamper evidence is, is a little bit, is, is bad because, you know, obviously it doesn't take into account, you know, the level of, um, the level of skill that an attacker would have. Uh, the limited zeroization requirements, uh, again, not having, not forcing, um, the, the module to actually perform zeroization at set times is, is not going to improve security at all. So again, that's one of those items that needs to, that's not really addressed well. And that's how to protect the keys, uh, you know, when somebody's gaining access to the product. Uh, the third is something I didn't jump too much into, but it's about how hardware-centric the standard is. If you've actually ever read the standard, or if you ever do decide to read it, you'll notice that a lot of the requirements are very hardware-centric, that they, you know, talk about certain requirements that when it comes to software, they just don't make sense. And there's no easy translation. And so this has actually created issues sometimes for software products because they're trying to enforce requirements that don't necessarily, you know, fit into the, the mold of the standard. Again, another item there is that the lack of protection for key storage, you know, while it's somewhat understandable at lower levels, I do believe that higher levels of security should come with at least some requirements that certain keys be protected not only when they're, not only when they're being distributed, but also while they're stored in the module. Uh, and obviously, you know, the, if you have plaintext keys within a product, then they're vulnerable to, to some level of access and somebody can get physical access to the system. Uh, the last requirement is that the standard is largely ignorant of side channel attacks. And again, this is a, this is something that's kind of largely, again, based on the age of the standard. Um, the standard is, like I said, 10 years old. And so it's, when they develop the standard, they created a documentation-based section that was kind of a, um, uh, you know, an approach to look at the requirements, uh, you know, and to allow vendors to say, oh yeah, we protect against side channel, but not necessarily require any testing of that. Um, that's something that they're going to potentially correct in 140 dash 3. Um, but to how many types of modules and to what products it will apply to is something that's still kind of up in the air. So as I've mentioned a couple of times, there is a newer vision of the standard that's being drafted. Um, you know, the, the newer vision, uh, has been in development for over seven years, almost seven years now.  Um, you know, there are some new requirements, um, that exist in the current draft, um, particularly authentication requirements, um, that need to be enforced by modules themselves. So instead of telling a user you have to use an eight character password or 12 character password, those would be enforced, you know, within the product, it would, you know, actively reject small passwords. And hopefully, uh, early revisions included specific strength increases. Um, and I'm hopeful those will remain in, um, or that they'll be added in some way, shape or form. Uh, there's been side, as I mentioned, there's side channel testing requirements, um, particularly at higher levels. Um, and at a minimum these would be, at a minimum these would be, uh, for single chip, uh, modules. Uh, there's been talk of expanding it out, um, and optionally, I, and, or optionally allowing, uh, multi-chip modules to also test against these side channel methods. Uh, there's also the improved zeroization requirements. Um, there's limitations of presage, procedural zeroization. Um, so, you know, it's no longer just as easy as saying, oh yeah, well, when you want to zeroize a key, you can call this command, but it's up to the user to perform it. Um, you know, they've kind of increased the circumstances under which those types of zeroizations can be performed, um, to kind of prevent, um, overuse of procedural, uh, key destruction. So, when is the future coming? Well, that's, that's a good question. Uh, as I've mentioned, the standard has been in development for seven years. Um, currently the best guesses are that by the end of 2012 or early 2013, um, I've actually started taking a very, um, being the pessimist I am, very negative approach, which is that I'll believe it when I see it. Um, uh, what I'll say is that I think a large part of the reason for the time that it's taken to develop the standard is that they feel what they have is relatively good for what they're trying to do. Um, so they've kind of taken their time in developing the new version. Uh, the current public draft is actually rather dated. Um, it was released in December of, um, of 2009. Um, it was actually a Christmas gift. Um, uh, a very bad Christmas gift nonetheless. But it was a, um, that, that draft is a little dated, um, from what we've, from what I've had conversations with, with people at NIST, the, they have internal drafts that have made some changes in corrections based on, um, public provided comments. Um, but again, nobody knows for sure outside of NIST what's actually in that standard. Um, it will, it should be and will be an improvement over the FIPS 140 dash two standard. Um, but it's still by no means perfect. Um, if somebody came out with a perfect standard for security, then I guess we'd all be out of jobs. So to, to summarize, uh, the FIPS 140 dash two standard does provide some good requirements that can be improvements over baseline security. Um, you know, as I mentioned, um, there are a lot of products that, that I've had a chance to look at over the years where, um, simple changes would greatly improve the security of the product. Um, while it is a good first step, it obviously doesn't guarantee that you are any safer. Um, particularly since it's up to you a lot of times to make sure that you're implementing that properly. Um, I recommend, you know, incorporating some of the good into projects that you might be working on. Um, if you're doing, um, crypto and security, if you're doing cryptographic relevant, um, development, I recommend implementing some of those items. Um, for, for two reasons potentially, some of them, uh, the requirements are actually good. Um, they actually can improve security. And the other is you never know. Some day you, that product may actually want to be used by a federal government agency and you'll have to implement it anyway if they really want to procure their product. Um, I have included a couple of links in the slides. Um, the first two are to the NIST, um, pages for the cryptographic modular validation program and the cryptographic algorithm validation program. Um, I didn't speak a lot about the CAVP. Um, but one thing, uh, to note is that, um, if nothing else, they're good for testing, um, for testing your algorithm implementations. So if you're ever in doubt, if your implementation is sound, um, they actually have links, um, on their page to test vectors that can be used, um, for verifying, um, your implementations. Um, and you can always go to a validation lab if you want to get official algorithm validation certificates. Um, I included a link to the sub page on the CMVP's website that has the standards, um, the FIPS 140 dash two standard as it's currently drafted and used and a link to the NIST page for the development version of, uh, FIPS 140 dash three. As I mentioned, the public draft is a little dated, um, but it is the best, um, that's available right now for public consumption. So I do have, uh, a little bit of time left over, um, to answer any questions if you have any, um, and if, um, if there are any questions you have now, we can start going over those. If we run out of time, we can always move to the Q and A room. You can yell really loud. I'll repeat the question as long as I hear it. Right. So the question is about, um, open SSL, um, they do have a validation about, um, for what they call a FIPS object module. And, um, as you mentioned, it's not updated, um, as frequently as the main, um, open SSL path. What they've actually done is what a lot of labs considered a software based validation, which is kind of contrary to what, um, in the past everyone had deemed acceptable. Um, what they have done essentially is you can take the open SSL object module and build it, um, and then compile it into a version of open SSL. And the FIPS object module, so long as it's built according to the directions and their security policy and compiled into a version of open SSL or into your own application would be acceptable and would be FIPS compliant. And one of the key things to note, um, though, and something I will admit a little bit of ignorance on is whether or not the object module will work under both, um, the old 0.98 trains or if it'll work in the 1.0s. I do not know if it works with the newer open SSL or not. Um, I do believe they're going through a new validation, um, for a new version of the object module, and that may be for a version that's compliant to the new versions. Yes. So the question was basically about the requirements in 140-3 and about the use of, uh, of password, um, enforcement within the module. Um, and whether that's kind of, uh, a change from, you know, the industry standard of, you know, requiring those through policy or actually as part of the product. Um, they're actually are trying to push away from, from policy driven items like that, um, in part because, you know, if you have policies where it's, where it's enforced by a user, excuse me, where it's enforced by the user, that a lot of times those aren't being implemented, um, or they're not creating strong enough passwords.  Right. And so that is something that, you know, one of the original requirements that got a little bit of flak was they actually had in an early draft requirement that specifically called out, um, that specifically called out the use of, the use of like preventing password based, or dictionary based passwords. And so one of the concerns obviously was, you know, all the vendors were like, well, we don't want to have to implement that. So it was obviously a concern from that perspective. And obviously from a testing perspective, it's like, well, we're supposed to implement, you know, attempt to enter, you know, a couple of hundred passwords all using dictionary words and see if we get rejected or not. So there's definitely a scoping issue with testing on that. And it's one of those kind of ongoing issues with, um, with the validation process. That's it. Okay. So we're out of time. If you have any other questions, we'll be in the Q and A room. I'll be with you. So it's a Miranda one. So it's right back, um, back where we all came from. So.


hi friends welcome back to my channel and welcome back to another five nights of dinner on ww i cannot wait to share these five recipes with you each and everyone was so good these are the recipes that we highlighted in my facebook group challenge that i did just a few weeks ago so i'm going to go ahead and insert my facebook group right there for you if you are not part of my group make sure that you come on over and join us we have over 7 000 amazing positive members so come on over join my facebook group and just get yourself a little bit of extra information positivity encouragement it is such a wonderful wonderful group of ladies and men so these recipes actually came from a challenge that i created for the members of the group they again were amazing so if you want to see what five recipes that i have in store for you for another five nights of dinner on ww then just stay tuned for tonight's dinner i am making ground beef tachas so it is a mexican themed dish using tater tots it sounds absolutely delicious so let me show you what is in tonight's dinner so first i have some taco seasoning some tater tots i am using the simple truth organic potato puffs they actually have less points than say the orita potatoes salsa two types of cheeses for mine i'm going to do some of the trader joe's light mexican blend and some fat free cheese to help cut down on the points you'll need some 96 for extra lean ground beef and for toppings i have some shredded lettuce a tomato and some green onions so let's get started on our ground beef tachas the first thing that we need to do for tonight's dinner is get our tater tots cooking so i've counted out 55 which is what i figured into the points of the recipe i've aligned a baking sheet with some foil and i'm going to go ahead and put these in the oven until they are cooked all the way through and nice and crispy while our potato puffs are cooking in the oven we're going to go ahead and get some ground beef nice and browned on our stove and then we're going to be adding in some taco seasoning and some salsa to make our taco mixture once your hamburger is browned we are going to go ahead and add two tablespoons of taco seasoning and then we are going to add a cup of fresh salsa you may need to add some water as well if the salsa isn't enough liquid to mix in your taco seasoning and we're just going to let this cook down for just a couple of minutes until all of those flavors get nice and incorporated and our tater tots are just about out of the oven i just pulled the tater tots out of the oven here is our delicious meat mixture yum so the next step is we are going to take our meat mixture and we're just going to top our tater tots with it get them nice and coated in our taco meats and then we'll add some cheese and we're going to pop this back in the oven for just a few more minutes until just that cheese on top gets nice and melted but this looks so good so let me get this meat mixture on there and then we'll go ahead and add on our cheese once we've added our meat mixture we're going to add our two cups of cheese so i have our one and a half cups of cheese three quarters of a cup of fat free three quarters of a cup of the trader joe's light mozzarella and i'm just going to sprinkle that on top and then we are going to put this back in the oven for just a couple of minutes we want to make sure our cheese gets a nice and melty so it kind of binds everything together that way as well you're not even going to notice the fat free cheese mixed in with the light cheese it's just going to kind of make it all cheesy goodness so i'm going to get this back in the oven until this cheese is melted this looks delicious once your cheese is melted then you can go ahead and add your topping so i've diced up one roma tomato so i'm going to add that to the top and you can do whatever toppings you want just remember that anything that you add with points you'll just want to recalculate your points from the points that i give you here at the end we're also going to add some chopped green onion to the top of yum and then we're also going to go ahead and add some shredded lettuce so it's basically similar to nachos but using cute little potato puffs or tater tots instead so there you have it let me bring this up close and show you there are the ground beef touches they look amazing so i'm going to let these cool for just a couple of minutes one thing you could add is some light sour cream and that would be really good on the touches so i'm going to let this cool i'll plate this up and i'll be back to give you the smart points so here is my completed dinner so this is one sixth of the ground beef touches i did go ahead and taught mine with one tablespoon of the light sour cream so one sixth of the touches is seven smart points and then an additional point for the sour cream so my dinner is a total of eight smart points for this deliciousness so bon appetit for some ground beef touches for dinner tonight i am making barbecue chicken pizza and i'm going to be making some two ingredient dough for my pizza so let me show you what is in tonight's dinner so for the two ingredient dough you're going to need some self-rising flour and some non-fat greek yogurt barbecue sauce i'll be using the g hugh's original sugar free mozzarella or any type of cheese i'm going to be doing the trader joe's organic shredded mozzarella cheese chicken and for veggies a red and green pepper a red onion and i'm going to add this half of zucchini that i have left over onto our pizzas and then for my husband i'm just going to make his on this simple truth organic classic thin and crispy pizza crust so let's get started on our barbecue chicken pizza the first thing i'm going to do is boil my chicken to make it quick and easy and that way i can shred it up for the pizza so i have two chicken breasts here i'm going to get this water to a boil and i'm just going to boil these until they are cooked completely through while our chicken is boiling we're going to chop up our veggies so i'm going to dice up a green pepper and a red pepper a red onion and the rest of this zucchini i'm just going to put them here on some paper plates and then we'll use that to top our pizzas chicken continues to boil i've added one third of a cup of self-rising flour to my bowl now i do not measure my greek yogurt i just add it until my dough is the consistency but normally you would add one to one so you would add a third cup of the non-fat greek yogurt i just like to add it until my dough is the consistency that i want my dough to be where it's not too terribly sticky without having to add any additional flour so you're just going to mix this really well give this a chance to get that flour and that yogurt nice and combine and then once our chicken is done we'll shred it up and we're ready to assemble our pizzas to roll out my dough i have this handy little roller this i picked up off of amazon it is linked down in my amazon store below i want to say it was like six dollars so really inexpensive perfect for two ingredient dough i'm going to use the larger side but i am just going to give it a quick spray with some non-stick cooking spray and then i'm just going to roll this out to the thickness that i want so i like my dough pretty on the thin side so i'm just going to roll it out again until it's the thickness that i want that's perfect for my toppings and then again i'll pull the chicken off the stove and we'll be ready to start putting together our pizzas now you can cook your dough first in the oven for a few minutes if you want to i never do i find that my dough gets cooked just fine without pre-cooking it but i know a lot of people like to pre-cook their dough rather than just throwing it into the oven raw with all the toppings so whatever your preference is so i'm gonna get this rolled out and we'll be ready to top our pizza so i just shredded up some chicken for my pizza so i am ready to get this nice and assembled so the first thing i'm going to do is i'm going to add a little bit of italian seasoning just over my crust i like this as it kind of gives a nice authentic pizza taste to it and then i'll add a little bit more as well on top of the crust and then i'm going to take about a quarter of a cup of the g hugh's barbecue sauce and i'm just going to spread it out over my pizza and i'm just going to use a spoon and kind of spread it out over the crust just get it nice and spread out so there's a little bit of barbecue sauce on all of the goodness of our two ingredient dough yum and then to that i am going to go ahead and add my chicken since that's my protein so i'm going to go ahead and add that on next and you can do as much or as little as you want i just want a little bit of chicken on each piece of my pizza i'm going to be adding quite a few veggies and things as well so we don't want to go too crazy and make it so heavy that we can't pick up a piece of our barbecue chicken pizza so i think that that is probably good for chicken oh looking delicious and then it's time to add some veggie so i'm going to start here with my zucchini and i'm just going to add a few pieces of zucchini all over my pizza and then we'll add some peppers and some sliced red onions but i thought this would be a nice addition to the pizza a little bit of zucchini and then we'll do some sliced red onions so those will get nice and crispy in the cooking process and then lastly we will do some red and some green peppers and then we'll top it with our cheese and we're ready to go into the oven this looks super good again little green and red pepper and all the corners and then lastly i have a third cup of the Trader Joe's mozzarella cheese and i'm just going to evenly spread that out over the top of my pizza this looks delicious and then the last step before it goes into the oven is we're going to go ahead and we're just going to add on just another little teeny bit of the Italian seasoning just for fun over the top of our pizza that way it kind of melts in with the cheese and we are ready to put our barbecue chicken pizza into the oven i'm going to put in at 400 until it is completely cooked through so here is my completed barbecue chicken pizza i just pulled it out of the oven i'm going to slice it up this entire pizza is only seven smart points everything on the pizza is zero with the exception of the crust itself and the cheese the amount of barbecue sauce that we use is zero as well so this is my seven smart point barbecue pizza for tonight's dinner i'm going to be making a ground beef casserole if you just have the casserole it would be a very keto or low carb friendly dinner so i wanted to throw that as an option in for you but we are going to pair ours with some potatoes and some veggies so let me show you first what is in the ground beef casserole so you're going to need some extra lean ground beef i'm going to be doing the 96 for from Trader Joe's fat free or light cream cheese and i'm going to do a mix of fat free cheddar cheese and the Trader Joe's light mexican blend you're going to need some salt and pepper and the recipe calls for cayenne but i decided to use the dax italian blast instead one because i don't have cayenne pepper and two because this is so delicious dax seasonings are amazing they have zero salt they are all natural no msg this particular one i love it only has garlic spices black pepper paprika and onion that's it so there is nothing artificial in these these are fantastic before weigh in or if you are someone that watches your salt but you want a ton of flavor so if you're interested in dax you can order them using the link down in the description box and my discount code here on the screen and dax will give you 10 off and free shipping so you can't beat it i love the italian blast it does have a little bit of a kick so it's a great substitution for cayenne pepper so i'm going to be using some of that also some garlic powder and onion powder and then i have some leftover veggies here that i'm going to be cooking up in a pan with some potatoes as our side dish so let's get started on our ground beef casserole so the first thing for tonight's dinner is we need to get our ground beef browning on the stove so i've added my one pound of 96 for here to my frying pan i also have diced up my potatoes and i'm going to get those cooking down about halfway before we add in our vegetables because they'll cook a lot faster i'm going to go ahead and season my potatoes with just some salt and pepper so let's get everything started here on the stove after your hamburger has completely browned we're going to go ahead and add in our spices so i'm going to start with my dax italian blast and i would say add spices to your preference with your taste buds and then i'm also going to add in some onion powder and some garlic powder and then just some pepper and some salt give this a good mix and then we're going to go ahead and add in our cream cheese you'll add in your four ounces of cream cheese and you're just going to stir until your cream cheese is nice and melted and incorporated in with your hamburger and as you can see here my potatoes are coming along nicely i'm about ready to add in my veggies i went ahead and added in my veggies with my potatoes so i'm just going to allow these to cook down a little bit longer until the vegetables are cooked through and i'm just going to be adding a little bit more salt and pepper and a little bit of garlic powder once your cream cheese has melted and mixed in with your hamburger we're just going to add in half of our mix of light and fat-free cheddar cheese and then we're just going to give it a stir the other half of it is reserved to go on top and that's it so it is a very low carb casserole we're going to put this into a baking dish and get it into the oven to allow the flavors to melt a little bit more and the cheese on top to melt so the last step for our ground beef casserole is we're going to go ahead and add on the rest of our shredded light and fat-free cheese kind of right over the top and then we're just going to get this into the oven until the cheese is melted and the casserole is cooked all the way through and nice and warm but very simple you could put this on a tortilla we're just going to go ahead and have it with a side of veggies and potatoes so i just pulled our ground beef casserole out of the oven it looks pretty good i have to say it is pretty lackluster for a dinner i would highly recommend that you pair this with something else like maybe as a topping to some rice or potatoes or pasta or put it in a tortilla shell so i'm glad that i decided to make a side here of the potatoes and the vegetables that way we can top our potatoes and our vegetables with our ground beef casserole and i think that will be a perfect pairing so let me get my ground beef casserole and my veggies plated up and i'll show you tonight's dinner and give you the smart points so here is tonight's dinner i have the potato and vegetable mixture and i topped it with the ground beef casserole the ground beef casserole for one fourth is four smart points and the potato and vegetable mixture is also four smart points so this is an eight smart point dinner for tonight's dinner i'm going to be making a hawaiian sheet pan dinner now the original recipe called for steak but i decided to go ahead and do chicken and i also added i'm going to be adding zucchini to the original recipe as well so let me show you what is in our hawaiian sheet pan dinner so first you're going to need a fresh pineapple minced garlic rice wine vinegar soy sauce brown sugar alternative of your choice i'm going to be using sucran gold pineapple juice so i'm just going to take the juice out of this can of pineapple tidbits cornstarch fresh ginger or ginger paste chicken black pepper a sweet onion two bell peppers i have an orange and half of a green and red that i'm going to use up and then i have this ginormous zucchini that i'm going to use partial of it as well on my sheet pan so let's get started on tonight's dinner the first thing that we need to do for tonight's dinner is chop everything up so i'm going to chop up my zucchini my bell peppers and my onion put them here in a bowl and then i will chop up my chicken last and so i can use the same cutting board for everything so always chop your veggies before your meats so but let's get everything all chopped up and ready to go we also need to chop up our pineapple i forgot that so we'll be chopping that up as well so now let's get everything chopped up once we've chopped up our vegetables it is time to get our sauce together so in my pan here i have one quarter cup of the sucran gold i'm going to add six tablespoons of soy sauce one quarter cup of rice wine vinegar six ounces or three quarters of a cup of pineapple juice and also i'm going to add about a tablespoon of my ginger paste or you would do fresh ginger if that's what you were going to do and then the last thing for the sauce is red chili flakes which i am not going to use so we're going to get this on the oven allow it or on the stove allow it to simmer until our sauce thickens it'll take about 10 to 15 minutes while our sauce is thickening on the stove i have the remaining one quarter cup of pineapple juice and one tablespoon of cornstarch i'm going to go ahead and add that directly into my pineapple juice and i'm just going to stir this and this will be our thickening agent for our sauce once our sauce has a chance to simmer so you're just going to stir up that pineapple juice in the cornstarch and we're just going to set it aside until our sauce is ready once your sauce has been simmering on the stove for about 10 minutes or so and it has starting to thicken a little bit we are going to add in that pineapple and cornstarch mixture and we're just going to stir that and we're going to let it simmer a little bit longer until it is nice and thick and then we'll be ready to assemble our sheet pan i just pulled my sauce off the stove look how good that looks i'm just setting that aside and we're ready to assemble our sheet pan so i have put down a sheet of foil sprayed it with some nonstick cooking spray and the first thing that we're going to do is we are going to add our protein right in the middle of our sheet pan so i'm going to take my little basting brush here that we're going to be using for the sauce and i'm just going to break the pieces of chicken up just a little bit and kind of center them in the middle here and then from there we're going to add our veggies and pineapple all around our pieces of chicken so i'm going to do my peppers and zucchini and onion and my pineapple so we'll get that spread out all around our chicken after you have your veggies pineapple everything spread out around your chicken this is already looking so good the next step is we're going to take our sauce and we are just going to baste over the top of our chicken our vegetables we want to go ahead and use all of this sauce i might actually just kind of dump and then we can kind of baste from there but you do want to make sure that you get a little bit of our delicious homemade teriyaki on all of our vegetables all of our pieces of chicken so i'll get this sauce spread out and then we'll be ready to put this into the oven and our hawaiian sheet pan dinner is ready to go into the oven this smells so good so i'm going to pop this in the oven at 375 for about 20 to 25 minutes we'll pull it out give it a quick mix and pop it back in for about another 10 minutes while our sheet pan is cooking i'm going to go ahead and do some rice so i'm going to do this success 10 minute boil in a bag jasmine rice they come in these little pouches this is the perfect amount for two people i'm going to be having half of a cup that is what is figured into the points so this is super easy you just pop it in some boiling water for 10 minutes and you have absolutely perfect jasmine rice i just pulled the hawaiian sheet pan out of the oven this looks incredible it smells so good so my rice is just about done so i'll get this plated up show you exactly what the portion size is and give you the smart points so here is my dinner for tonight here is what's left on the pan this makes a total of four servings so we actually have a little bit more than four servings but i did measure out one half of a cup of the jasmine rice for three smart points and then i layered on the chicken the sauce and all the veggies it is a total of two smart points for that so this is a five smart point dinner including the rice and it looks absolutely delicious for tonight's dinner i'm going to be making skinny orange chicken over jasmine rice super excited for tonight's dinner so let me show you first what is in the orange chicken first actually first let's do the rice so of course i'm going to be having some jasmine rice and i'm actually going to cook mine in broth so if you have broth available it just adds a lot more flavor to your rice so i'm going to cook mine in some veggie broth now what's in the orange chicken is you're going to need some oil avocado oil olive oil whatever you have on hand minced garlic rice wine vinegar salt and pepper soy sauce so i'm going to be using the coconut aminos red chili pepper flakes and ginger the recipe also calls for white pepper i'm just going to substitute regular pepper you're going to need some cornstarch i'm going to use sugar free honey only because it really makes the points way less and you can't tell any difference this is the nature's hollow sugar free honey it is delicious it tastes like regular honey you can purchase this off of net triton's website so down in the description box is a link it'll take you directly to net triton look around you guys there is a ton of w w friendly things on that website and this is one of my favorites so i'm going to use the sugar free honey you're also going to need an orange and lastly of course some chicken so let's get started on tonight's dinner so i've got my rice going in my broth i did rinse it with some water to kind of get some of the starch off so i'm going to let my rice start cooking in my pan here i have one teaspoon of my avocado oil to that i'm going to be adding in my chicken so i went ahead and just kind of diced up my chicken into a little bit smaller pieces so i'm going to go ahead and add my chicken here to my pan and then i'm just going to season it with just a little bit of salt and pepper and we're going to start the cooking process let this cook until almost all the way cooked through and while our chicken is cooking we're going to go ahead and make our orange sauce so let's get started on our orange sauce for our chicken so first i'm going to add in three cloves ish of minced garlic i never measure my garlic a little extra garlic never hurt anybody to that i'm going to add in my orange juice now i did fresh squeeze from an actual orange so it's zero points it did not quite get me half of a cup so when you make this recipe i recommend that you get two navel oranges and go ahead and squeeze the juice out of both of those i'm also going to add half of a cup of my sugar-free honey it's a lot of honey that's why the sugar-free really is going to save you on definitely save you guys on some points so i'm going to go ahead and add that to that i'm also going to add one third cup of my coconut aminos or soy sauce whatever it is that you are using we are also going to add one quarter cup of rice wine vinegar we are going to add three tablespoons of cornstarch i'm going to add just a hair of red pepper flakes because i don't really like anything very spicy and then i'm also going to add in some ginger and then lastly a little bit of pepper and then we're going to give this a good stir here with our whisk you can also add a zest of orange i threw my orange away before i realized that so i probably recommend adding a little bit of the zest that'll just give it even that more orangy flavor so look at that you guys so i'm going to let this sit while our chicken is cooking and we're going to add this directly to our chicken once it's brown once your chicken has cooked all the way through we're going to go ahead and add in our delicious orange sauce and we're just going to let this cook for just a few more minutes until the sauce thickens and everything is nice and combined and our rice is actually coming along nicely it is about done as well so very quick easy dinner look at our orange chicken so once it starts to thicken from the cornstarch we're going to go ahead and remove it from the heat i'm going to put it in a bowl and show you how to measure out six servings and that noise you hear is my Brussels sprouts cooking away in my microwave so let's get this chicken measured out into six serving so i've put my entire batch of orange chicken into a bowl on my scale oh i got a little bit of a glare so it's 781 grams for the entire bowl of orange chicken so we are going to take 781 and we are going to divide that by six and that is the number of grams we're going to include in a serving so let me do the math and i'll show you what one sixth of the recipe looks like so here is my completed dinner so i went ahead and measured out one half of a cup of jasmine rice and that is three smart points one sixth of the orange chicken wait until you guys hear that this three smart points that's it and all you're counting for is the sauce the chicken is zero and most of the sauce ingredients are zero as well so this entire serving of skinny orange chicken is only six smart points of course my Brussels sprouts are zero i just have some salt and pepper and some spray butter now if you are going to make the orange chicken with regular honey just for the orange chicken it would be six points and then you would have to add three additional points for rice so it would be nine so depending on what you want to use but the sugar-free honey from nutrition is delish so this is going to be my six smart point dinner thank you for joining me on another five nights of dinner on ww i hope you enjoyed seeing all five of the delicious amazing recipes that i shared with you don't forget to check out my facebook group join us it is such a fun positive wonderful place to be no matter what healthy eating or diet journey you're on we'd love to have you as part of our facebook group if you're new to my channel welcome make sure that you subscribe hit that little bell that way you're notified every time that i upload a new video you don't want to miss a single one i'd appreciate it if you thumbs up this one comment down below let me know which of these recipe or recipes were your very favorite and i'll see you guys all in my next video bye


Welcome back to debate 4. If I can just remind everyone of the motion, it is, this house believes that Scotland should continue to lead the way in marine energy technology. Felly, mae gynllunio'r Moseong, All Ness Academy, am en diet caenth, Kelsey McCrae, Andrew Beca McLement, Cynusi High School, Beth Mickel, Polina Pologava, Rory MacDonald. We have Allness and Can You See, and I would like to open the debate by inviting the first speaker from Allness to talk about the proposition. Good morning, Madam Chair, judges, fellow delegates and audience, and welcome to today's debate. My name is Amnip Kynth, I am myself, Mr Rebecca McLeimont and Ms Kelsey McRae, are representing Allness academy today in proposing the motion today, which is, this house believes that Scotland should continue to lead the way in marine energy technology. We strongly agree with this motion and believe that Scotland should most certainly stay ahead in marine energy technology for the various reasons that my colleagues and I will soon state and explain. First of all, I would like to define this motion. By this house, we mean the people in this room. By continuing to lead the way, we mean that Scotland should stay at the number one position in marine energy technology development and deployment, and by marine energy, we mean wave and tidal power. I will be talking about the excellent natural resources that Scotland has, which makes it one of the best places to harness power from marine energy. I will also be discussing the low-carbon footprint and the reliability of those technologies. My colleague, Ms McLeimont, will be expanding on those points, as well as discussing the investment and job opportunities that continue to lead the way in marine energy will bring our country. My first point to support the argument is that Scotland benefits in many ways by being the leader of marine energy technology. One factor is that Scotland has an excellent environment for wave and tidal power. For example, there is plenty of coastline around Scotland to install the technology. In fact, there is more than 6,000 miles of it. It is a clean... Yes? We are talking about our amazing coastlines in Scotland, but those coastlines are home to thousands of different species of animals. Why should our needs go before theirs? As I was saying, there is plenty of coastline to install technology. The companies that develop those technologies carry out lots of surveying and careful considerations to make sure that they are not affecting the area that they are installing in. As I was saying, it is a clean and reliable technology, and it does not depend on the weather like other renewable sources. It only makes sense to take advantage of our incredible environment. Ladies and gentlemen, did you know that the waters around Scotland hold 25 per cent of Europe's total tidal power potential? We know that the technology is under development, but it is rapidly expanding. According to BBC researchers, very soon it alone will be able to meet 50 per cent of Scotland's energy needs. Engineers from Oxford University and Edinburgh University have identified Scotland as one of the best places for marine energy technology. It has significant renewable energy potential. The idea also has exceptional environmental quality. The Pentland Firth is recognised as the best site for tidal energy. Energy from this site has the potential to meet 50 per cent of the country's current electricity demand. Energy from tidal technologies such as lagoon enclosures could supply another 12 per cent of our power. Some of the best resources are located off the northwest coast and northern tip of Scotland. The Scottish Government believes that wave and tidal energy make an important contribution towards meeting our future demand for electricity. The placement of wave and tidal projects here will not affect tourism in the same way that other energy sources such as wind turbines or nuclear plants do, which tourists find ugly. To conclude, we have been provided by nature with the perfect environment for harnessing safe, clean and reliable energy. To not take advantage of this would be illogical. Ms McFlymont will be talking about the cleanliness of these technologies, as well as investment on job creation. I am confident that you will agree with our viewpoint towards the motion for the various seasons that I have stated and for those that my colleague Ms McFlymont will discuss with you in her speech. Ladies and gentlemen, thank you for listening. Thank you for opening our debate on this, and I am now going to invite the First Opposition Speaker to outline their case from Can You See? Good morning. Ladies and gentlemen, Honourable Chair, esteemed judges and fellow delegates, my name is Rudy McDonald and I shall start by introducing our argument. First, I would like to start with a point of rebuttal for the other team. Mr Keith, you said that marine technology holds many benefits for Scotland, but why do not we use our other technologies that are much more developed to lead the way in? That would be a much better choice for Scotland. As I was saying, the proposition has already defined the motion, but we are going to explain to you why Scotland should not lead the way in marine energy technology. We are going to convince you that Scotland should be stepping down from leading the way and that we should be investing this money into things that will really benefit Scotland's people. My colleague, Ms Mikkel, shall go on to depth about our arguments, and Ms Paliegova shall summarise our points and close the argument. Marine technology. Let's start from the beginning. What is it and how does it work? When marine energy is created by the waves of the ocean, harvesting the kinetic movements using tidal turbines, tidal barages and wave power devices, the questions that we ask are is it predictable, is it affordable and is it secure? Can we answer those questions fully? No, because this technology is in the early stages of development, meaning—yes, please. You asked if it was reliable and if we could really say that we could power Scotland alone on this, but are there other renewable energies that rely on the weather that is really reliable that can catch fire at any second, such as solar? Please bear with me while I confer with my colleagues. Solar energy is actually more beneficial because we are not harming the environment very much. Yes, please. You may not be harming the environment, but solar panels do actually cause harm to humans because the silicon used to build these solar panels can actually give humans serious illness such as silicosis. No, thank you. My colleagues and I strongly feel that this money could be put into a more worthy cause. After the recent cuts in education, we feel that this could be put there to improve. Every three years, countries of the world participate in PISA exams organised by the OACD, the organisation of economic cooperation and development to show which countries are leading the way in maths, science and reading. I am not even going to begin sugarcoating the bad result that the UK achieved in last year's exams. We are supposed to be a well-developed country and we failed to gain a place in the top 20. Why is this happening? The answer is so straightforward. We are putting projects in a leading the way before the education of our youth. We are saying that leading the way in marine technology is a negative for our country. As a future student and future voter, I feel that we could develop a child's understanding for renewable energy, something that we might be very reliant on in the future, or have better facilities for children to study renewable energy. With this new generation of knowledge, we can ensure that we fully understand this technology before we make the mistake of standing forward and end up drowning in a sea of our bad mistakes. Madam Chair, for those reasons, I beg to oppose this motion. Good morning to everyone in attendance, chairs, Madam Chair, judges, audience and, of course, my fellow delegates. As you all know, we are for the motion that this House should continue to lead the way in marine energy technology. We are here to prove that we are correct to agree with this motion. My colleague Mr Cainth has already discussed with you the fact that we are in the perfect environment to harness the energy from wave and tidal movement. As my colleague, but first of all, I would like to take issue with what Mr McDonald said about how we should rely more on other renewable energies, such as solar, rather than on our marine energy. Yes, they may not cause harm to environment, but what about the harm that they cause to human lives, as I said, the silicon that is caused by the silicon, and that they can catch fire at any point in time, such as May 14 this year. A solar panel is on top of a school named Faith Lutheran middle school and high school caught fire, causing about an estimated $60 million in damage. That is equivalent to about £40,000 in damage. As my colleague Mr Cainth has mentioned, marine energy technology is very clean. The emissions that are created from the technology are minimal, and it costs much less to install and run than any other renewable power. The technology does not affect the environment, for example. A wave power system simply floats on top of the surface of the water, preventing serious impact upon wildlife. As far as maintenance is concerned, tidal energy does not need to be regularly maintained, as the technology is modern and newly built. If the technology is modern and just built, how do you know that it is not going to take a lot to maintain? We have not had this technology long enough to be sure. Yes, it is in its infancy, but it has been tested before. As by what is being tested, it has been proven that it does not need that much input from humans. We have already had it for 10 years. Therefore, it requires little human input once installed. Marine projects cause little damage to land, unlike fossil fuels such as coal that cause massive destruction. For example, coal mines leave large holes in result of their extraction. However, wave power does not cause any damage to earth. It is safe and it is clean. You say that it is safe, but it is actually endangering many species under water. As Mr Cainth has already said in his speech, that careful consideration has been put into where these technologies are placed to prevent minimal damage to the wildlife, sea life, sorry. In creating power from waves creates no harmful byproducts such as carbon dioxide. Through being leader of marine technology, Scotland will become well known on the global map. That attracts a lot of investment into Scotland's renewable energy sector. At the start of 2014, many major companies such as ADF Energy invested millions in the technology. Latest figures released by the UK Government shows that, over the past two years, Scotland has seen more than £2.3 billion worth of investment in renewables, which supports more than 2,500 jobs. ADF Energy has invested £3 million in the development of underwater turbines, with its strategic partner Marine Current Turbines. Because of Marine Energy technology, thousands of jobs are being created across Scotland. Scottish Enterprise has led the development of the national renewables infrastructure plan. The plan aims to help the development of a globally competitive marine renewables industry in Scotland through the creation of infrastructure to support large-scale manufacturing, assembly and deployment. We now have the ability and resources to create an industry that delivers significant investment and jobs throughout Scotland, including in some of our most remote communities, such as St Kilda's, where there is great potential for marine renewable projects. What about all the jobs that are lost for the fishermen who rely on the coastlines to get money? As you were saying, there are a lot more jobs that are created through the renewables industry, and, as we have said, there are 6,000 miles of coastline. I think that there would be quite a bit of space to continue. The entire industry is forecast by Renewable UK to be worth £6 billion by 2035. That will also create around 20,000 jobs. Since the 1980s, unemployment figures in Scotland have risen extremely high, as have the crime rates, drug and alcohol abuse and domestic abuse figures. There is no doubt that those factors are related. When unemployment goes up, sales go down. That is because, in most cases, the unemployed simply do not have enough money to buy the things that they usually would down at their local shops. That has directly affected many businesses, with thousands becoming bankrupt sometimes overnight in the past few years, bringing some areas from 100 per cent employment to 100 per cent unemployment in one day. Marine energy companies, as of Renewable UK's 2013 end-of-year report, employ 18,465 people full-time. Three times the number of people working within the UK's coal industry. Ladies and gentlemen, keep in mind that marine energies are still in their infancy, so those employment figures are set to rise even higher in the next few years. Ladies and gentlemen, thank you very much for listening. You have all heard my points and Mr Cain's here, and you will soon hear Ms Kelsey McRae's. I hope that you will agree that this and all our other points clearly show that marine energy is the way to go for Scotland, not just to benefit our environment, but the Scottish industry as a whole. Thank you very much for listening. I will now call on the second speaker to make the case for the Opposition from Can You See. Good morning, ladies and gentlemen, esteemed judges, honourable chair and fellow delegates. My name is Beth Mickel. My colleague Mr McDonald has already responded to the motion for today's debate, so I am going to explain to you why Scotland should not continue to lead the way in marine technology. Before I start my speech, I would like to say a quick point of rebuttal. You are saying that lots of jobs are created by renewable energy, but you are not taking into account the people who have trained all their lives to work in areas such as the fishing industry, the coal and mining industry. Those people do not have any other qualifications. They would be left unemployed. Marine technology has a huge potential. Yes, that may be true, but it is not down to Scotland to lead the way. We simply do not have the financial backing to do so. Scotland is not a very big country, and before we start blowing the small budget we have on fancy new technology that we do not actually know enough about, we need to focus on things that are really necessary, things like healthcare, education and the military. As you will all be aware, the referendum this September will determine whether or not we will become an independent country. If we were to go independent, we would have a lot more pressing issues to deal with rather than leading the way in marine technology. It is just not that important. No, thank you. We will already be spending £13 million on the referendum. Having just come out of recession, the last thing we want to do is go back. More financially stable times are ahead of us if we can just be sensible about these things and not blow all our money on unnecessary things. With things like the massive £15 million cut to our education budget and plans for a £226.7 million cut to our NHS, how do you expect us to find the money to continue to lead the way in such trivial areas as marine technology? Yes, please. There's lots of investment from major firms for our marine energy technology, such as EDF energy. That may be true, but we're still going to need massive investment from the Scottish Government, and if we want to continue to lead the way, we're going to need even more investment and more money, and we just don't have it. No, thank you. Renewable energy is by all means a good thing, but in comparison to other types of sustainable energy, marine energy is not in its prime. Currently, marine power systems are not as well developed or practical as other renewable energy sources. If we were to invest in renewable energy, surely we should pick a type which is cost-ejective, practical and advanced. I hate to break it to you, but marine energy is none of the above. To have Scotland leading the way in marine technology may sound like a nice idea, but in reality it is a waste of money that could be spent on more worthy causes. We are just too busy to continue to lead the way in this field. We have done our bit, and it's now time to pass the button on to another country. How would you feel if you were a fish?  Yes, please. Fish would not be as stupid as that to go into a current that they are not familiar with. They would rather just stay in their part instead of swimming towards a turban current. Are fish come back to the same place to breed every single year? If we install more marine harvesting facilities, they are not going to know. Nobody is going to tell them. They will come back and find these turbans in their breeding areas and they will get sucked in. No, thank you. It is not fair on our marine wildlife for these harvesting facilities to be put in place. We have already done enough damage to our marine life. If we were to continue to lead the way in marine technology, it would mean installing a lot more marine harvesting facilities. Have we not done enough damage already? Do we not owe our planet a new, safe type of renewable energy? No, thank you. Marine energy is not actually as clean as it seems to be. To have the facilities out in the first place will take lots of boats to bring the parts. What powers these boats? Fossil fuels. To have the facilities regularly manned will take boats and cars to bring them in. What powers these methods of transport? Fossil fuels. And to have all the parts made in the factories, what will power the machinery? You guessed it. Fossil fuels again. Installing more of these marine harvesting facilities will mean burning more fossil fuels and doing more damage to our environment. The proposition may say that this is a short-term loss for a long-term gain, but marine facilities are not actually advanced or even commercially viable. We are losing a lot and only gaining a little. Leading the way is really not in Scotland's best interest. We should let other countries take the leading role and make the mistakes. We should watch and learn from these mistakes. Mistakes are good. You can improve them from them, but when these mistakes could lose us billions of pounds, we do not want to be the ones making them, lessing bigger countries with bigger budgets and less to lose make the mistakes before us. We can make sure that in the future we will not be making them. Scotland relies on its beautiful coastlines for jobs and money. New marine power stations could have disastrous effects on coastal towns and villages. People visit those coastal areas and generate jobs and income. Who is going to want to visit Scotland to see the majestic looking power stations and breathtaking machinery? No, thank you. Alness, for a village near the coast, I am shocked and ashamed that you could support such a motion. Not only will marine technology affect tourism, but it will affect the fishing industry as well. The noise pollution from those facilities will scare away the fish on which people rely for their income. That could prove to be catastrophic for coastal towns and villages. But hey, what does it matter? No, thank you. The Government will look eco-friendly, so destroying marine life tourism in fishing industries really does not matter. And of course, causing mass unemployment does not matter either. Oh no, the proposition does not care. They are just trying to make themselves look good and are not taking into consideration the lives of the Scottish people. If you care about your country and your environment and the Scottish people, I beg you to oppose this motion. Thank you very much indeed, can you see? And we are now moving on to the summations, so I am going to call on the third proposition speaker to sum up the case for Alness. Good morning or nearly afternoon to everyone in the room. Honourable chair, audience, judges and, of course, my fellow delegates, I am Casimacrae, third speaker of the opposing team. The statement at debate today is this house believes Scotland should continue to lead the way in marine energy technology. My colleagues, Ms McLeimont, Mr Cainth and I, believe this statement to be true. As third speaker, it is my job to read back what the other team has said, and when thinking about what they have said, some words spring to mind. I would agree with you, but then we would both be wrong. The first speaker of the affirmative team, sorry, of the negative team has tried to tell us that there are better alternatives, such as solar panels. Solar panels are not a better alternative at all, as they can cause illnesses such as silicosis and can catch fire any minute because they are not turned off. There are other alternatives, of course, that he may have discussed, such as winter bends, but they release lots of oil waste and destroyer, can't she say? The second speaker of the team opposing the motion talked a lot about the investment that needs to be put in to marine energy technology. We accept that this is a valid point, but we have had investment from major firms, and EDF energy is only one of the examples. Also, the Scottish Government has put millions of pounds aside for marine energy technology. She also spoke about the independence vote and how we will need our money if we do indeed go independent, but there are no stats to prove that the majority vote is for independence, so therefore that is a relative factor in this argument. She spoke about the sea life that is affected by marine energy technology, but there are nets and ladders and lots of careful consideration and planning to protect them from wind turbines. As for the jobs lost, we have over 6,000 miles of coastline, which is something that the Opposition has failed to recognise. There is enough room for fishing and our new clean source of energy. As for tourism, that has put Scotland on the global map. That means that it will attract tourists from bigger countries after seeing this. Surely the more we expand on marine energy technology, the more we will get in the tourist industry. I apologise in advance for whatever the third speaker tries to say or bring to this argument. The arguments that have been made by the Opposition have been what we feel pointless. My first speaker, Mr Amadik Kane, spoke to you about how marine energy technology is the best and most clean way to power Scotland. He made points about the excellent natural resources that we have here in Scotland and how they are reliable and produce a low-carbon footprint. As for the excellent natural resources that have already been mentioned, we have over 6,000 miles of coastline. I cannot stress that enough. As for the low-carbon footprint, marine energy technology only releases CO2 in the transportation. Workers do not have to travel to it to maintain it because it can run by itself. The only thing that needs human impact input is the installation of it. My second speaker, Mr Beckham Clymont, informed you that marine energy technology has put our weak country on the global map, attracting investment from major firms such as EDF Energy. She also spoke to you about the jobs that renewable energy can bring in. Marine energy companies, as of renewable UK's 2013 end-of-year report, employ 18,465 people. Madam Chair, members of the audience and, of course, the judges, our team strongly convinced that this statement is true and that we hope that you have not been swayed towards the lies of the Opposition. Very much indeed on this. Finally, to close the debate, I am going to call on the third Opposition speaker to sum up and close the debate. Good afternoon, ladies and gentlemen, esteemed judges, honourable chair and fellow delegates. My name is Polina Payugova. My colleagues, Mr MacDonald and Ms Mikkel, have already explained why it is not in Scotland's best interests to lead the way in marine technology, and I will continue to argue that this should be the case. Before I begin, I would like to start with a few points of rebuttal. Your first speaker has said that marine energy is better because it does not rely on weather. Solar power can work without the sun using diffusive solar radiation, and this disease is extremely rare. You also say that nets will protect our ocean species when nets are actually a big hazard to them and cause harm to the ocean life that gets trapped inside. You also say that our arguments are pointless, but what is pointless is leading the way when we do not actually have to. You also say that the Government has put money aside when they could be using this money for education, things that are actually necessary for the Scottish people. As I was saying, Scotland is a country that stands proud for its natural beauty, and so it should, because we have so much to be proud of. One of our most iconic sites is our beautiful coastline. How can we preserve this beauty when the Government plans to clutter it with marine technology? For one thing, marine technology is a number one harm to our ocean wildlife, as well as the starting point of a negative food chain. Allow me to explain. The fish will be harmed by the blades, chopped up, gone, bye-bye. Fishermen rely on fish to run their businesses, which will suffer majorly if nothing is caught. Tourists from all over the world travel to visit Scotland's coastlines. Who will want to see a cluttered, lifeless landscape? I certainly would not make the effort for that journey. As you can see, leading the way in marine technology is the start of our spiralling way down a set of stairs that spell disaster. The proposition is rattling on about saving the world, when in fact they are doing quite the opposite. Unless I know that my home is important to me, surely your home is important to you too, especially where you live, a beautiful coastline. I am surprised that you are willing to sacrifice the beauty of your home for such an unworthy option. Scotland is certainly not in the position to blow its finances and projects from which we will gain so little. Let's invest our money on a more worthy cause, a renewable energy type with more potential. How about hydro energy, which Scotland has been studying and developing for some time, or wind power, which is successful up and running? We should concentrate on what we have and make the most of it before we start on something new. Speaking of using our budget wisely, there are more important issues that we need to focus on—things that are actually necessary. Scotland is an economically developed country, living in the advanced 21st century, and yet one in seven families live in poverty. Scottish education is also falling behind, as Mr MacDonald has explained. How can we expect a good future when we are so poorly preparing our use for life ahead? It is time to face our problems before things go worse. It is time that we learn how to stand on our own two feet. It is the people of our country that matter most.  The future is to be put in our hands. It may as well be one that we can trust and depend on. Renewable energy is the door that opens towards a brighter and better future. However, to open that door, we need a key. The key to open that door is a successful and skilled generation that we need to build. Marine technology should not be the centre of our tension. Like Ms Mikkel has said, it is time to hand the baton to another country. One wrong turn, and it could be millions of pounds down the drain. Let's not be the country labelled for making that big mistake. I hope that my colleagues and I have been able to convince you that leading the way in marine technology is not the way forward.  We need to show the world that we are worthy of making the right decisions. This is the right decision. It is for these reasons that I beg you to oppose this motion. Thank you very much to Can You See. The debate has now closed. Thank you to both Can You See and All Ness for certainly giving it everything on our last debate. Nothing was left unsaid. We are now going to take a break for lunch, which is going to be served in the area just outside the room here, whilst the judges, the poor judges, are going to have to deliberate and come to some decisions, because all eight of you have been absolutely fantastic. The standard is just so high, and they have the very difficult job of deciding which four teams are going to go through to our semifinals and our afternoon debates. They will be making that announcement in around 30 minutes' time, and then the teams will have some time to prepare. However, we have now a half-hour break, and then we will convene in here for that announcement. Thank you to all of you for the debates this morning. Thank you very much indeed to everyone who took part.


The study found that the prevalence of ever-water pipe use among Herot University students in Western Afghanistan is higher in male students and having a smoking friend or family member positively influences water pipe use among both sexes. Most users believed that water pipe smoking was less hazardous than cigarette smoking. This article was authored by Aziz Yuraman Niyazi, Nassara Madshayan, Suh Oscar, and others.