Hello everyone, my name is David Kniche and in the next few minutes I will present our work with the title Silver, Statistical Independence and Leakage Verification. This is the result of a collaborative work with my colleagues Pascal Saastrich and Amir Muradi at the Wohl University Boho. Over the last two decades, a lot of progress was made in the area of masking. This resulted in various models and security notions being published. So the general idea is to build a software tool that can verify these security notions. There already exist verification tools like for example Math Verif. But Math Verif is language-based, which means it performs security checks based on a symbolic leakage and rules used for simplification of these leakage terms. As a result, these checks are over-conservative and are not in direct conformity with a security notion. So our goal was to build a complete and sound verification tool for Math's implementations. Complete here means that our tool supports all well-established security notions. And sound means that our checks are in direct conformity with the definition. Our verification tool utilizes so-called reduced-order binary decision diagrams or short ROBDDs. A BDD, so a binary decision diagram, is simply a representation of a Boolean function. An example can be seen on the right. Each node represents the binary variable. Accept the leaves. They represent the output value of the function. The outgoing edge of a variable node represents if the variable is fulfilled or not. So the structure can be recursively defined. Where every variable node can be seen as a root of a new function, while the leaves are simply the constant functions that take 0 or 1. In addition to basic BDDs, ROBDDs are ordered, which means for every path from root to leaf, every variable is transversed in the same order. And they are reduced, which means they are minimized in a way that there are no isomorphic sub-trees and no redundant nodes in the BDD. To sum up, ROBDDs are canonical representations of a Boolean function.  On the right, you can see a very simply digital circuit realizing a Boolean function. Here, every wire can be seen as a binary random variable, which takes either 0 or 1, depending on the input to the circuit. So Q1, for example, is a function of X1 and X2, while Q2 is a function of X2 and X3. And the output depends on all three random variables. So as a consequence, each wire is a Boolean function, which can be represented efficiently as an ROBDD. Now let's get to how we perform our checks, meaning how we check the statistical distributions of the wire using the ROBDDs. For that, we will quickly recap the concept of statistical independence. Two events, A and B, are said to be statistical independent if the probability that A and B happen is equal to the product of the probability of A and the probability of B. This can then be extended to random variables. Two random variables are said to be independent if the probability that X takes a certain value and Y takes a certain value is again equal to the product of the respective probabilities. Now for every possible pair of values, the random variables can take. We can simplify the check if we just consider two binary random variables. For this case, we don't have to check every possible combination. But it is enough to show that the condition holds for a certain pair of values, X and Y. More specific, one can show that if X and Y are binary random variables, they are statistically independent if and only if the probability that X takes 1 and Y takes 1 are equal to the product of the probability that X takes 1 and the probability that Y takes 1. As a result, making this one check instead of all possible four combinations of X and Y is already enough to conclude statistical independence of two binary random variables. As the next step, we will extend this approach to check statistical independence of two joint distributions over binary random variables. For that purpose, that X and Y be sets of binary random variables. Now to show that these sets are statistical independent, we have to show for every subset X prime of X and every subset Y prime of Y that the event that all values in the X prime takes 1 and all values in Y prime takes 1 are statistical independent. We have to do this for every subset. An example where the sets consists of two random variables is given below. For checking independence, we have to check these four cases. Now, let's make the connections to the ROBDDs. We can make the following interesting observation. The probability that all binary random variables in a set are equal to 1 is equal to the probability that the logic conjunction of all these random variables is equal to 1. Now, the logic conjunction of binary random variables is again a simple binary random variable which we can present as an ROBDD. To sum up, we reduced the check of independence of joint distributions of random variables to the check of simple binary random variables which can be realized utilizing ROBDDs. So far, we showed how we perform statistical independence checks over the joint distribution of binary random variables. As the next step, we will present how we make use of this approach to verify the security of masked implementations. So, we need to redefine all the well-established security notions by means of statistical independence of joint distributions and then check the independence utilizing our ROBDDs. First, let's consider deproving security and describe it in terms of statistical independence. If we have a masked circuit realizing an unshared function with input x, y and z, the circuit is said to be deproving secure if the joint distribution over every set Q of probes on wires of the shared circuit is independent of the joint distributions over x, y and z, meaning the unshared input. For first-order security, that simply means that every wire is independent of the unshared input. As a result, we have to check statistical independence of joint distributions and we already showed how we do this. At the next step, let's describe denon interference in terms of statistical independence. This mainly is derived from the work consolidating security notions by the Maya ador. Now here, the definition follows a simulation-based approach where the simulator gets access of a restricted set S of input shares. More precisely, a masked circuit is said to fulfill the notion of the non-interference. If for each set of probes Q of maximum cardinality D, there exists a simulation set S of input shares restricted to a maximum of D shares per input such that Q is perfectly simulatable using S. This simulation argument can be translated into probability distribution. Namely, the distribution over Q, given only the simulation set, should be equal to the distribution over Q given all the shares. Now, if we assume that the input shares are identically and independently distributed, we can simplify this to the statistical independence of the distribution over Q combined with the simulation set and the shares which are not in the simulation set. Again, as a result, we have to check statistical independence of joint distributions here. Our tool also supports to check all security notions in the robust probing model in the presence of glitches, which is necessary to consider for checking hardware designs. This involves simply a pre-processing step of each probe before the independence check is performed. An example is given here. The probe Q3 realizes a function with inputs from the last synchronization point, which means the previous register stage. To derive the glitch-extended probe in the robust probing model, Q3 is simply substituted with a set of its input to the last register stage, meaning Q3 is substituted with Q1 and Q2 in this example. Then, the extended set is used as probes for the check. Again, now we can perform our check using the ROBDDs. We also derived a new methodology for checking the output uniformity for a masked implementation. We will explain it here for a single output function with three shares. We showed that instead of checking that the probability for all valid sharing given the unshared value is equal, we can also check if all sets that do contain all output variables except one are balanced. Hence, we have to check the balance of these three sets in our example. As a result, we reduced the uniformity check to verification of balance of joint output shares and generalized it even for multiple outputs. How do we perform the balance check using our ROBDDs? We use the fact that a vectorial boolean function is balanced if and only if each component function is balanced. Every component function simply means every possible linear combination of the coordinate functions. Here, all possible linear combinations of that one to ZELM. One linear combination is again simply a single random variable and we can also perform the balance check of a single random variable utilizing BDDs. On this slide, you can see an overview of our supported features. We support a check of all well-established security and composability notions. This ranges from deep probing security over deep non-interference, deep strong non-interference to deep probe-isolating non-interference. All these checks can be performed in the standard probing model which is mostly relevant for software and also the robust probing model and the presence of glitches which is relevant to check hardware implementations. Additionally, we support checking the output uniformity. Now, let us give you an overview of the verification flow for a hardware design using our tool. The engineer defines its design using VHDL or Verilog. Then, he produces the Verilog netlist synthesized for example by the Synopsys design compiler. The resulting Verilog netlist file will then be passed into a custom netlist file which is the input to our analyzer. This analyzer is performing the checks and outputs the result. The result contains for each supported security notion the security order D and the first failing probe for order D plus 1. In this table, you can see some results of our tool for several different gadgets. The green tick indicates why verification times are given in the brackets. We also verified several mask encryptions like present, skinny, prince or AS. The results can be seen here. Now, we want to stress one advantage of our tool, the soundness. Meaning, our checks are in direct conformity with the security notions and we will not have false negatives. Which means we will not declare the design unsecure with respect to a security notion although it is actually secure. The example here is a gadget realizing Q124 taken from consolidating masking schemes by Reparass et al. Overconservative tools like for example a masked verif will declare that this design is not deproving secure although it actually is. This is simply due to the simplification of leakage terms to gain speed. So what the designer now will do is add additional randomness. Now, masked verif will say it is secure but the additional randomness was not required in the first place because it was already secure with respect to deproving security. So the designer introduced unnecessary overhead to the design. For larger designs, this overhead in terms of randomness will become bigger and bigger. So we consider being in direct conformity with the security notion a big advantage of our approach. Now, we give a quick wrap up about the advantages and disadvantages of silver. Silver is complete, meaning it supports all well established security know and composability notions. Silver is sound, meaning it is in direct conformity with the definition of the security notions and avoids false negatives. Which leads to less overhead being introduced by the designer. It also gives useful results. It returns, for example, the first failing probe, knowing this will enable a much easier fix by the designer. At the disadvantage, we see that our tool is slower than language-based tool tools like masked verif. So let me give you a quick demo of the tool. Let's assume the designer already made his code, so in the hl or verilog and synthesized it using an example library. And then the result of the design is the verilog netlist. And for one small example, which is simply a two input and with two shares which should be at the end probe isolating probe isolating robust secure first order can be seen here. You can see the netlist here and for the inputs and output Silver needs some additional information which you can give as annotations in the brackets you can see here and basically you have to say what is the clock what is fresh randomness and what are the single shares and for probe isolating or interference the indexing is important because for the security notion you need to give a specific index. And yeah, so you define what are the shares what are the fresh randomness and what is the clock and afterwards you simply go in the config file of Silver, you can define how many cores you want to use and zero is simply auto-detect of the cores and then how many memory you want to use then here you give the path through your file your very long netlist file which in our case was derived using the standard set library N, A, N, G, 45 and then you can basically simply run Silver so let me do this it takes a few moments and then you can simply run the verification and it will give you the result so this design fulfills for the first order everything even in the robust model except SNI robust so this is the D smaller equal to 1 indicates that and the probe at the end is the first failing probe for the security order so SNI robust is even failing for the first order with that probe and I robust is fulfilling the first order but is failing for the second order with that probe so it gives you useful information with what probes the jack fails to conclude with Silver we developed an easy to use tool for sound and complete verification of the security and composability of masked implementation in both software and hardware there are some additional information about Silver so you can find the tool on github following this link please feel free to download it and try it out feedback is always welcome here you can also find the eprint link to the paper and our contacts so my email address the email address of Pascal and also the email address of army is listed here so yeah please feel free to contact us if you have any questions or problems when running Silver thank you very much for the attention and for watching this video


Let me present to you the so-called orthogonal decomposition theorem. If we have a vector y that lives inside of the vector space fn for some field f and we take a subspace w of that vector space, there always exist vectors w1 and w2 such as the following conditions that hold. First of all, w1 will live inside this subspace w, which be aware y itself might not have anything to do with w, but w1 will live inside of w, w2 will be inside the orthogonal complement of w, and the sum of w1 plus w2 will equal y. And in fact, there's only one way to do this, and so this is the orthogonal decomposition. We can break apart y into two pieces of a w part and a w per part. And the proof of this theorem is actually quite simple if you use orthogonal complements. The idea is you set w1 to equal y hat. More specifically, this is the orthogonal projection onto w of the vector y. Okay, so you take that vector by construction. Remember, this thing will look like the sum where i equals 1, 1 to p of, you're going to take vi dot y over vi dot vi times vi, which will live inside of w assuming that the w is the span of an orthogonal basis, v1, v2, all the way up to vp. So you have some orthogonal basis right here of w. At the moment, we kind of lack the, you know, we should make mention like how do we even know w has an orthogonal basis. It turns out when we talk about the Gram-Smith procedure, we'll get exactly that. So we can always construct this orthogonal projection and that gives you the element in w. How do you get w2? Well, w2 is just going to be y minus y hat, for which you can then show that y hat dot y minus y hat is always equal to zero. So these things will always be perpendicular to each other, which then implies that y minus y hat belongs to w perp. Clearly the way we've defined this, if w1 is y hat and w2 is y minus y hat, their sum will equal y. So that's what the orthogonal projection, the orthogonal decomposition theorem is all about, is we can decompose a vector using orthogonal projections. Let's look at an example of such a thing. Let's take two vectors u1 and u2 to be 1, 2, 3 and negative 4, negative 5 for negative 1, excuse me. Notice real quick that if I take the dot product of u1 and u2, you end up with negative 5 plus 8 minus 3, which is equal to zero. So those are perpendicular with each other. And let's take the vector y, which y is not actually inside of w. Maybe it could be, I don't know. We're going to see it's not going to be able to. So I want to construct the orthogonal decomposition of y with respect to this space w and this orthogonal basis, which be aware the orthogonal decomposition does not depend on which orthogonal basis you use. The calculation will change a little bit, but the end result will be the same. So if we want to calculate w1, right? This is supposed to equal the orthogonal projection onto w of y. So this will look like the sum. We're going to take u1 dot y divided by u1 dot u1 times u1. And then add to that u2 dot y divided by u2 dot u2 times u2. So doing this calculation here. So u1 dot y, we're going to get negative 9 plus 40 minus 3. And this will sit above 1 plus 4 plus 9. And we're going to times that by 1, 2, and 3. And then for the second one, u2 dot y, we're going to get 45 plus 80 plus 1. And this sits above u2 dot u2. So we get 25 plus 16 plus 1. And we'll times this by negative 5, 4, and negative 1. So some arithmetic that has to be done here, but nothing, frankly, that's going to be too painful for us here. And so we're going to get 40 minus 9 minus 3. That turns out to be 28. 1 plus 4 plus 9 is 14 times the vector 1, 2, and 3. And then for the second one, 45 plus 80 plus 1, that turns out to be 126. And then 25 plus 16 plus 1 is 42. So we get negative 5, 4, and negative 1. Notice that these fractions both reduce down. 14 goes into 28, 2 times. 42 goes into 126. That goes in there three times. And so if you take 2 times 1, 2, 3, and 3 times negative 5, 4, and 7, you can see that that's going to turn out to be the vector negative 13, 16, and 3. This is a vector that lives inside of w. It was a linear combination of its basis right here. So this gives you y hat, aka w1 here. The next one, if you want to calculate w2, it's a whole lot easier to do. We just have to take y minus w1. That is y minus y hat right here. So recall that y, I can't see on the screen anymore, y was just going to be negative 9, 20, and negative 1. y hat, which we can see right here, we're going to subtract from that negative 13, 16, and 3. And so that adds up to just to be 4, 4, and negative 4. Like so. And so let's verify to make sure we have everything correct. So if we take w1 plus w2, this part we should expect to go smoothly. We take our w1 right here, which was inside of w. We get negative 13, 16, and 3. And then we add it to w2, which is right here, 4, 4, and negative 4. And given that we computed w2 just a second go by subtraction, the sum should work out pretty obviously. You're going to end up with negative 9, 20, and negative 1 again. That's what y originally was. No surprise there. But this is this is the important part. So we found a vector in w, which adds to another vector to give you y, is w2 in the orthogonal complement. To prove that we're going to compute the dot product of w1 and w2. We're going to take the negative 13, 16, and 3. And we're going to dot it with 4, 4, and negative 4. So negative 13 times 4 is a negative 52. 16 times 4 is a 64. And 3 times negative 4 is negative 12, which you can see combined 52 and 12.  Thus, in fact, we see that w2 belongs to w perp like we thought it would. And so we've then computed a orthogonal decomposition.


All right, let's start with our next talk in the security track of the Chaos Communications Congress. The talk is called Jailbreaking iOS from past to present done by Dimster. He spoke at the 32nd C3 already and researched on several jail breaks like the Phoenix or the jailbreak time for the Apple Watch. And he's going to talk about the history of jail breaks. He's going to familiarize you with the terminology of jailbreaking and about expert mitigations and how you can circumvent these mitigations. Please welcome him with a huge round of applause. Thank you very much. So hello, Roman. I am Dimster. And as I said, I'm going to talk about jailbreaking iOS from past to present. And the topics I'm going to cover is what is jailbreaking. I'm going to give an overview in general. I'm going to introduce you to how jailbreak started, how they got into the phone at first and how all of these progressed. I'm introducing to you the terminology which is tethered, untethered, semi-tethered, semi-untethered jailbreaks, like stuff you've probably heard, but some of you don't know what that means. I'm going to talk a bit about hardware mitigations which were introduced by Apple, which is KPP, KTRR, and a little bit about PAK. I'm going to talk about the general goals of the technical goals of jailbreaking and the kernel patches and what you want to do with those and brief overview how jailbreaking could look like in future. So who am I? I'm Dimster. I got my first iPod touch with iOS 5.1. And since then I pretty much played with jailbreaks and then I got really interested into that and started doing my own research, eventually started doing my own jailbreaks, kind of started with downgrading. So I've been here two years ago with my presentation downgrading. I was downgrading from past to present. I kept hacking since then. So back then I kind of talked about the projects I made and related to downgrading which was CSS checker, Future Restore, IMG4 tool, probably have heard of that. And since then I was working on several jailbreaking tools ranging from iOS 8.4.1 to 10.3.3, among those 32-bit jailbreaks, untethered jailbreaks, remote jailbreaks like me, and the jailbreak for the Apple Watch. So what is this jailbreaking I'm talking about? So basically the goal is to get control over the device you own. You want to escape the sandbox where the apps are put in. You want to elevate the privileges to root and eventually to kernel. You want to disable code signing because all applications on iOS are code signed and you cannot run unsigned binaries. You pretty much want to disable that to run unsigned binaries. And the most popular web people are jailbreak is to install tweaks. And also a lot of people install a jailbreak or jailbreak that devices for doing security analysis. For example, if you want to pan test your application, see how an attacker goes for it, you want to like debug that stuff and you want to have a jailbreak on phone for that. So what are these tweaks? Tweaks are usually modifications of built-in user space programs. For example, one of the programs is Springboard. So Springboard is what you see if you turn on your phone. This is where all the icons are at. And usually you can install tweaks to, I don't know, modify the look, the behavior, add functionality. Just this customization, this is how it started with jailbreaking. What is usually bundled when you install jailbreak is Cydia. So you install DPKG and APT, which is the DBN package manager. And you also get Cydia, which is the user-friendly graphical user interface for the decentralized or centralized package installer, package system. So I'm saying centralized because it's pretty much all in one spot. You just open the app and you can get all your tweaks. Or it's also decentralized because you can just add up your own repo. You can make your own repo. You can add other repos. And so you're not kind of tied to one spot where you get the tweaks from, like, when the app store, you can only download it from the app store. But with Cydia, you can pretty much download it from everywhere. You're probably familiar with DBN, and it's pretty much the same. So this talk is pretty much structured around this tweet, the ages of jailbreaking. So as the user said, we get like the golden age, the bootrom, the industrial age, and the post-apocalyptic age. And I kind of agree with that. So this is why I decided to structure my talk around that and walk you through the different ages of jailbreaking. So starting with the first iPhone OS jailbreak back then was actually called iPhone OS, not iOS, was not the bootrom yet. So the first was a buffer overflow in the iPhone's Lib Tip library. And this is an image parsing library. And it was exploited through Safari and used as an entry point to get code execution. It was the first time that non-Apple software was run on an iPhone, and people installed applications like Installer, AppTap, which were stores similar to Cydia back then. And those were used to install apps or games because for the first iPhone OS, there was no way to install applications anyhow. So the apps were introduced with iOS 2. So then, going to the golden age, the attention kind of shifted to the bootrom. People started looking at the boot process. And they found this device from our upgrade mode, which is a part of ROM, which, yeah, so the most famous bootrom exploit was Limerain by Geohot. It was a bug in hardware and was unpatchable with software. So this bug was used to jailbreak devices up to the iPhone 4. And there were also several other jailbreaks. We didn't rely on that one. But this one, once you discover it, you can use it over and over again, and there's no way to patch that. So this was later patched in the new hardware revision, which is the iPhone 4S. So with that bootrom bug, this is how tattered jailbreaks became a thing. So Limerain exploits a bug in the DFU mode, which allows you to load unsigned software through USB.   So historically, a tattered jailbroken phone does not boot without a computer at all. And the reason for that is because the jailbreak would modify the kernel and the bootloaders on the file system for performance reasons. So when you do the actual tattered boot, you would need to upload a very tiny payload via USB, which then in turn would load everything else from the file system itself. But this results in a broken chain of trust when the normal boot process runs and the bootloader checks the signature of the first-stage bootloader, that would be invalid, so the bootloader would refuse to boot that, and it would end up a DFU mode, so basically a phone won't boot. Sometime around then, the idea of a semi-tattered jailbreak came up, and the idea behind that is very simple. Just don't break the chain of trust for tattered jailbreaks. So what you would do differently is you do not modify the kernel on the file system, don't touch the bootloaders at all, and then when you would boot tattered, you would need to upload all the bootloaders, like the first-stage bootloader and the second-stage bootloader, which is iBoot, and then the kernel via USB to boot into jailbreak mode. However, when you reboot, you could boot all those components from the file system, so you could actually boot your phone into non-jabrock mode. If you don't install any tweaks or modifications, which modify critical system components, because if you tamper with, for example, the signature of the mount binary, the system obviously cannot boot in non-jabrock mode. So this is kind of the golden age, so let's continue with the industrial age. So with the release of the iPhone 4S and iOS 5, Apple fixed the bootron bug and essentially killed Limerain. They also introduced AP tickets and non-sys to bootloaders, which just I'm mentioning because it's kind of throwback for downgrading.  But with that, they also added downgrade protection, so jarricking became harder. If you want to know more about how the boot process works, what SHSH blobs are, what AP tickets are, you should check out my talk from two years ago. I go in depth on how all of that works. So I'm skipping that for this talk. So the binary default boots are encrypted. So the bootloaders are encrypted. And until recently, the kernel used to be encrypted as well. And the key encryption key is fused into the devices, and it is impossible to get through hardware attacks. At least there's no public case where somebody actually got that recovered that key. So it's probably impossible. Nobody has done it yet. So all boot files are decrypted at boot by the previous bootloader. And before the iPhone 4S, you could actually just talk to the hardware IS engine as soon as you got kernel level code execution.  So there's no way to decrypt bootloader files anymore so easily unless you got code execution in the bootloader itself. So yeah, decrypting bootloaders is a struggle from now on. So I think, kind of because of that, the attention shifted to user land. And from now, the JABRAX kind of had to be untethered.  And this is usually achieved through re-exploitation at some point in the boot process. So you can't just patch the kernel on file system because that would invalidate its signatures. So instead, you would, I don't know, add some configuration files to some demons which would trigger bugs and then exploit. So JABRAX then changed many bugs together, sometimes six or more bugs to get initial code execution, kernel code execution, and persistence. This somewhat changed when Apple introduced free developer accounts around the time they released iOS 9. So these developer accounts allow everybody who has an Apple ID to get a valid signing certificate for seven days for free. So you can actually create an Xcode project and run your app on your physical device. Before that, that was not possible. So the only way to run your own code on your device was to buy a paid developer account, which is like $100 per year if you buy a personal developer account. But now you can just get that for free. And after seven days, the certificate expires, but you can just for free request another one and keep doing that, which is totally enough if you develop apps. So this kind led to semi-unthesered jail rig, because initial code execution was not an issue anymore. Anybody could just get that free certificate, sign apps, and run some kind of code, which was sandboxed. So jail rig focused shifted to more powerful kernel bugs, which were reachable from sandbox. So you had jail rigs using just one single bug or maybe just two bugs. And the jail rigs then were distributed as an IPA, which is an installable app. People would download, sign themselves, put on a phone, and just run the app. So semi-unthesered means you can reboot into non-jail broken mode. However, you can get to jail broken mode easily by just pressing an app. And over the years, Apple stepped up its game constantly. So with iOS 5, they introduced ASLR, address space, layer randomization. With iOS 6, they added kernel ASLR. With the introduction of the iPhone 5S, they added 64 bit CPUs, which isn't really a security mitigation. It's just changed a bit how you would exploit it. So the real deal came with, started to come with iOS 9, where they first introduced kernel patch protection, an attempt to make the kernel immutable and not patchable. And they stepped up that with the iPhone 7, where they introduced kernel text. Street-only region, also known as KTRR. So with iOS 11, they removed 32-bit libraries, which I think has very little to no impact on exploitation. It's mainly in the list, because up to that point, Cydia was compiled as a 32-bit binary and that stopped working. That's why they had to be recompiled for 64-bit, which took someone to do until you could get a working Cydia on 64-bit iOS 11. So with the iPhone XS, which came out just recently, they introduced pointer authentication codes. And I'm going to go more in detail into these hardware mitigations in the next few slides. So let's start with kernel patch protection. So when people say KPP, they usually refer to what Apple calls Watchtower. So Watchtower, as the name suggests, watches over the kernel and panics when modifications are detected. And it prevents the kernel from being patched. At least that's the idea of it. It doesn't really prevent it, because it's broken, but when they engineer it, it should prevent you from patching the kernel. So how does it work? Watchtower is a piece of software which runs in Eel 3, which is the ARM exception level 3. So exception levels are kind of privileged separations, while 3 is the highest and 0 is the lowest. And you can kind of trigger an exception to call handler code in higher levels. So the idea of watchtowers, that recurring events, which is FPU usage, trigger a Watchtower exception of the kernel. And you cannot really turn it off, because you do need the FPU. So if you picture how it looks like, we have the watchtower to the left, which totally looks like a lighthouse. And the application's at the right. So in the middle in Eel 1, we have the kernel. And recent studies revealed that this is exactly how the X and U kernel looks like. So how KPP works. An event occurs from time to time, which is from user application. For example, JavaScript makes heavy user floating points. And the event would then go to the kernel. And the kernel would then trigger watchtower as it tries to enable the FPU. And watchtower would scan the kernel. And then, if everything is fine, it would transition execution back into the kernel, which then it would transition back into user space, which can then use the FPU. However, with a modified kernel, when watchtower scans the kernel in the text modification, it would just panic. So the idea is that the kernel is forced to call watchtower, because the FPU is blocked otherwise. But the problem at the same time is that the kernel is in control before it calls watchtower. And this thing was fully defeated by QWERTY in YALO 10.2. So how QWERTY's KPP PyBus works. The idea is you copy the kernel in memory, and you modify the copied kernel. Then you would modify the page tables to use the patch kernel. And whenever the FPU triggers in watchtower inspection, before actually calling watchtower, you would switch back to the unmodified kernel. And then let it run, let it check the unmodified kernel. When that returns, you would go back to the modified kernel. So this is what it looks like. We copy the kernel in memory. We patch the modified copy. We switch the page tables to actually use the modified copy. And when we have the FPU event, we would just switch the page tables back, make a forward to call to watchtower, make then watchtower scan the unmodified kernel. And after the scan, we would just return to the patch kernel. So the problem here is time of check, time of use, a classical talk to. And this works on the iPhone 5s, the iPhone 6, and the iPhone 6s. And it's not really patchable. However, with the iPhone 7, Apple introduced KTRR, which kind of proves that. And they really managed to do an unpatchable kernel. So how does KTR work? So kernel text treat only region I'm going to present as described by Zeguzza in his blog. Adds an extra memory controller, which is the IMCC, which traps all writes to the read-only region. And there's extra CPU registers which mark an executable range, which are the KTRR registers. And they obviously mark a subsection of the read-only region. So you have hardware enforcement at boot time for a read-only memory region, and hardware enforcement at boot time for an executable memory region. So this is the CPU. This is the memory at the bottom. You would set the read-only region at boot. And since that's enforced by the hardware memory controller, everything inside that region is not writable. And everything outside that region is writable. And the CPU got KTR registers, which mark begin and end. So the executable region is a subsection of the read-only region. Everything outside there cannot be executed by a CPU. Everything inside the read-only region cannot be modified. And this has not been truly bypassed yet. There's been a bypass, but that actually targeted how that thing gets set up. But that's fixed, and now it's probably setting up everything. And so far, it hasn't been bypassed. So jailbricks are still around. So what they are doing? Well, they just walk around kernel patches. And this is when KPP jailbricks evolved, which means, well, they just don't patch the kernel. But before we dive into that, let's take a look what previous jailbricks actually did patch in the kernel. So the general goals are to disable code signing, to disable the sandbox, to make the root file system writable, and to somehow make tweaks work, which involves making mobile substrate or lib substitute work, which is the library for hooking. And I was about to make a list of kernel patches, which you could simply apply. However, the techniques and patches vary across individual jailbricks so much that I couldn't even come up with the list of kernel patches among the different jailbricks I worked on. So there's no general set of patches. Some prefer to do it that way. Some prefer to do it that way. So instead of doing a full list, I just show you what the Helix jailbreak does patch. So the Helix jailbreak first patches the icon has debugger, which is a boot arc. It's a variable in the kernel. And if you set that to true, that would relax the sandbox. So to relax the sandbox or to disable code signing usually involves multiple steps. Also, since iOS 7, you need to patch mount because there's actual hard coded that the root file system cannot be mounted as read write. Since iOS 10.3, there's also hard coded that you cannot mount the root file system without the no suit flag. So you probably want to patch that out as well. And then if you patch both these, you can remount the root file system as read and write. However, you cannot actually write to the files on the root file system unless you patch lightweight volume manager, which you also only need to do in iOS 9 up to iOS 10.3. Later, when they're switched to APFS, you don't actually need that anymore. Also, there's a variable called proc and force. You set that to 0 to disable code signing, which is one of the things you need to do to disable code signing. Another flag is CS enforcement disable. Set that to 1 to disable code signing. So AMFI, which is Apple Mobile File Integrity, is a CAX which handles the code signing checks. So in the CAX, it imports the mem copy function. So there's a stop. And one of the patches is to patch that stop to always return 0 by some simple gadget. So what this does is whenever it compares something in a code, it would just always say that the compare succeeds and is equal. I'm not entirely sure what it does. So this patch dates back to Yalu. But just applying the patch helps killing code signing. So that's why it's in there. Another thing he links does is it adds the get task allow entitlement to every process. And this is for allowing retrial executable mappings. And this is what you want for mobile substrate tweaks. So initially, this entitlement is used for debugging because there you also need to be able to modify code at runtime for setting breakpoints, while we use it for getting tweaks to work. Since I was 10.3, Helix also patches label update exit VE patch, label update exit VE function. So the idea of that patch was to fix the process exec denied while updating label error message in Cydia and several other process. Well, that seems to completely nuke the sandbox and also break sandbox containers. So this is also the reason why if you general come with Helix, apps would save their data in the global directory instead of their sandbox containers.  So if you want to check out how that works yourself, unfortunately Helix itself is not open source and I have no plans of open sourcing that. But there's two very, very closely related projects which are open source, which is double Helix. This is pretty much exactly the same, but for 64-bit devices, which does include the KPP bypass, so it also patches the kernel. And jailbreak time, which is the watchOS jailbreak, but Helix is for iOS 10 and the watchOS jailbreak is kind of the iOS 11 equivalent, but it shares like most of the code. So most of the patch code is the same. If you want to check that out, check these out. So KPP less jailbreaks. So the idea is don't patch the kernel code, but instead patch the data. So for an example, we go for remounting the root file system. We know we have hard-coded checks which forbid us to mount the root file system read-write. But what we can do is in the kernel, there's a structure representing the root file system and we can patch that structure removing the flag saying that this structure represents the root file system. And we simply remove that and then we can call remount on the root file system and then we put back in the flag. So we kind of bypass the hard-coded check. For disabling code signing and disabling sandbox, there's several approaches. So in the kernel, there's a trust cache. So usually, Amphi handles the code signing, the demon user space handles the code signing requests, but the demon itself also needs to be code signing so you have the chicken and egg problem. That's why in the kernel, there is a list of hashes of binaries which are allowed to execute. And this thing is actually writable because when you mount the developer disk image, it actually adds some debugging things to it. So you can simply inject your own hash into the trust cache, making the binary trusted. Another approach taken by Jarek D in the latest ElectroJarek is to have a process, in this case, Jarek D, which would patch the processes on creation. So when you spawn a process, that thing would immediately stop the process, go into the kernel, look up the structure and remove the flags saying, kill this process when the code signature becomes involved. And it would invalid. And it would also add the get task allow entitlement. And then after it's done that, it would resume the process and then the process won't get killed anymore because it's kind of already trusted. And the third approach taken or demoed by Bazette was to take over Amphi D in user space completely. So if you can get a Mac port to launch D or to Amphi D, you can impersonate that. And whenever the kernel asks Amphi, is that trusted? You would reply, okay, yeah, that's trusted. That's fine, you can run it. So that way you don't need to go for the kernel at all. So future Jareks. Kernel patches are not really possible anymore and they're not even required because we can still patch the kernel data or not go for the kernel at all. But we're still not done yet. We still didn't go for post-apocalyptic and post-apocalyptic or short pack. Well, actually pack stands for point authentication code but you get the joke. So point authentication codes were introduced with the iPhone XS. And if we quote Qualcomm, this is a stronger version of stack protection. And pointer authentication codes are similar to message authentication codes but for pointers if you're familiar with that. And the idea of that is to protect data and memory in relation to a context with a secret key. So the data and memory could be the return value and the context could be the stack pointer. Or data memory could be a function pointer and the context could be a V-table. So if you take a look how pack is implemented. So at the left you can see function entry and function prologue and function epilogue without pack. And with pack the only thing that really changes is when you enter a function before actually doing anything inside it you would normally store the return value on the stack. But when doing that you would first authenticate the pointer with the context and then kind of create a signature and store it inside the pointer and then put it on the stack. And then when you leave the function you would just take back the pointer, again calculate the signature and see if these both signatures matches. And if they do then just return and if the signature is invalid you would just throw a hardware fault. So this is how it looks like for 64 bit pointers you don't really use all of the available bits. So usually use 48 bits for virtual memory which is more than enough. So you have, if you use memory tagging you have seven bits left for putting in the signature. Or if you do not use memory tagging you can use up to 15 bits for the pointer authentication code.  You cannot simply smash this tag and create a ROP chain because every return would have an instruction verifying the signature of the return value and that means you would need to sign every single of these pointers and since you don't know the key you can't do that in advance. So you cannot modify a return value and you cannot swap two signed values on the stack unless the stake pointer is the same for both. Can we bypass it? Maybe, I don't know. But we can take a look at how that thing is implemented. So if we take a look at the ARM slides you can see that pack is basically derived from a pointer and a 64 bit context value and the key and we put all of that in an algorithm P and that gives us the pack which we store in the unused bits. So the algorithm P can either be calmer or it can be something completely custom. And the instructions, the ARM instruction kind of hide the implementation details. So if we would go for attacking pack there's two ways of attack strategies. We can either try and go straight for the cryptographic primitive, like take a look what cipher that is or how that cipher is implemented, maybe it's weak or we can go and attack the implementation. So if we go and attack the implementation we could look for signing primitives which could be like small gadgets we could jump to somehow, somehow execute to sign a value which could be either an arbitrary context signing gadgets or maybe a fixed context signing gadget. We could also look for unauthenticated code. For example, I imagine the code which sets up pack itself is probably not protected by pack because you can't sign the pointer if the key is not set up yet. Maybe that code is still accessible. We could look for something like that. We could also try to replace pointers which share the same context. It's probably not feasible for return values on this deck but maybe it's feasible for swapping pointers in a V-table or maybe you come up with your own clever idea of how to bypass that, these are just like some ideas. So I wanna make a point here that in my opinion it doesn't make much sense to try to attack the underlying cryptography on pack. So I think that if we go for attacking pack it makes much more sense to look for implementation attacks and not attacking to cryptography and next few slides are just there to explain why I think that. So if we take a look at karma which was proposed by ARM as being one of the possible ways of implementing pack, karma is a tweakable block cipher. So it takes an input, a tweak and gives you an output which kind of fits perfectly for what we want. And then I started looking at pack at karma and came up with ideas how you could maybe attack that cipher and at some point I realized that practical crypto attacks on karma if there will be any in the future will probably, that's what I think completely irrelevant to the pack security. So why is that? If we define, so just so you know the next few slides gonna bore you with some math but it's not too complex. So if we define pack as a function which takes a 120-bit input and a 120-bit key and maps it to 15-bit output or we can more realistically define it as a function which takes 96-bits input with the 120-bit key because we have 48-bit pointer because the other ones we can't use because that's where we store the signature and we most likely using the stack pointer as a context so that one will also only use 48-bit pointers, 48-bits. So then we have a pack as a construct. So then we define the attacker with following capabilities. The attacker is allowed to observe some pointer and signature pairs and I assume that you can get that through some info leaks. For example, you have some bug in the code which lets you dump a portion of the stack with a bunch of signed pointers. This is why you can observe some, not all, but you can see some. And I would also allow to have the attacker be able to slightly modify the context. And what I mean by that is I imagine a scenario where the attacker could maybe shift the stack, maybe through more nested function calls before executing the leak which will give you actually two signatures for the same pointer but with a different context. Maybe that's somewhat helpful. But so we realize that the attacker is, the cryptographic attacker is super weak. So the only other cryptographic problem there could be is collisions and for those of you who've seen my last talk they probably know I love collisions. So we have 48-bit pointer, 48-bit context and 128-bit key. We sum that up and we divide that by the 15-bit of output we get from pack which gives us two to the power of 209 possible collisions because we map so many bits to so little bits. But even if we reduce the pointers because practically probably less than 34-bit of a pointer are really used, we still get two to the power of 181 collisions which is a lot of collisions but the bad thing here is random collisions are not very useful to us unless we can predict them somehow. So let's take a look how a cryptographically secure Mac is defined. So a Mac is defined as following. Let P be a Mac with following components and those are basically Gen, Mac and Verify. So Gen just somehow generates a key. It's only here for the sake of mathematical completeness. Just assume we generate the key by randomly choosing N bits or however much bits the key needs. And Mac is just a function where we put in an N-bit message, call M and it gives us a signature T and I'm gonna say signature but in reality I mean a message authentication code. And the third function is Verify, you give it a message and a signature and it just returns true if that signature is valid for the message or false if it's not. And when cryptographers prove that something is secure they're like to play games. So I'm gonna show you my favorite game which is Mac Forge game. So the game is pretty simple. You have to the left the Game Master which is playing Mac Forge and to the right the attacker. So the game starts when the Mac Forge Game Master informs the attacker how much bits are we playing. So this is the first one to the power of N basically means hey we're having Mac Forge with I don't know 64 bit messages. So the attacker knows the size. Then the Game Master generates a key and then the attacker can choose up to key messages of N bit length and send them over to the Game Master. And the Game Master will generate signatures and send them back so then the attacker can absorb all the messages he generated and all the matching signatures. So what the attacker needs to do then is to choose another message which he did not send over yet and somehow come up with a valid signature. And if he can manage to do that he sends it over and if that's actually valid signature for the message then he wins the game otherwise he loses the game. So we say a Mac is secure if the probability that an attacker can somehow win this is negligible. So I'm gonna spare you the mathematical definition of what negligible means but like just guessing or trying means that it's still secure if that's the best attack. So as you can see is a Mac which is secure needs to withstand this but for our pack attacker we do not even have this oracle. So our attacker for pack is even weaker than that. So why do we not have this oracle? Well simple, if we allow the attacker to sign arbitrary messages, the attacker wouldn't even need to try to somehow get the key of forged message because then he could just send over all the messages, all the pointers he wants to sign, get back signed pointers and he wouldn't need to bother about breaking the crypto at all. So basically the point I'm trying to make here is that the pack attacker is weaker than a Mac attacker. So every secure Mac we know is also a secure pack but even an insecure Mac might still be sufficiently secure for pack. So secure Macs have been around for a while and thus in my opinion I think if somebody who knows what he's doing is to design a pack algorithm today it will likely be secure. So instead of going for the crypto I think we should rather go for implementation attacks instead because those will be around forever and by that I mean, well you can either see how the crypto itself is implemented but I mean especially by that is you could see how the pack is used in the actual code. Maybe you can find signing oracles, maybe you can find unauthenticated code. I think this is where we need to go if we wanna bypass pack somehow. So just to recap where we're coming from future iPhone hacks probably gonna not try to bypass KTRR and I think they will not try to patch kernel code because we can achieve pretty much all the things we want to achieve for end user jailbreak without having to patch the kernel so far. And I think people were gonna struggle a bit at least a bit when exploiting with pack because that kinda will either make some bugs unexploitable or really, really hard to exploit. Also maybe we're gonna avoid the kernel at all as Bazard has demoed the userland only jailbreaks are possible, maybe gonna recalculate what the low hanging fruits are. Maybe just go back to iBoot or look for what our thing is interesting. So that was about it. Thank you very much for your attention. If you would like to ask a question, please line up on the microphones in the room. We do not have a question from the internet. We have one question over there. Yes, please. Okay. Hi, I would like to be interested what your comment is on the statement from Zorik that basically jailbreaking is not a thing anymore because you're breaking so much security features that makes the phone basically more insecure than the former reasons of doing a jailbreak really allow for. Well, jailbreaking, I don't think jailbreaking itself nowadays makes the phone really insecure. So of course, if you patch the kernel and disable all the security features that will be less secure. But if you take a look what we have here with the unpatchable kernel, I think the main downside of being jailbroken is the fact that you cannot go to the latest software version because you want the box to be in there to have the jailbreak. So I don't really think if you have a KTR device, the jailbreak itself makes it less secure. Just the fact that you're not on the latest firmware is the insecure part of it. All right, thank you. Mike for number two, your question. Hi, good talk. Could you go back to the capabilities of the adversary, please? Yeah, so you said you can do basically two things, right? This one, yes. Yeah, I can observe some pointers and some signatures pairs. But why is this not an Oracle? Because you cannot choose your message yourself. You message yourself. And you have also an Oracle that says if the signature is valid for a chosen message. Well, yeah, but this is if you take a look at the game and this game for a secure Mac, the attacker can choose up to Q messages, send it over, like he can do whatever he wants with that messages and get a signature while the pack attacker can see a few very limited amount of messages and they're matching signature and he has little to no influence on these messages. All right, thank you. Okay, so it's a bit weaker. So yeah, that's the point, just that it's weaker. Thanks. Do we have a question from the internet? Seems not so. Okay. Just please. All right. Then I don't see anyone else being lined up and please give a lot of applause to Team Stuff for us all. Thank you. Thank you.


Hi, it's Bridget. Welcome to above life channel. On this channel, you know that I share with you weekly channeling that comes from famous dead people. And why do we talk to dead people in the afterlife? Famous ones, no doubt. Because they give the best advice. They have incredible insight about our human life. And we tend to listen to them because it's interesting, right? It's interesting. All right, so this particular video is actually not a channeling session. It will be a little bit of a question and answer. I got this incredible question, which I thought was hilarious. I actually laughed out loud as I was reading it. And I thought this is perfect. And it's a legitimate question. So I wanted to answer it. So what is the question? Well, I do read my YouTube comments. Yeah, I know there's some nasty ones on there, you guys. Just ignore that. Okay, don't pay attention to the nasty ones. But there's some really insightful value added comments. And so for those of you who are leaving those comments and the kind ones, thank you. That's really sweet. And I totally read them. So here's the question. There was a question that was asked about spirit in the afterlife because I describe them. So how I see them, right? And the question was, do they wear clothes? Like, why do they wear clothes? And do they have wardrobe changes? Or how does that work? And I thought that's a great question. And it was so funny because as soon as I read that comment, instantly Prince appeared to me. And if you watched my stuff, you know that all this afterlife channeling of celebrities started with Prince in the afterlife a couple of years ago. And he decided to become full spirit. He's the one that opened all this up for me to channel famous celebrities. I wasn't channeling celebrities before. I was just doing private sessions as a medium. No big deal. Now it's like all these famous dead people, which is fascinating. But Prince shows up as I'm reading this comment. And he's like, and he answers because Bridget doesn't want to see me naked. And you know what? He's right. I have no desire to see anybody with this in that kind of setup scenario, especially in the afterlife. Like, I don't need that. All right. So to answer it in all seriousness, okay, in all seriousness, you guys, this is a good question. Because they don't have bodies. If a spirit doesn't have a body, they don't need a body. Why do they have clothes? Why do they need clothes? They don't need clothes. They don't need a body. They don't need clothes. So why do they show up visually for me in that way? Because that's what's familiar to me. In order to relate, to be able to translate and be relatable, they show up in the way that we are going to be able to receive them. And so for me, when I see, for example, my friend Prince in the afterlife, he usually looks really nicely put together. And sometimes to look according to different genres, depending upon what topics we might talk about, if he looks a little funky, you know, he's ready to kind of jam and got the Afro going and the 70s kind of look, because sometimes he shows up that way, then that that kind of helps me. It's an indicator to me what kind of vibration, the energy or the messages that's going to be coming through. Or if he shows up very neat and tidy in his suit, and when his hair all tucked back and really short, neatly, very neatly groomed and maybe with some glasses on, he means business. He might want to talk to me about my business, because he likes to give. He's got a lot of he's got a lot of guts when it comes to other people's businesses. Let me just say, so when he's trying to give me some business advice, he might look like that, you know, so it's just it's part of the energy. So it is kind of like a costume to answer your question. It is kind of like a costume. And it tells me, it tells me gives me clues as to what context, what vibration, what kind of energy we're going to be talking about, or what it sets the tone, or it just reiterates. Clothing color, the color of clothing like purple and such, for example, would be a Prince color for me. It would give me a sense that that's what I'm talking to. Or if somebody else shows up and they're wearing a purple, like sports coat or something, after life's a lead in session, they might be paying respects to Prince, because they know that Prince is the reason why I'm even interviewing celebrities in the first place, because he's the one that I was just crazy enough to be open to and created this incredible just opportunity for me to do channeling, you know. And so color is very symbolic. I've talked about it in my work. You guys have to know, I want you to know that although you're finding me at a above life channel and you're seeing me as kind of this, you know, the last two years, maybe this person that's just started doing channeling in the last two years, I have been doing psychic work for over 14 years at the time of this video. I've been a psychic and a medium for a very long time.  So no disrespect to other people, but I just wasn't really for me. I never saw myself doing that. And now I recognize that there's so much value to be shared and so much incredible insights that afterlife celebrities can bring to us as a whole humanity where we will listen. We will listen to them. And they have some kind of credibility with us. So the clothing thing, speaking of credibility, gives them some credibility, I think. And it helps to give to provide information, additional information as to what the topic is, what the tone is, what the energy is. So pay attention. If you are having visits and your dreams from celebrities or from loved ones who are totally in spirit form now, then pay attention to what they're dressed like. Maybe they'll come dressed in a suit or a tux if there's a wedding upcoming. Maybe they're dressed in their Sunday attire because they're attending a baptism for someone in the family, for example. Pay attention. Pay attention to what they're wearing because it could give you additional information about what the messages they're trying to convey. So this is Bridget at Above Life Channel. I hope this video has helped you a bit. I thought it was a great question. It's like, I'm thinking, naked spirits. Yeah, not really. They need to be wearing clothes. That's a requirement for me to be able to channel them. Oh my goodness. Great question. See, I do read my comments. Thank you so much for watching. Be sure to like and subscribe so you never miss a new weekly channeling video. Thanks for watching.


Sam, it's Michael, Don and Peter. How are you today? Hey, guys, you know, it could be better. Obviously, we would have liked to get a win yesterday, but you're all right.  I mean, how do we talk to you about that? I mean, what is it to ask? I'll start with the simple one. How did you guys lose to a team that doesn't want to win? You know, for us, we just, we knew going in, it would be about us and how we execute on, you know, in all three phases of the game. And we just didn't, simple as that. And, you know, we got to be better. And, you know, for us, it's about making sure that, you know, we understand kind of, you know, how we got to get better. And if we don't get to play exactly right, we feel like we're not very comfortable with the look. We got to redo it. We got to, we got to be sure about everything that we do from here on out. And I think, you know, we just got to be really, really into the details from now on. Shouldn't that been the case from the beginning, though, Sam? Yeah, yeah. I mean, you know, it always has been the case. But I think for us right now, we just got to, we just got to really, really walk into every little detail.  But I think for us, you know, going through that and making sure that everything is perfect, I think that's what we got to do from now on. The last two weeks, and I believe the Dallas game as well, you scored on the first drive. Are you scripting the plays, and does that have something to do with the fact that you guys look very crisp on those first drives?  I've said it every single week, win or lose them. For us, it's, you know, it's really, it's about us as players making sure that we go out there and actually do what we need to do to win the game.   But it seems to work in the first drive. What's working early in the game that doesn't seem to translate later in the game? I mean, lack of, lack of penalties, lack of negative plays. We move the ball so well, and we can get into rhythm. And, you know, it's tough as an offense when you're getting setbacks and penalties and negative plays. Now, this is better a question for Coach Gase, because you are on the field and we'll talk to Coach tomorrow, but, you know, 250 left in the game, you have three timeouts, and you didn't use one. And then when you finally get the field goal, there's 15 seconds left for the onside kick. How come there wasn't a timeout used at the end? Yeah, not sure. That's a question for Coach Gase. A lot of fans are upset, and you could understand that, Sam. They didn't expect this team to be 1-7. And then there were whispers of Sam's regressing. Sam is not becoming better. He's becoming, he's going back to bad habits. What do you say to the people that say you're regressing now? I would say it's not true.  You know, it's, you know, as professional athletes, we go out there and we want to win games. You know, for me personally, I feel like I have gotten better. I mean, you know, from the New England week to, really from Dallas week to New England game to Jacksonville to now. I feel like, you know, I've gotten better. It's just, it's about putting it all together and continuing to sustain drives. Like you said, I mean, last couple of weeks we've put together really good drives, really good first drives up again.  I think a lot of it is what it's going to force.  And, but, you know, people have seen it. Those first drives, if we, you know, if we can just stay ahead of the chains and we stay on rhythm, you know, we're capable of anything.


Welcome to the last of that news, like a top stories in crypto and bringing on a bite-sized pieces today. Instead of talking about the news, I want to talk about something a little bit more important. And that is, as we are getting closer to the end of 2021, we're in November, we've got one more month to go. I think both of these months will be fireworks. And then we'll probably go into an extended bull market in 2022, January, February, March, April, who knows? But during this time, we're going to see a pretty rapid growth of our portfolios. And the next question is, well, what are we going to do with these portfolios when we have to, if we decide to cash out and pay the tax, man? So today, what I want to talk to you a little quick about is the things that I've learned along the way as far as tax minimization. And to make my point crystal clear, I want to direct us to a story about billionaire investor Peter Thiel, how he turned $2,000 into $5 billion. I got to tell you, when I wrote this title, it seemed very click-baity, but it's already happened. And it continues to happen. And I should just bring this to your attention so you know exactly what it is. So we're gonna talk about this. Then we're gonna go into some information I had put out previously and just update this information and then we'll go into all the things we need to know as far as tax minimization. So the first thing is Peter Thiel.  Well, his account, as it says right here, jumped more than $3 billion in just three years, even though he didn't contribute money to his Roth after 1999, pretty amazing, right? He put a little bit in, didn't contribute anything, went to $3 billion.  Well, first of all, Thiel's Roth IRA was worth less than $2,000 in 1999. Imagine that, $2,000. And Roth IRAs, if you're not familiar with them, are funded with after-tax dollars, which means that with a draw, the money is tax-free. So if you're not familiar with these in the United States, that's what we have as far as like, we have 401ks and Roth IRAs. In the UK, you've got things like SIPs and ISAs, but generally, as a function in most territories or countries or different destinations, a lot of these countries have some type of savings account or something that you can actually put into and you can only withdraw at a certain time because that really helps out their citizens. Now, not all of this is available in every single country, so check with your local countries and laws, but this is what we have in the United States and the UK and so on and so forth. So this Roth IRA, again, funded with after-tax dollars, which means that withdrawal, the money is tax-free.  So what did he do? How did he do this? Well, how he did it was, Teal bought 1.7 million shares of PayPal. Remember, he was the co-founder of PayPal and when it went public, there's some type of regulation I'm sure, but like if you want your shares, you gotta pay X amount. In this case, it's 0.001, which is what he paid in 1999, per share or essentially $1,700. And now he added in another $300 later on, but a 10th of a penny is what he paid. So just think about how much you can buy for a 10th of a penny and then here is what the stock price is at today. So that's not too shabby, right? Actually at the very top, it was at 308 and right now it's taking a little bit of a dip into 188. So that is essentially how Peter Teal did it. And the crazy thing, if you really think about it, is what this can do for you and how you can use this to your advantage, especially if you believe, like I believe, that crypto and digital assets are going to appreciate massively over the next years and decades. So what I'm gonna do is I'm gonna, we're gonna update some information that we had talked about in a previous video. So let's just jump into that and I'll give all the information out that I can. So remember this, it's not how much you make, it's how much you keep. And taxes are the number one reason why you'll lose a ton, but there's a way around this.  I think even the Bitcoin maximalists and the XRP army can all agree on one thing and that is that taxes are awful. So here's a question before we start. Question one is would you rather pay a 20% tax on $180,000 or a 15% tax on $2 million? And number two is do you think you live past 60 years old? Now me personally, I think I've made it this far, so why not? It's not outside the realm of possibility that I can make it that far. So let's start with the average viewer of this channel. Let's go with a person who is about 35 years old. That's pretty much somebody who is in the middle. Now it's just an average. You might be older or younger, but this is just an example. And according to the US Census Bureau and the Social Security Administration, people will live on average somewhere around 82 years old. That's males, females, white, black, Latino, whatever.  But let's say you retire at 65, so you got about 20 years to go until you kick the bucket. I mean, well, it's actually 17, so let's just round up to keep things simple. Again, you might live longer or shorter than this. I'm not no Stradamus, let's just go with the average. So obviously the earlier you retire, the more money you might need so you don't run out. It really all depends on how long you wanna work. So that means that if you're around 35 years old, you've got 30 years to save up for retirement. Now it may sound far away, but let me tell you right now it is not.  If you're 20 years old, at some point I was in your shoes and someone told me a long time ago about compound interest and retirement and I thought, yeah, yeah, yeah, sure. I'll get to that and I didn't.  So again, it's not about what you make, it's about what you keep. And one of the biggest obstacles you and I are going to face is the tax man. And I know there's some libertarians right now saying, hey, taxation is theft. Well, that's what these people said and it didn't work out too hot for them. You got Willie, Wesley, Martha, and even Al Capone got pinched for tax evasion. So good luck doing better than these guys. And here's a little trivia, which one of these four did not serve jail time? Because three did, federal jail time. The only one that didn't was actually Willie. And the way he did it was he made a tape and paid the IRS back millions of dollars. So again, good luck dodging the IRS. Now, have you ever signed up with an exchange, done any kind of KYC, know your customer, AML, anti-money laundering, or submitted a photo ID or passport or social care number to any exchange or wallet? Because if you did any of those, chances are the government knows you have crypto and this question on your 1040 for taxes should have been answered, yes. Now look, I'm not here to calm down anyone, but I've been through an IRS audit and it is no fun. So trust me when I say the IRS knows, but stay with me because I'm gonna show you the smart way to do things and how to massively reduce your taxes so you can keep way more of what you make instead of giving it to the US government. So let's say you dollar cost average into Ethereum starting at the beginning of 2020. So assuming ETH goes to 10K, then we need to accumulate 200 ETH over the next 30 years. And that's just to break it down, ETH times 10K is 2 million, right? That's just my goal. And remember, that's just for you. So if you wanna leave a legacy for your kids and grandkids, then you might need more. Again, I don't know your personal situation, but these are all just rough estimates.  Now, I think this is a real possibility based on how technology is advancing. This is a great and frightening at the same time. Now, ETH might be the new 40. And if that's the case, you're gonna need way more income, which is even more of a reason to keep as much as you can and not give it away to good old Uncle Sam. And nobody wants to do that. And one more thing, remember $100,000 today will not be $100,000 in 30 years, especially with all this money printing going on. So just keep that in mind. So here's your options right now. And they're called capital gains tax. And you've got essentially two flavors. You got short-term capital gains, which is anything that you can make under a year. So an example is you buy Bitcoin in June 2020 and sell it April 2021. You bought it and sold it in less than a year. That is short-term capital gains tax. And you'll be taxed based on your filing status.  Head of household, same thing. If you make over about 52,000, 22%, 84,000, 24%. And then married filing jointly and separately. And this is progressive. So just be aware of that's how it is. And also here's long-term capital gains tax, which is like the prettier, yet still ugly sister of short-term capital gains we just saw. So this is what you can expect if you cash out after holding an asset longer than a year. So let's say that, again, you are head of household and you make $52,000, you're gonna be taxed at 15%. If you make over 461,000, first of all, good for you.  And then single, 39,000, 15%, 20%, and so on and so forth. So it really all depends where you fall. And one more thing, these are the current numbers. Keep in mind that these capital gains taxes have been as high as 35% in the 70s. So hopefully it doesn't go back to that in the future, but who knows? We gotta pay for all this money printing, right? And it really depends on the philosophy and direction of the government at the time and who is in charge, which is why I'm making plans right now. So I have to deal with that uncertainty in the future. Also, more bad news, depending on the state you live in, you also have to pay state capital gains tax on top of the colossal taxes you just paid on the federal capital gains taxes. So lucky for me, I'm in Texas, so I got 0%. But who knows where I'm gonna live later? I could move to Georgia, I don't know. But Florida, Nevada, all 0%. Washington, congratulations, New Hampshire. Then you got most of the Midwest and the Southeast, you're looking at four to six. And then if you live in California, you got 10%. So sorry, Cali. So let's recap. We're gonna need money for decades after we stop working and we don't wanna pay Uncle Sam a huge chunk of our crypto gains. So here's what I'm doing. I'm putting $6,000 worth of cryptocurrency and gold per year into a Roth IRA. Now, why $6,000 and why a Roth IRA? Because six grand is the max I can contribute every year and with the Roth IRA, I'll never pay taxes on the gains from my crypto ever. Let me say that again. With the Roth IRA, the one on the right. I'll never pay taxes on the gains from my crypto ever. So if you're thinking, well, I don't have $6,000 to contribute every year, I'm on a budget. So I want you to think of it this way. If you put in $500 into Bitcoin in 2013, when it was $100 per Bitcoin, you'd be sitting on five Bitcoins right now and it'd be worth $50,000 plus and probably $500,000 in the future if it hits 100K per Bitcoin, which a lot of people do predict. Or if you had invested $500 into Ethereum in 2016, which wasn't too long ago, when it was $10, you'd have 50 Ethereum worth $200,000 right now and $500,000 if Ethereum hits 10K per ETH. The point is it doesn't matter if you contribute a little bit or the max per year. Just contribute something and get prepared for the future. Be proactive instead of reactive. Trust me on this one. And those examples I just gave was only $500 total. So imagine if you would have invested or could invest 1,000, 2,000 or even 6,000, which is the max every year and what might happen in the next 20 to 30 years. Now I don't know what's gonna happen with crypto and digital assets in the future, but if history is any teacher, we could see some massive gains and unfortunately some massive taxes for those who are not careful. So the question is, do you believe that what you invest in will stay flat or massively go up in value and eventually moon? I think it's gonna weigh up. So here's why I'm using a cryptocurrency specific IRA that will massively minimize my taxes so I can keep more of what I earn. So let's break it down and talk about a traditional IRA, a SEP IRA and a Roth IRA and why I picked the Roth. Again, you can do whatever you want to do but this just made sense for me and my personal situation. So a traditional IRA, the contribution limits per year are $6,000 if you're under 49 and $7,000 if you're over 50. So that's just something to be aware of. Contribution taxes are pre-tax, meaning you put in money before the IRS taxes you on your income, which means the growth of the investment will be taxed, i.e. you save it in the beginning but then you get crushed in the end. So do you wanna pay taxes on the $6,000 that you put in per year or the millions it can potentially grow to?  So whatever your crypto investments grows to means that's what you'll pay taxes on on all of those gains. Early withdrawal fee is a 10% penalty plus a tax fee. So if you take money out before 59 and a half be prepared for a nice kick in the teeth. And who is this good for? Well, this is good for people who need the tax break for this year's taxes or people who think that their taxes will be lower in the future. An example would be someone who makes like a ton of money, $200,000 salary now but when he or she retires they won't have that job or that high salary which will put them in a much lower tax bracket. So that is what will be good for them. So additional info is this, you can do a rollover. So if you have a traditional IRA somewhere else or an old employer plan like a 401K, 403B, military TSB or 457 then you can move these types of accounts tax and penalty free to any type of traditional IRA. But if you wanna roll over any of those traditional plans into a Roth cryptocurrency IRA it's considered a taxable event as additional income. This might make sense in certain situations but just talk to the pros. So we talked about traditional IRA, let's talk about a SEP or a simplified employee pension. And for this one, the contribution limits per year are 20% of that earnings. That's pretty big, 20%. Contribution taxes are also pre-taxed which means you put in money before the IRS taxes your income. So again, the growth of the investment will be taxed. Again, you wanna be taxed on the 20% of your net earnings you put in or the millions it grows to. Withdrawal tax are also tax deferred meaning you pay taxes when you withdraw after age 59 and a half. So again, whatever your crypto grows to you'll pay tax on it. Early withdrawal fee is again, 10% penalty plus a tax fee. So again, another kick in the teeth. And this is good for small business owners and people who need the tax break for this year's taxes or people who think that their taxes will be lower in the future. Like the example we just talked about with the traditional IRA. Again, for the additional info, you can do a rollover. Talk to the pros in that one and they'll set you up. But for me, I'm a heavy crypto investor. And for me, it only makes sense to open up a Roth IRA and here's why. So for a Roth, the contributions limits a year are again, 6,149 or 7,000 for 50 year olds and plus. Contribution taxes are post-tax meaning that you put in money after you get taxed on your income. This means your investments grow tax-free. So again, you wanna pay tax on the 6,000 you initially put in or the millions it will grow to. Withdrawal taxes are tax-free growth meaning after 59 and a half you can withdraw any amount tax-free. Early withdrawal is none for contribution. So you can also withdraw your contributions at any time for any reason and get no type of penalty. But for the earnings it makes you could pay taxes plus a fine or both. So if you need money for any reason just take out the contributions that you've put in and you'll be fine, although I wouldn't recommend that. So this is good for people who believe that their crypto investments are gonna shoot up massively over the next 20 or 30 years like myself. Also it's for people who think their taxes will be higher in the future either from government interference or they'll continue to work the rest of their lives like small business owners or asset owners or people who have like rental property. So just so you know, this is my choice and what I believe will work best in my situation. Again, use this information to decide what works best for you and your personal situation and that's what I have to say there. So here's a little trivia. Do you know the return on investment for a IRA that invests in the usual regular market, stocks, bonds, CDs, et cetera? On average, it's a whopping six to 10%. Let me say that again. Per year, it's six to 10% in the traditional space. That's a huge year. That's enormous. But in crypto we call that a Tuesday. So here's a warning. How you file your taxes will make a big difference. So for the traditional and SEP IRAs there's no contribution limits based on income meaning pretty much everyone can contribute up to 6,000 per year but for a Roth IRA there are contribution limits based on income and tax filing status. So you know there was a catch because everything if it's too good to be true usually is but there's a catch but it's not too bad. I'm gonna show you why. So here's the Roth IRA modified adjusted income chart for 2019 and 20. They're pretty much the same but if you filed as a single or head of household and make less than 122,000 nothing to worry about. Above that it gets reduced at 137,000 you can't contribute anything to the Roth IRA but there's a way around this. Now, if you filed as married filing jointly and make less than 193,000 nothing to worry about. Above that it gets reduced and then at 203,000 you can't contribute to a Roth IRA at all but there's a way around this. If you filed as married filing separately like I do and make less than $10,000 then you can only contribute a reduced amount or none at all but there's a way around this. Now the way around this is called a backdoor Roth IRA and it gives me all the advantage of a regular IRA regardless of my income and I'm able to contribute the max of 6,000 per year and this little gem was passed into law by the federal government in 2010 but not too many people know about it and that's why it got me. So here's who I use for my personal Roth IRA and who I recommend to all my friends and family and it is I Trust Capital and the reason for this I went with them for three main reasons. First of all was the team, second was because the fees and third is I can have an IRA of crypto and gold so let me just break it down. So the team itself is the actual website I'm gonna go to about us, click down on team and this is what I always harp about. If you wanna see a company that'll be successful look at the team because it'll just tell you exactly what you wanna know. So this team that they've assembled I believe is kind of bringing together the old world with the new. So Todd and Blake here and Anthony, where do you go? Anthony down here are the kind of like leading in the cryptocurrency investments and Rich, Tim and Murphy or Rich is the CTO, Tim is the economist and Murphy is the VP of operations. These guys were all part of PIMCO which has a 1.9 trillion assets that are management. So these guys manage bond trading platforms that would do one million trades a day. So the point is they know how to build and operate a trading platform at a pretty high level. So that makes sense to me. And I've also got Terry down here who's got three decades in the retirement trust industry and the rest of the supporting staff which all looks pretty good. Again, I'm a big believer in teams and this one's pretty stacked. So just show me who the team is behind the company and I can tell you pretty much whether they're gonna be successful or not. It's the same thing with businesses, same thing with cryptocurrency and digital assets and the teams behind it. Next is the fees. So let's take a look at the fees as you go to pricing and here it is, three bucks a month, it's a count fee and then in crypto you get a 1% trading fee, 1% not too bad. Gold is $50 over spot. Okay, so here's those updates I was talking about. Talking about pricing, this is crazy but it's true. Now instead of 2,999 per month as far as I trust capital, this is the pricing right now, zero. You have a $0 monthly account fee. Let me say that again, there's no more monthly fees, it's just zero dollars. Now there's still a fee if you trade within your account, you get as far as like 1% trade fee, gold is $50 over spot per ounce and silver is 250. So that is essentially what you get right there and then just remember that within your account as you trade there is no capital gains tax, whatever you trade within your Roth IRA account. So if at some point, you know, Bitcoin goes up or down and you say, I don't want to sell it and just kind of hold on to things and reinvest later within the Roth IRA, you can totally do that, pay zero in capital gains tax. Now on top of, which is crazy, no monthly account fees. And then of course also, when you sign up with my link in the description below, you get $100 worth of Bitcoin just for signing up, which is crazy. But your account still includes a setup of your new IRA, facilitation of transfer, rollover contributions to fund your IRA, and we talked about that for a 1K, for a 3B, a Thrift Savings Plan, all those different things that you can actually roll over, all necessary IRS tax reporting, unlimited storage with institutional custody partners and I trust capital, platform support and maintenance. Now on top of that, the next question that I had was, hey, you know what, what are the different types of crypto assets that I can actually get into? Well, here they all are. And when I first got into, I mean, this is my second year and there wasn't that many. It was like Bitcoin Ethereum, I think Chainlink was there, Litecoin was there and Bitcoin Cash, but now you got a plethora of different ones to choose from. I mean, Doge or Bitcoin Cash, Stellarios, Compound, Uren, Sushi, Maddox, Alana, Bat, Engine. Ooh, Engine's good. Cosmos, Maker, Shiba Inu, and then coming soon, Avalanche. So you've got just a ton of choices for which ones you want to get into as far as with crypto. And again, if you want to trade within your account, it's there is no tax issues. You don't have to pay capital gains tax. And then also on top of that, the next question I had was, well, if I'm gonna invest in a crypto with iTrust, how I know it's safe? And this is one of the big things that I thought was probably the most important, which is it's not how much you make like I talked about, it's how much you keep. And if things get hacked, then that makes that does nothing for us. So they've got two different custody champs. They've got Coinbase, Custody, and Curve. I'm gonna talk about Coinbase first. Now Coinbase, I thought this was pretty interesting, they did a blog post on this one, and they just talked about custody.  And that's really what the truth is. As far as insurance and industry-leading, annually reviewed, renewed commercial crime insurance, the amount of 320 million, and they have all these different securities and controls. But the big thing of why they actually did this, and I actually reached out to Anthony over there at iTrust, he goes, why did you guys go from Curve to Coinbase? He goes, you know what? It's there's two reasons, staking and governance. So staking is the potential to offer staking while still maintaining the same safe and offline storage of assets that clients trust. So what we were talking about is like what the different currencies are. How many of these can you stake? Well, Cardano, Chainlink, Dot, Stellar, Eos, I don't know about Stellar. Eos, Solana, I mean, name it, a lot of these can be staked, especially Ann Avalanche. So when we start to talk about this, as far as like, what is a good one? I mean, staking services is huge. And I talked to Ann and I go, when is that gonna happen? And he goes, well, it's all about regulation. He goes, but by no later than Q2 of 2022, we should have staking and maybe sooner. So I'm like, that's pretty good. On top of that governance, when clients invest in governance tokens like Uniswap, Compound, MakerDow, Sushi, Polka, and all those ones that we just talked about, they carry the right to participate in governance activities. And we eventually liked the clients to have the ability to vote their opinions. Again, this is all regulation issues, but this is things of what they are working on. And that's why they chose Coinbase custody. Now, on top of that, they also chose Curve. So I'm gonna jump into that real quick. Curve is for storing digital assets. Let me take a look at their website. So Curve, you don't know, they are making a big dent into the institutional grade custody.  And Franklin Templeton investments, I think they have like almost a trillion assets in their management. Of course, those are all traditional. But I mean, if you have something like this, old school like this coming in, they're going, hey, we wanna get in the game and we wanna use Curve. So the same, these same huge corporations and big entities that are using this for storage and custody, you're also seeing this for what you are storing it. So that sounds pretty good to me. Now that was the old Curve website. When you type in Curve these days, Curve.io or whatever else it was, this is what you're gonna find. First of all, you're gonna see that PayPal is to acquire Curve. This is March 8th, 2021. And when you type in that website for Curve, it doesn't exist anymore. This is what it takes you to, PayPal.com. So Curve was such a great platform, such a great for custody. PayPal snatched it up. So you can't even, Curve doesn't, it's just been absorbed into the multi-billion dollar institution that is PayPal. And that is essentially what's going on. And then lastly, just real quick, because we know about Curve and whatever else, the big thing then is, what about gold? What about gold and silver? Because I personally believe that the new savings account should be Bitcoin, cold silver. I mean, if you really wanna be the safest one, you can choose what you want to as far as crypto, but gold and silver, sure, why not? I have no problems with gold bugs. I own a little bit myself. So just so you know, you can also get into gold and silver. iTrust uses Vault Chain. Investment, grain, gold and silver help physically at the Royal Canadian Mint. So they don't just get into shares of gold, but it's physically held at the Royal Canadian Mint. And I mean, if you're looking for some place to do these things, I mean, as far as like safety, and you wanna make sure that everything's on the up and up, this sounds like a pretty good place to do that. So again, this is everything that you can do as far as like with iTrust, and it looks pretty good as far as things going on. And then lastly, just remember that this account is open to you 24-7, 365. So a lot of all the different things that we talk about, how it can actually help you with tax and minimization, especially as time comes on, it's open 24-7, 365. You can do all the trading. You don't have to call anybody like a brokerage. And yes, that actually does still go on in different Roth IRAs, but not here. So I think it is, it's a pretty good platform. I've used it personally for two years, and I've had nothing but good things to say about it for all this time. So lastly, the fees are gone, like we just talked about. Also, it's $100 in free Bitcoin when you set everything up. So you can go right to iTrust. You don't have to use my affiliate link if you don't want to, but you won't get the $100 signup bonus and all that stuff. So there'll be a link in the description. It looks just like this. And when you click on that link, you can set everything up. It's just super easy, easy, peasy. Now, when you set things up and you have issues or whatever else, you see in the upper right-hand corner, it says schedule a call right up there.  That's what I did. And it was pretty much seamless, but I had a ton of questions because I didn't really know anything about Roth and traditional and set by IRAs and difference. That's why I made this video for you guys. So that is what it is. And then lastly, I will just say, just to put a face behind the company, I'm gonna bring in Blake and he's gonna just take a quick snippet. All right, everybody, welcome to the office. And then very lastly, I want to introduce you to Blake Scadron. And he is the CEO of Itrust Capital. And it's one to actually put a face to a name. So this is the guy that we're talking about. Blake, thanks for coming on. Yeah, Dan, thanks so much for having me. Real excited to be a part of your channel and help all the crypto investors take advantage of the benefits of IRAs. Yeah, I really appreciate it. Now, if you guys don't know, Blake was the one that I actually reached out to them and he was the one that answered all my questions. And I had so many questions. I think I was bombarding with him with so many. And I'm just glad that he actually kept me in the wheelhouse. So if you've got questions, this gentleman got answers. Him and his whole team are, they have a crack squad and I'm happy that we can work together. So Blake, thanks for taking the time. That's it. Yeah, thank you for having me a part of your channel.