What if Cooler came to dynamic to try and stop Frieza from gathering all of the Dragon Balls for himself in order to steal the wish, ultimately leading to a brother civil war that would go on to destroy the entire planet? And what if all of that was because of one man, and that man was Zarbon? Well, if somehow you've always wanted to see that story, Dragon Ball Z Budokai TKG2 has a complete story just for you. And today on the channel, we're going to play through that story to see how Zarbon makes this story unfold. It's finally time to get into the next what if saga. I'm putting this above even completing the Frieza stuff because the Raditz one was so good, dude. Raditz is one of my favorite characters, and I know nothing about beautiful treachery. A what if story about Zarbon's sad fate? Did I make these what ifs? Why are they covering my favorite characters that nobody else cares about? This is sick. No spoilers, dude. These intros always do spoilers. Beautiful treachery. You actually get to play as Zarbon. Is this one going to be another, like, heart-wrencher dude? Hold on. Let me go. I guess we just go straight to the point. As Dodoria staggered, cut off guard by Gohan and Krillin's attack, Zarbon came to his rescue. Oh, Zarbon's here. Dodoria, why in the world are you having trouble with these runs? But Zarbon, they're stronger than I thought. Hey, give them their credit. Give them their credit. You must be from Earth. Why did you come here? Why would we tell you? We better get moving, Gohan. Yeah, get out of here, Krillin. The fight with Dodoria was honestly pretty tough. Oh, sorry, I can't let you. I can't let y'all do that, though. All right, I gave Zarbon a blast and a speed. That's it. Nothing too crazy. I just want him to have the ability to level up after that Bardock fiasco. Hey, I'm sorry about this, Gohan. Now I'm fighting on the other side. Now I can see through Zarbon's eyes. Come here. Okay, I'll block that. All right, I'm running. I'm running. I'm running. Easy dodge. Mix ups. Wow. How did Gohan just go straight into a grab like that? Bloody dance.  Eight. Wow. Not nine Ks. A little crazy. I'll do it again. I'm sorry, Gohan. Hey, listen, you guys put up a good fight against Dodoria, but Dodoria is like six levels below the... Oh, hold on. You got me wanting to fire a beam too. Shooting star arrow. Did less than my rush attack, but I'll take it. Let me see these Zarbon combos. Don't do this. Don't do this. Damn. A bar. And they just be making everybody hit hard in this game. Shooting star arrow. How did I miss? No, enough with the beams, dude. Enough with the beams. Block that. Step up. Sweep the leg. Pop him up. Oh, no. Dude, little Gohan is... Where is he going? Why is Gohan spamming like crazy? Another thing I'm just realizing. Wait, do they give the bots like my Evolution Z? Maybe this is a conspiracy theory because I did give Gohan a lot of key. So maybe it's the bots thinking that he should be firing more attacks? I don't know. Look, that's just one man's conspiracy theory. Let me take care of Krillin here. I feel like I should still be able to win with just Zarbon, even though I am moving super slow. My goodness. Zarbon attacks weird as hell in this game. No. Got him. Cancel out the beam. We're using rush attacks all 2024. Damn. I heard him hit the ground from here. What's Zarbon's ultimate? Is it just elegant blaster? Oh, God. I'm not dodging that. Oh, back step. It is elegant blaster. Boom. All right. It honestly didn't do that much. I feel like I should just go with rush attacks. The scaling in this game is weird sometimes. All right. Sit him down. Oh, I got that wild sense in me. Oh, I got that wild sense in me. Oh, I told you I got that wild sense in me. Yeah. Take a break. He is getting a lot of key. Does he have my Evolution Z abilities? Is that why Piccolo is so hard for me? Anyway, sit down, Gohan. I'm really here more for the story than the fights, even though the fights, you know, I hope they're hard. Against the combined onslaught of Zarbon and Dodoria, Gohan and Krillin stood little chance. Man, they got messed up. How did they get out of this? The two were captured and questioned. Damn. Hey, Slick, where's Vegeta? You can find him, right? Why? Well, spin it out, or you're in for a word of pain. I don't think they're questioning Gohan right now. Okay, we'll find him. Thus, Krillin struggled to sense the energy of a traitorous Vegeta. Oh, we're snitching Vegeta out. All right. Well, Krillin's here. I don't know if Gohan died or something. I don't think Gohan actually died. I think Krillin would react to that a little more negatively. But I am curious, how do Gohan and Krillin get out of this? Thanks to Krillin's energy sensing ability, Zarbon and Dodoria have learned Vegeta's location. Zarbon, but how? Oh, damn. Too bad, Vegeta. Thanks to the Earthlings, finding you was easy. Oh, you ain't have to tell if we snitched like that.  Whoa, bro, relax. Do you intend to live in Frieza's shadow forever? Oh, Vegeta's going to talk some sense into him? New Timwits could rule the universe. Could? Hey, Vegeta's kind of like skill checking this.  Come on, Dodoria. Right. Dodoria was more shaken by that than Vegeta was. Oh my God, he is getting jumped. Why would I not lead with Krillin? No, no, this is Zarbon's story. I should play as Zarbon. Is Vegeta going to like hit hard or something? Oh, you can instantly get that behind the scenes action, Vegeta. Oh, God. Okay, so 5K on block. I'm going to go ahead and assume that he is going to hurt. Yeah, this is not going to be an easy one. This is not going to be an easy one. All right, all right. You can't science at that. 8K is not bad. Dude. Dude. All right, he only has four health bars though. If it is true that they get my techniques, I'm actually very glad I didn't give him help. Well, Zarbon died. Zarbon died so quickly. I like that Krillin is still excited to be in this battle. He's basically captured and just doing things for them. But he's excited, bro. Look at Krillin. Block that easy. Oh, no beam clash. Thank God because I was not going to win it. Let's go. Rock him, sock him, get a little 4K damage there. All right, I couldn't deflect that. He's got blasts. He's got blasts is what I'm assuming. Oh, he is kind of crazy at the dodges though. 9K. Oh, God. Oh, God.  Oh, how did I get behind him? Let's go. Step up. Solar flare. Oh, I got him looking goofy, except he found me instantaneously. But whatever, I still had him looking a little goofy. Combos. Oh, he got cooked. Wow. Thanks, Krillin. You know, once Zarbon went down, the heck she got a lot easier. Hey, I'm just bringing Vegeta into justice, man. He deserves to get snitched on. Against the combined powers of Zarbon and Dodora, even the Saiyan Prince Vegeta was no match. Yep.   Bro made it too easy. He did make a good point. We could use the Dragon Balls to take over. Dodoria, even with the Dragon Balls, you ain't doing nothing. Eternal beauty. He's doing this for eternal beauty? Huh? What's wrong, Zarbon? Nothing. We'd better get searching for the Dragon Balls. Let's go, Dodoria. Bro just wants to be pretty forever, bro. Having dealt with Vegeta, Zarbon and Dodoria resumed their search for the Dragon Balls. Hey, I don't want to ask the dark grim questions, but what did they do with Krillin? Does he just get to stay around because they're feeling nice, or did they just execute him? Oh, no, he's still alive. All right, he's still doing good. Once again, making use of Krillin's ability, Zarbon and Dodoria gathered the Dragon Balls. Oh, they needed him. Like, maybe the Dragon Radar? That's the last of the Dragon Balls. Okay, but no props for Krillin? Dodoria, I'm sorry, but it's time for you to die. Oh my God! What? Eternal beauty will be mine. Bro, just go to a Sephora, man. It ain't that deep. What? What are you doing? Oh, yes, dude. I get to... Oh, and even Krillin's gonna... Yo, I like the idea of Krillin's just like, wow, I'm game. Yeah, let's get one of you out of here. Oh, Dodoria couldn't find me. I crawled. Why does he have blue health? Hold up. Wait a minute. How hard is this fight going to be? Not hard at all, bro. They gave him no AI. Bro can't even think for himself. Look at him. Mixups.  Oh, right here. Bop, bop, bop, bop.  Those kicks in the head don't even look right. Yo, make it a little challenging at least, Dodoria. Come on. Where's the fun? Yo, somebody... Did somebody please make it a little challenging at least? Yo, this is the easiest fight of all time.  How do I transform? I really wish I could. All right, dude. Let's do a beam clash for all time's sake, buddy. Elegant blaster. Come on. I got to win at least one beam clash in this game. I can't win. I can't. Wow, that hurt. Bro, all I want to do is win a beam clash. You wouldn't think I'm asking for the... No. Bloody dance. Dance with me, Dodoria. Dance the Dance of Life. Yeah, go ahead. Sit over there and think about what you did. And by that, I mean get shot. How is he still alive? Check that. Oh, come on. I take that. And now, Zarbonne has to... And once again, Krillin has to come in and save the day. Oh, damn. Krillin, watch out. Oh, double headbutt, triple headbutt. Yo, he's kind of... Yo, he kind of has combo damage. No way. 10k off a grab. When did this fight get 10 times harder? Oh, God, I had to just shoot him. I didn't know what else to do. Oh, God. Blink it. I am not going to lose now. Zarbonne put up too much work and it would be too goddamn hard to get back here. He blocked that? Finish him, Krillin. Finish him. Yes. Okay, that got a little risky at the end. I'm not going to lie. I had to focus up. Hey, big clear. Moving on in the story. So when does Zarbonne's story... It said at the beginning, experience Zarbonne's sad story. In a surprise move, Zarbonne has turned on his partner, Dodoria. Look at this.  With this and the others in Frieza's possession, we'll have all seven Dragon Balls. We all? Yo, Zarbonne's on the team. Eternal youth and beauty will be mine. This beautiful face and body will last forever. He's kind of feeling himself. What are you doing? You can't beat Frieza, can you? Krillin, bro, let him play into our hand. They're going to start moving soon. And all the chaos, I can take the Dragon Balls easily. Zarbonne's treachery continues. All right. Well, I'm still not sure how Zarbonne's going to outplay Frieza here, but I'm interested. Let's get the rest of these Dragon Balls. What? My brother Cooler is coming here to Planet Namek? What? What is happening? It seems he has somehow learned the Dragon Balls and plans to usurp you.  Bro, look at him. In fact, it was Zarbonne who prompted Cooler's trip to Ni... But you... Wait, so why didn't we just lie? Why are we telling the truth? That's it. I won't let anyone else steal my immortality. Well, it seems there's no choice but to fight. Damn, Cooler's involved in this? The only threat to Frieza's power. Cooler arrives and quickly dispatches a messenger. Lord Frieza, Cooler is calling. He asked that you come immediately. Bro, are we going to see Frieza and Cooler fight? Let him interfere. Zarbonne, take care of this. I'm going to go snitch. Yes. Oh, I'm taking care of the messenger. We can play as Frieza... Oh, I got to play as Frieza. Hold on. Zarbonne, take a backseat. Let Frieza do this. Oh, look at little baby Frieza. Hold on. Let me get... Oh, let me get up on close personal. Oh, Frieza can't sweep the leg. Oh, yes, I can. Hey, look at baby Frieza go. Block that. Oh, I take these combos. Yeah. Oh, you know how pissed I would be if I worked for Cooler? And I was like, all right, I'll deliver a message to your brother.  Nah, I'm tired. I am so upset if I'm this guy, man. All right, let me charge up. Death Beam. Oh, I'm spoiling the Frieza saga for myself. Punishing Rush. Oh, wow. This kind of looks like bloody dance. But I got a little bit of a different cadence. And 5k damage, not bad for a messenger, if I'm being honest. Hey, hey, relax, bro. With these... All right, recover. Do I really hit him with the... All right, I'm a punishing rush him again. I was going to say, let me hit him with Frieza's ultimate. But, you know, I got better things to do. I have to go beat Cooler eventually. But that being said, I mean, can I really resist landing an ultimate? The answer was no. Death Ball. Let's go. Dang, I took out... Oh my God. This arc is happening so quickly. I'm sorry, Namek. And I didn't even hit him. What? Bro, how did he not get hit by that? Death Beam. Bro, you should have been dead about roughly eight minutes ago. And no way you're grabbing Frieza. Hold on, power scalers, get this guy. Death Beam through all that. Damn, Death Beam is broken. That move is crazy. Easy clear.  That was the easiest match of all time. Well, Zarbhan intercepts Cooler's messenger. Lord Frieza, how should I go about this? Oh, play in the role perfectly. Let's go with Cooler. Call the Ginyu Force. Oh, we are working Frieza like, oh my God. Zarbhan is an evil genius. Ignoring Frieza's orbiters, Zarbhan makes his way towards Cooler's balcony. Never mind. Bro said, call the Ginyu Force. He said, of course. I'm not doing that. I'm going to go talk to Cooler. Wow, they actually got Cooler's henchman. On his way towards Cooler's spaceship, Zarbhan encounters the elite soldier, Salsa. Your Salsa? Oh, man. You know, not to be a hater on Frieza, but I imagine that Cooler's guys are just on a different level from Frieza's guys. Zarbhan, the soldier Lord Cooler sent isn't returned. What's going on? Frieza killed him. Frieza's dealing with him. Shall I inform Lord Cooler? Oh, we... Zarbhan! Oh, damn!   Somehow, Dodoria has survived. Could this mean the end of Zarbhan's treacherous plans? That rotten Frieza, I'll deal with that traitor. What? So Frieza really is attempting a cue? Oh, we got to play this.  No forgiveness for traitors! Thank God Dodoria didn't say anything else. That could have been bad. I got to kill this guy now, bro.  I know I'm about to say something wild, but this isn't too different from, like, Better Call Saul. This is the exact same reason I like Better Call Saul. Zarbhan is gaining over his head, bro. Bro is just Nacho for it. This is crazy. This is crazy. This is actually just Nacho's story, like, 10 years before Better Call Saul was even a thing. Also, damn, I am getting cooked!  Please, Dodoria, don't make me work this hard, man. It's not that serious. Oh, God. All right, we didn't break our guard, so I'm doing good. I still have to find a way to get four health bars out of the way. I'm going to have to start cheesing. Bloody dance! Dance with me. Dance with me, Dodoria. Please! I need you to dance with me. All right, while he's sitting this one out, I think it's best to just charge up.  You got to get shot for that. If he does it again, I'm shooting him again. Oh, sorry. Sorry, man. I am so sorry, but... Oh, Dodoria, you shouldn't have tried that. Oh, my God. Oh, I'm sorry. Oh, you should have. You tried to hit me again. I'm so sorry about that. Come here. Come here. Stand up.  You should have stayed dead from the first... Oh, God. Oh, God. No. No! No grabs!  Damn it, Dodoria.  Hey, this time I'm not going easy on him, though.  I am- Oh, you are getting good! No! He had to lock on to me, so that's probably why he ran up like that. But I can't- I can't take that. Oh, God. No grabs, no grabs, no grabs. If there's no grabs, then I really have nothing to worry about. I can guard everything else. I just don't know how to- Oh! I just don't know how to tech in this game. I thought that was a gra- Four stamina bars? You broke my- Thank God, Zarbhan actually has a two-key boss move. Oh, Dodoria, you walked right into my trap! Takes hit damage.  No. Oh, God, I can't take any more failure, man. My heart just can't take it. Bloody dance! Ah, I'm getting scared. I'm getting scared, dude. I'm getting scared for even in health. I worked two goddamn hard. Okay, you might be like- Oh, God, shoot him. 14k, though. That is impressive stuff. No! Thank you. Thank you, bro. I- I really did not want him to beat me. All right, now let me get back to lying, bro. I got to make it seem like Frieza's planning a coup. This time, Zarbhan settles things with Dodoria. Sousa, Frieza's planning to attack Lord Cooler. Please, notify him. Oh, we just be lying! Of course, but what we need is- I'll keep an eye on Frieza. I'll contact you as soon as he makes his move. Hoo-hoo-hoo-hoo! Zarbhan is a little strategic genius! Thus, as Zarbhan expected, the epic showdown between brothers commenced. No way! Bro, are we about to get a cooler versus Frieza? And because of a Zarbhan, what if? These riders are spin! I need to see this, bro.  Aw, damn!  Frieza leads an invasion of Cooler's spaceship. Zarbhan tried to use this opportunity to take the last Dragon Ball from Frieza's ship, however- Oh, no. Hey, it's Zarbhan! What?  No, what are you doing here?  I can't stab your stench! Got him! What?  Bro, you gotta get the sun out of your eyes, man! You're nothing but an insect compared to me. Go ahead, Zarbhan! Talk your talk! What did you say? I don't know why my PS2 is struggling with this scene. Let me get behind him, bro. This is the old- Oh, he countered the oldest strat in the book? Block high. Yeah, you're not blocking that. Honestly, sometimes I'm not sure why they put a fight like the Dory in there, just to give us Goldo who's not even tough. Hey, I really hope I get to see Cooler, though. I wanted to see Cooler in Frieza's fight. Block that. No, I'm not blocking that. Block that. Nope, I'm not blocking that. Psychic rocked- Go crazy.  Go crazy. Hey, hey, hey! I'm not gonna lose this. Bloody dance! Oh, no! Yeah, I'm gonna go ahead and have to hit that rematch real quick, Goldo. Oh, this time you didn't counter the strat. Yeah, this time you didn't counter the- How did you roll away from that? Block that. Are you just gonna break my guard every time? Shooting star arrow. I gotta hit him with the cheap stuff. Oh, you just ran up to get your ASP! You just ran up to get your ASP! Yeah! 7k damage, yeah! Yeah, I'm leveling up.   This time I'm not taking any- I'm not giving him any mercy. I guess is what I want to say. No mercy for Goldo. I was- I was kind of laughing it off. You know, it's Goldo. I didn't really think much of him, but- You know, he deserves respect.  Off his head, he blocks that, because Zarbhan has the slowest attack of all time. Please don't hit me with that! 12k. Dude, are we being real right now, Goldo? Did you just do 12k because of a- of a few energy blasts? Bro- Sit down. Alright, it's time to cheese. If he would just stop, should stop! How did he dodge that? No! Alright, I think I might have overreacted a little bit, but I was getting tired of Goldo. You gotta understand, I- Zarbhan defeated the Ginyu Force member, Goldo, who was left to guard the Dragon Balls. What are you? You can't possibly understand my plans. First adored, and now you- There really should be a ban on this sort of ugliness.  What- What I do to you? Good lord, please. Yeah! Now, Zarbhan, make sure you kill this guy this time!  Hang on. Oh, just look at you. Bro has a very small window of people he enjoys. Zarbhan, the warrior has both beauty and ugliness. This is the root of Zarbhan's obsession. It's all going according to plan. Luck is on my side. I wouldn't even say luck, bro is playing this masterfully. Having secured all of the Dragon Balls, Zarbhan returns to the hideout where Krillin waits. Now, this is where Krillin jumps Zarbhan, and then Krillin ends up on top, by the way. That's all I need to see. Also, this is getting long. Do I have to do this in two videos? And they got a little Dende ready for this. How is Gohan still struggling to- Dude, Zarbhan must have done all of this in an afternoon. He waged a brother's war in an afternoon. Preferring Zarbhan to freeze it, Krillin reluctantly asked Dende to grant Zarbhan's wish. Sorry guys, but we've got to do something. Yeah, go ahead Krillin, I don't mind this plan. Dende summons Perunga and grants Zarbhan's wish, but keeps the last two wishes a secret. Outplayed! Eternal beauty is mine. Good for you, Zarbhan. Good luck. Gotta go. Krillin on top! Scam artist, yes!  Get outplayed, bro! Oh my God. Oh, oh no. Oh, buddy is not built for this. Elsewhere, Frieza senses Perunga's presence. Shocked, he races to the sea. We're done, Zarbhan. Oh no. Lord Frieza! Oh no! Dude, this is not good. Defend yourself, Zarbhan. Bro, what did I wish for? Yo, I'm still proud of my boy Krillin. No, he masterfully played this. It was a masterful. Krillin scamas these guys, dude. Oh, please don't death beam me again. Hey, I know you're mad, Frieza, but I really didn't even... Frieza! No, no more death beam spam.  Oh, why?  He's crazy. He's actually crazy, though. Are we seeing this? I can still win. He only has a few health bars. Shooting Star Arrow is going to be my light in the darkness here. Every time we have a question mark, we're shooting Star Arrow. What? How long is the hitbox active? That guy lives a... Bro, it goes for 6 miles. I'm... I'm cooked. I'm cooked. Zarbhan, dash up! What is... Goodbye, Krill world. Ugh! Trying to fight this Frieza in hand to hand is actually cr... Is actually just impossible.  Like, look, I'll do this. Dash up! Alright, so it actually worked there. So this is a horrible example and just means that I was... I was sucking. So that's humbling. No, no, no, no, no, no, no, no, no, no, no, no, no. Let's not do that, Frieza. Let's not do that. Let's not do that. Come on. Come on, Frieza. Oh! Another opening. Oh, I can't believe I missed my... Shooting Star Arrow! That was just... Oh wow, I dodged it. I'm not actually that pissed anymore. Sorry. Sorry, I yelled at you, Frieza. I really... Whoa! Oh, Psycho Kinesis. Something tells me I'm cooked. Buddy thought he had combos, though. No, no, this can't be happening to me. I blocked it with literally one HP and a dream. Is it possible? One HP and a dream. Let's make the impossible happen. Let's do it. Let's go! I can't even see my HP bar. I am him! Never try me again, Frieza. Three attempts. That's all it takes. Zarba had gained eternal youth, but this was little comfort in the face of Frieza's might. His strength... It's unbelievable. No. I am the hand that feeds you. I can't believe I was fooled by such tricks. I'm sorry, Frieza. I just want it to be young forever. But... I can't die. Eternal beauty is mine. Go for it, Zarbaan. Fool! Appearance means nothing when you no longer exist. What? Oh, no. Just then, Goku arrived on...  We forgot to tell this guy not to come! Oh, no! Just then, Goku arrived dynamic, powered up from his training at 100 times gravity. Is that the one the Earthlings were talking about? Is that Goku? Why did we not tell this guy not to show up? Look, even he's confused. Hold on. Where's Krillin and Gohan? Hope seems lost for Zarbaan when the hero Goku appears. I can't sense Krillin or Gohan. What's happening? Bro, nobody told him not to show up. That's crazy! Help me! Oh, they're not here anymore. They went back to Earth. He's pretty calm for a guy that got scammed. I'm not sure what's going on, but that's the bad guy called Frieza, right? Yes, bro, and you stand no chance without your Zenkai boost. Please help me fight him. All right, I'll help. Garbage, huh? This is really starting to irritate me. Isn't your brother Cooler supposed to be spanking you right now? I mean, I'm going to start with Goku. I'm going to be honest. I'm going to be honest. I'm going with Goku. See, the thing is, is my Goku's action... Look at up it!  Sweet delight because I can't extend the combo up to... Dodge that!  I'm less worried because this is basically the same fight, but now I have Goku. Psychokinesis! Oh, but this was still cheap. Even in the last fight, that was cheap. Kaioken! I don't know where my friends are. I don't know who left. I don't know why the Dragon Balls aren't here anymore, but I know that I have to fight because this guy told me to. Shout out to Zarbonne. Come on! Dodge that! It was a little... It was a little terrifying to dodge that, but we still got it done. Sweet delight. I'm not playing with Frieza no more. Give me your energy! The hopes of this planet last with... Oh! I'm mad. Everybody just left Goku here, man. Oh, ow! Ow! Davey's slapping me! This isn't my fault! Hell no. Oh, he actually died to that. Pathetic! Hey, all the Zeddy in the world is mine, baby! Working together, it seems Zarbonne and Goku are in an even match for Frieza, however. He sure is strong, and he's not even using half of his true power. Bro, are we trying?  Oh, we're cut. Bad Earthling. Now perhaps you'd like to witness my true fall. How is this true though? Because Goku only got to fight Frieza in his final form. Wouldn't Goku even just fresh off the ship? Wash baby Frieza? Power scaler's comment? At that moment, Frieza received word from his henchman that Cooler was on the move. So, please buy it. Oh, we definitely have to escape. Frieza rushes off to face Cooler and asks for Zarbonne and Goku. We need to get out of here, man!  What do you mean, ask for us? We have no reason to be here. This is a tag team I never thought I'd see, by the way. Look at these two. What a dynamic duo. Man, their energy is incredible. I'm not sure I can handle this. I'm not sure I'm built for this. Use a spaceship to escape from Namek. True, let's get out of here. That might be our only choice. We gotta go, bro. Zarbonne and Goku made their way to Goku's ship in an effort to escape. However, you will get it, Zarbonne. Zarbonne, you need to learn how to finish your goddamn food. You, how dare you?  Somehow, Dodoria and Goldo had survived. The two most nobody losers I've ever seen, by the way. Look at this.  No, dude, I can't. I can't believe we're fighting these guys again. Zarbonne, kill them.  And now Goku's here, too. So of course it's gonna be like, no, Zarbonne. They can't fight. They can't fight.  Bro, these guys will not die. Thank God they don't have the Zenkai boost, bro. They'd be unstoppable. These guys would be freezing level. Honestly, even just talking about it, they should be out on the front lines. If they're this tough, they need to be helping in the war against Cooler. Of course, Dodoria still hits like crazy for some reason. I'm just gonna block it. Kaioken. Even if I do have to take 8k on ship damage, I'm still gonna win this. Goldo I don't think is gonna be as strong. So that's kind of the thing keeping me going right now.  No, grab. No, low. There we go.  Well, thank God he didn't grab. I'm actually glad he canceled that out. Dodoria's grabbed this 10k. Uh, uh, uh, uh, uh, uh, huh, hey, hey, hey. Every- every bot in the game just blinks the beam. If you do not have them distracted or if they're not like key charging already.  Don't grab me. Don't grab me. Huh. That might be even worse than grabbing me. Nope.


Good evening. I hope all of you are able to hear me. I am Akhila. I work as a solution architect with TCS and today I would be presenting the application that we have developed on OpenStack platform for NFV. So what is this application about and what have we done? This is a framework that enables validation of network functions and what we mean by validation is to validate reference architectures, functional verification, verification of the various life cycle events that a virtual network function or probably a service that comprises of multiple virtual network functions goes through and also some real-time diagnostics which would help the person who is using this framework who's actually testing his solution to simplify troubleshooting and debugging. So this is a platform that we are talking about. Of all the list of features that I mentioned, we'll first look at how we are deploying the service. When we talk about deploying a VNF or a network service based on these VNF, they are a few important phases that we look at. It starts off with onboarding the network service wherein the configuration of that network service is captured into predefined templates like the network service descriptor which gives a high level overview of what all components are there in this network service, what are the different networks that are there, what are the entry points into that particular network and what are the different flavors that are present on this particular network. The next phase is the deployment which is probably the most complex because it involves coordination across the different layers likewise the NFA orchestrator, the infrastructure manager, your virtual network function managers and the VNF itself. In this phase the service is brought up with day zero configuration. The next step is or one of the important things is monitoring service for various aspects whether you want to understand if you want to scale your service or if you want to recognize a fault through monitoring you can do it in this phase and the update where we are referring to the configuration updates of the network services only not software updates and the final phase is bringing the whole thing down cleaning it up so that resource consumption comes down to zero. So, this is what we mean by end to end service orchestration. This is a high level reference architecture of the solution that we have built. So, we have you see a big blue box here marked as VNF SVC. This is centralized them in the trans on the open stack controller it provides the REST API and it is responsible for onboarding. Now, what are the different things that we do when we onboard a network service? The descriptors are given to this component it acts like a typical compiler. So, it understands each and every aspect of these descriptors converts it into metadata and puts it into its internal repositories and why do we do this because when we are asked to create a service we save a lot of time by defining it in a format which will give us data readily to be deployed on open stack. Now, when we talk about onboarding the descriptors though Tosca is a well known format there are also existing service orchestration solutions. So, you might need compatibility. So, what we have done is we have implemented a plug-in based interpretation of these descriptors. Reading the metadata in the descriptors we understand how this particular descriptor needs to be onboarded and the right kind of translator is invoked to convert this descriptor into metadata that is a first phase and also some preparatory steps like onboarding the images into glance and also computing the quota requirements for deploying various flavors of the service these kind of things are done during the onboarding of the templates. Once the onboarding is done you have your service in your catalog and you will be able to deploy it. In the next phase when the user requests for a deployment either through a REST API or through a CLI, VNFSVC coordinates all the different components that are involved including your open stack, the VNF managers and pushing configurations and everything is coordinated by VNFSVC. It derives the deployment order because services are not a flat deployment. You can't just run the VMs anything at any time. They are interdependencies that could exist between these virtual network functions. So, this information is derived by this component and then it ensures that these virtual network functions are deployed in the proper order and one simple use case is suppose I am deploying a network service which has a node that distributes IP addresses to each of these each of the other VNFs then that is a node that should go in first and that the configuration of that node or the IP address should be passed on to the rest of the VNFs that is one use case. So, when we are deploying these VNF we are able to dynamically extract the data typically you would hard code or preconfigure such parameters which is not required if you are able to extract it dynamically during deployment. Once it starts of deploying at least one VNF it triggers a launching of a VNF manager. The way we have implemented the VNF manager or probably first I will talk about the requirements that we have for a VNF manager because we are talking about a platform where we are able to validate any third-party VNF. It should be possible that we should be able to talk to them. So, this VNF manager is more of a framework and you see small rectangular boxes on this VNF manager these are what we refer to as drivers. So, this is like a framework which loads the required drivers that it needs to talk to the VNFs in that particular service and we have well defined API that needs to be invoked. For example, when a VNF is first launched the initialization API is what you would look at and when you want to update a configuration a similar API and on the other side it could be any protocol that runs on L3 likewise a netcon for SNMP or anything that is internal to the driver. Once the VNF is launched that is you can have a prepackaged VM like a firewall or you can have something where you need to go and install the software on top of that. Either of these configurations once it comes up the VNF manager pushes the DayZero configuration onto the VNF. Now, this is repeated for each of the virtual network functions in the service and the service is brought up. This is what happens in the deployment phase and the next one is the update. There is an API that or rest interface that we provide for being able to update the configuration on the VNF. The decommissioning is also I mean it is a process of cleaning up things so it keeps track of whatever resources it has consumed and make sure that it is cleaned up. Now, one aspect is monitoring what exactly do we refer to by monitoring where this is the phase where we are trying to understand what is the load on the system or derive a performance matrix which gives us some indication about what is the state of the network service. It could be based on CELOMETER but sometimes you would require some more information. It is possible to extract this from the VNF through the VNF manager and run it through an algorithm and this algorithm is not standard. It differs based on the service that you are deploying. So, we have a pluggable KPI algorithm. We have few predefined ones but it is also easy to add new ones because we are trying to validate fetch the value of this KPI and expose it. You can read it through a rest API and based on this KPI value you can trigger scaling. There is API also available for scaling. You can scale using REST, I mean OpenStack API also. So, why do you need a separate API for scaling the VNF? Because VNF scaling is not just launching a new VM. It has to go through the entire process that happened when you were creating the network service. It has to be configured. It has to be loaded with the right kind of software. So, these are the additional steps that go in. Of course, launching the VM is done through OpenStack API only. But the rest of the stuff is implemented by the higher layer which is your VNF SVC. This is the overall reference architecture of the OpenVNF manager and you will be able to find it on GitHub. I will probably run through a quick demo now so that we can relate to whatever I have explained. It is a recorded demo because it is quite lengthy. So, this is a setup that we have. Whatever framework I was talking about is deployed on a VM because this can be quickly created. We have a simple CLI for deploying this framework because this is supposed to enable full automation. It can integrate either with your CI, CD solutions, your DevOps or into your existing system verification suit where you are able to enable the orchestration and also reuse the test framework that you would already have because IMS has not inherently changed. The way you validate IMS has not changed the functional verification part. What has changed is how you actually build that IMS service is what has changed. So, you can even integrate it with your existing verification solutions. And we are using a third party traffic generator from Terra VM for executing this demo. So, we are triggering the service creation where we are onboarding the network templates and these small blue bars that you see here is what we refer to as event notifications. Now, when you deploy a service, it takes quite a good amount of time. And you would have to understand what exactly is going on in the background and you would also need updates on the nodes as and when they are deployed so that you can extract that configuration and use it for configuring the rest of the system. That would save you a lot of time. So, we have an event framework which gives you continuous notifications about the state of the network service as well as the metadata whatever configuration has gone into that network service or any such information and we are demonstrating the deployment of a clear water IMS here. So, you see that the nodes are coming up one after the other. Once the network service is deployed, it will trigger the traffic generator which is the Terra VM. It will configure the Terra VM to speak to the right node which is the SIP proxy and Terra VM will be able to kick off the test verification for SIP likewise registering the users making calls between the different users and getting the results. So, this is the Terra VM solution. This is also running on the VM which has just been deployed and you will see that the configuration will come up. It is coming through the test framework all this configuration and it executes the test cases. Once the test execution completes you will see that it will also perform the cleanup and it will log in the results. Yes, it has cleaned up everything and a few of the data is reported. Apart from this, the other aspect that we are working on for which I don't have a demo ready is the diagnostics. What do we mean when we say diagnostics? We mean that we are looking at capturing network traffic, correlating it with what exactly we are doing at that point of time and giving some meaningful result on the screen so that the user is able to understand what is happening. If there is a failure, he will be able to derive some sort of a conclusion from it which will help him in troubleshooting. Now, for diagnostics, there are a couple of things that we had executed. We used Ansible to deploy TCP dump on the host interfaces, capture that information, then analyze it and show it to the users, but that is very, very offline. It shows data very lately. So, what we have done is we have used this feature called tap as a service, which is available in OpenStack. It gives you an API which enables you to mirror the traffic that is going on to a network interface. We have built a small packet analyzer based on DPDK. This pulls in the network traffic. It quickly segregates it. We pick the packets that are of interest to us, wrap them up with the right information that the user is ready to see because we don't want to throw a full packet starting from L1 to the application layer to the user for debugging. That really doesn't help. So, we pick up whatever is relevant to that test scenario. So, if it is a SIP protocol that we are doing here, we can configure that analyzer to give us SIP messages from specific nodes. We do that and then we pass on this information to the user who is executing the test case and this is more real-time than what we could get with a TCP dump. So, that is one other feature that we are working on. So, that is pretty much what I have to share today. Thank you.


Okay. Hi everyone. Good morning. So, as Eleanor said, Tiago and I are presenting on using Linux as a secure boot loader for open pass servers. So, we both are from IBM. We work for Linux Technology Central in IBM and both of our contributing to the kernel. This is a disclaimer to start with. This work represents a view of the author that is both of us and does not necessarily represent the view of IBM. All design points disclosure in a subject to finalization and acceptance and they may or may not be the part of the final product. Less of the things as there. Okay. Here is the agenda. We will start with the secure boot goals and requirements as per open pass. And to satisfy those requirements, we are trying to see what the existing mechanisms in the kernel which we can reuse. There are some gaps in that and we will talk about them and we will also talk about our proposed solution. Then finally the patch status and the summary. Okay. To get started. So, secure boot goals and requirements. I assume here everybody would be knowing about secure boot and we have heard about it either in other slides or in the previous LSS.  It is a protection against boot kits and the root kits. And it is basically to make sure that any firmware or any operating system you load on the server is basically verified, genuine, and from the owner as you expected. So, this is the same what we are targeting. It's for the open pass secure boot solution. The second thing is it's also a requirement for the standards complaints and two of them as I listed. This SP 8147B and common criteria OSPP 4.1. Okay. I'll first start with the open pass secure boot high level overview. And then we will see what problem actually we are focusing into the whole solution. So, here is the firmware secure boot and OS secure boot as you see. Okay. The open power, the root of this, it starts with the SB, which is basically a sign of tested code embedded into the hardware. And, okay, sorry. I think my hands. Yeah, embedded into the hardware and from where the chain of trust actually starts. As I told, every in secure boot, every image before loading the next image is supposed to verify it. And that is what is done. The SB verifies the host boot. Host boot verifies ski boot, which is also called as OPAL, and ski boot verifies the boot gunner. These are the part of the firmware and they are stored in the process of flash as a signed firmware containers. These signed firmware containers are actually the headers which are prefixed before the images and they have a defined format. It's that the overall secure boot perspectives are being discussed in other addresses and we are not going into details of that. This process of flash is not locked, so we protect the signed firmware containers via TPM. Now the next point comes is the OS secure boot. So once the boot loader is there, boot kernel is there, it needs to load the host operating system. The open power boot loader is actually a kernel based loader, which is a petite boot. It's a user-specific application running on the kernel, which loads the kernel images from differences options and then Kexecute as a host source. Today's discussion is actually about making sure this part from the boot kernel to the host source verifying the kernel images, which is the requirement for as part of end-to-end secure boot solution. So getting into the boot loader details. So as I said, it's a Linux kernel based boot loader and petite boot is the application which does the Kexecute. It can load the images from different mechanisms, either as a network from local days, Clemson, etc. And then the host source can continue the chain of Kexecute, which is common for any other Linux possibilities. So requirements. Okay, we need a verified kernel that is a requirement, core basic requirement for the secure boot. This kernel can be fetched from any multiple ways and we have to make sure that whichever way we get the kernel, it should be verified before loading. The second thing is that the secure boot solution, basically a system can be in a different mode as part of the secure boot also. It might be in a setup mode, which may not require you to do the verification. It might be in the audit or user mode. The user mode enforces that you verify everything. And the audit mode tells you to do the verify. But even if the verification fails, it allows you to boot. It just logs that the verification has failed for later analysis. So these different states of the secure boot needs to be honored. The policies as per them has to be honored. Then you need the firmware key support. It is possible that your firmware is signed with a set of firmware keys and your kernel image is also signed with the same firmware keys. For example, DB, KEK keys. So it is required that the kernel can verify the boot loader, can verify the kernel using these firmware keys. Maintain the secure boot policies across the Kexecute. When the kernel does the Kexecute, it can change the boot parameters option. So it is possible that people can try to do overriding. So what is required is that based on the secure boot state of the system, these policies should be maintained across any set of Kexec chains. And we need that the Kexec load is disabled because Kexec load allows unsigned kernel images to be loaded. And the last thing, as I said, as shown in my first diagram, we actually divided it into two domains. Firmware and the operating system secure boot. Because the OS secure boot kernel images can come from various options, but firmware is from the platform owner. So it is possible that sometimes you distrust, might want to load unsigned kernels for backward compatibility, but then you don't want to disable the whole secure boot solution. So your firmware secure boot is still enabled, but it allows unsigned kernels to be loaded. So that is the last point. So the thing is, we need this for our last stage of loading the hostOS. And we have a kernel-based bootloader. So the point is, can we use something which already exists in the kernel? And from yesterday, today, and all of earlier discussions, people know about integrity measurement architecture somewhere. So we consider this as a possible solution. Tiago will discuss about that. Okay, hello. So AIMA, as we have seen here today and in other presentations and conferences, AIMA is a major subsystem in the kernel being used in production. So we turned to it to implement secure boot. It can be used to enforce the secure boot rules that we want. So how does it work to have a secure boot implemented using AIMA? When the bootloader starts, it has to check the secure boot state, which can be audited, our setup, our user mode. And depending on that, it will load the firmware keys to the kernel key ring. And we'll load the policy that will enforce the secure boot settings of the firmware. And finally, it will be ready to verify the kernel before allowing it to be loaded and booted. So, well, I will not spend a lot of time with AIMA basics. We had talks here about that already. Basically, we have three operations in AIMA, measure, appraise and audit. When you measure, you can also start the measurement in the measurement list, as was said before. And at the top here, we have an example with AIMA policy with three rules. The rule in the middle here is the one we are most interested in for secure boot. It appraises the kernel that is loaded via a KSEC file load. And the argument here appraised type equals AIMA sig is telling AIMA to verify a signature stored in the file. So, how do you do that? You have to use the AVM CTL command, which will add the security dot AIMA extended attribute that extended attribute contains a signature in a very simple format as can be seen here. And with that, AIMA is able to retrieve that signature and verify if the kernel is correctly signed. So, if this works and it does, then what's the problem? We found three issues that we solved and we are going to expand on them during this talk. I will explain the first one and Nina will go into more details on the next two. So, the first one is related to the use of extended attributes. It's a very common method when you boot your computer that you fetch your kernel from the network. And some methods of booting via the network, they will not allow extended attributes to be fetched. For instance, HTTP or TFTP or even local file system, some file systems used for USB keys. For example, they don't support extended attributes. So, we need to support secure boot even in those scenarios. So, this is a problem we have found. So, well, just to reinforce, these are examples of boot methods that Peteyboot allows. They're fairly standard in bootloaders. Some of them allow extended attributes, some don't. So, our solution involves embedding the signature in the file. The kernel has a method for that already for module signatures. There's a kernel feature where you can require that modules are signed and only sign-in modules can be loaded. And the format of the signature is very simple. You just append at the end of the file this structure which contains a pkcs7 message with a signature. This suits us because the PowerPC kernel is an elf image as well. You can append contents to it and it will still be usable. That's what we decided to use. There's a tool already in the kernel script slash sign file that performs this step. So, that's what we use. When we added appended signature support to AIMA, we wanted to do it in a way that's backwards compatible in the sense that if you already have a file that has an extended attribute signature, nothing will change if that file has an appended signature as well. So, what happens is that if there's no... Well, the first step is there's a new argument you can pass to the appraise rule which says to AIMA that it can expect a modcig. We allow it to use a modcig to verify the signature. And if you have that and there's no extended attribute signature in the file then, of course, AIMA will look for an appended signature and try to use it. And the other case is if there is an extended attribute signature, but the signature is signed with a key that the kernel doesn't know about. It's not present in the kernel key ring. So, in that case, it will ignore the extended attribute signature and also look for an appended signature in the file and try to use it to verify it. So, even though secure boot is not about measurements, there is an interaction with measurements that we found that we had to address. So, I'm coming back to this measure step and storing it in the measurement list. Just an aside, the rule in the middle has the setting that I mentioned that you can add. In the appraise rule, you can say appraise type equals AIMAcig or modcig. Then you are telling AIMA that it can use a modcig if there is one. So, before I talk about our issue, how does AIMA know what to put in the measurement list? It has a concept of an AIMA template. The AIMA template tells it which information should be added to an entry in the measurement list. You can use template fields for saying that you want to store the digest, the name of the file, and if there is a signature, a signature as well. So, there are some predefined AIMA templates, for instance, the AIMA-cig here, which includes the signature. In that case, you have a measurement entry like this one. Just to explain a little bit, the first number here in yellow is the PCR. The TPM PCR that is extended with this measurement then follows the contents of the PCR at the time of this measurement. And then you have the template that AIMA is configured to use. In this case, AIMA-cig, which as shown on this slide, tells that AIMA should store the digest, the name, and the signature of the file. So, that's what follows here in blue. This is the SHA-256 digest of the entire contents of the file that was appraised, the path of the file, and then at the end, the contents of the security.IMA extended attribute containing the digital signature. So, one property of these that is very useful is you can, just with this entry, during audit, for instance, know whether the signature is valid or not for this file. The digest of the file is the digest that is used in the signature to validate the contents. So, with this digest and this signature, you can say whether the signature was valid or not when the file was appraised. The problem we found is that when you append the signature at the end of the file, you modify the file contents, obviously, and with that, the digest of the file as measured by AIMA is not the same one that was used to sign the file anymore, and you can't, at a later point, verify whether the signature was valid or not. So, we solved this by introducing a new template field called d-sig, which tells AIMA to store not only the, sorry, it tells AIMA to store the contents, the hash of the contents of the file, but ignoring the appended signature at the end. This field, this hash then is the one that is expected to match the one in the signature, and here in this example, we see at the end of the file the contents of the appended signature as well in the entry, and with that information, we can once again verify that the signature is valid or not when the file was appraised. One last point that's also not directly related to secure boot, but important in our use case, every boot is a KSAC in open power, so if you want to verify the contents of the PCR registers in the TPM, you need the history of measurements that were made because when you KSAC and you kernel, the TPM is not reset, so the PCR contents are not reset either. You need the history of the measurements in the new kernel to know whether the PCR values are the ones you expect or not. Also, you need to know at which boot, which kernel each measurement corresponds, so you have a measurement you want to know if it was before a given KSAC or after a given KSAC, so you need a marker for the KSAC event, and IMA has the boot aggregate that serves that function. You have one boot aggregate per KSAC that you perform, and lastly, you also need the measurement list passed to the new kernel because the act of performing a KSAC file load itself generates new measurements and you want them passed on so that you can verify the TPM PCR values. So we have a feature already upstream since kernel 4.tem on PowerPC where when you perform a KSAC file load, the kernel will serialize the IMA measurement list into an IMA KSAC buffer and pass it on to the next kernel. Then the new kernel will detect that this buffer is there and will load the measurements into its own measurements. Sorry. No problem. Sorry, I think I'm talking too much. But I'm at the end. So these summarizes how we solved the first issue that I mentioned before in the earlier slide. It solves our problem with extended attribute signatures by using the module signatures. So now, Naina will talk about the other points. Yes. So if you remember from the Mimi's slides, there are three things required for the IMA present. First is signature, then the keys and the policies. Now, we have the kernel with the signature, but we need the keys to verify those signatures. And as I mentioned that one of the requirement is that it is possible that you get the firmware keys to be loaded. The kernel images might be signed with the firmware keys and we need to load these firmware keys in the kernel for verifying. So what's the problem? There exist key rings. Yeah, from David Hall's presentation, people might have an idea about key rings. So there exist key rings and dot IMA and underscore IMA. Like it is used by the IMA for appraisal. So store these keys into the, store the firmware keys into these key rings. But what is the problem? Let's see. Dot IMA actually accepts only the signed keys. And these signed keys are watched by the keys which are present in the dot secondary and the dot built-in trusted keys. And the point is that we want to emphasize is that the dot built-in and dot secondary should have only, are actually accepting only signed keys. That is because since they are watching the keys, if they are unsigned and if somebody puts an unsigned malicious key, they might end up watching most of the other malicious keys which are there in, which may be loaded into the dot IMA and can be used for the IMA appraisal. So this is the like dot secondary and dot built-in that's to expect only the signed keys. And the same that the dot IMA then needs the keys which are signed and watched by these two. Underscore IMA is the one which is the user's defined key ring. And it can accept the keys which are unsigned and generally loaded, typically loaded in the MFS before the system privates root. The second key property is the modifiability. The built-in trusted keys are actually compiled in time you define, you add the certificate. But the other keys can be modified via the user space. And the scope, the limited and broad. So the, as I said, the built-in and secondary keyings are used for verifying other keys or for the model signatures. That's the only purpose for them. So that's why we say scope is limited. But for the dot IMA and underscore IMA, keys are used for multiple purposes. So now if we see and if we need a firmware keys to be loaded, what is the requirement? Keys come from the firmware. The first question is, does the kernel trust the keys which are coming from the firmware? So you can also see in another way pre-boot keys or the post-boot keys. That is one thing. Second thing, since the keys are provided by the firmware, we would not want any user to be able to modify them. And if we try to match, none of these actually are satisfying this. So I need a compile link here loaded from firmware. But the kernel may not trust them. And also, the firmware keys may not always be signed. So I may not be able to verify their signature chain of trust. Secondly, these are used for, the scope is only to use them for the kernel image verification. And they should not be user-modifiable. Now, if we, so that's where to satisfy these three requirements. We propose a new key ring, which is called the platform keys. And the purpose of this is that you load the firmware keys. Basically, you need to provide an isolation. The kernel has to isolate the keys provided by firmware, which may be unsigned, and the keys which its own provides from the kernel itself and which it trusts. So this platform key ring, the purpose of this is to provide that isolation between the untrusted firmware keys and the trusted keys. It can be loaded either the compiled in time as a single certificate or loaded from the boot time. These accepts unsigned keys. They need not be satisfied any chain of trust. And then the node-modifiable, they should not be overridden by user-respect. So basically, these keys, once loaded at the boot time, nobody can change them. We can enable this by a config option, config platform key ring, and config platform trusted keys. So here is how it looks like. Dot platform keys, it has the same permission as the dot built-in because it doesn't, it need not be modifiable by user. And yes, that's what they think. So this actually provides a, it allows us to use the firmware keys, which comes from the pre-boot time, may or may not be signed to be used by the bootloader for the kernel image verification and only for the limited purpose of the kernel image and are not modifiable by user. And that's how we solve this problem. The second thing, so again, the third thing which is required for the appraisal is the policy. AIMA will do the appraisal only if there is a policy defined for it. And we need KXK kernel, check is the existing policy rule which can be used for the kernel image verification. But what's the problem that's discussed there? These are the default policies. These are the existing policies available now. The upper two are more of default policies for different purposes. Our focus is more on the secure boot and the secure boot specific policies which has a KXK kernel check. So the last two does that. The secure boot policy is defined as a boot parameter and it can be overwritten by the user space by writing it to the syskernel security AIMA policy file. This is not preserved across KXK because I might have loaded my host source with the boot parameter secure boot, but I can do another KXK without this parameter and there are no secure boot policies anymore. The second option to fix this, the next option that comes is the build time policy so that it cannot be modified by the user. And so here, these are defined at the compile time. This has come recently, so these are defined at the compile time. We have to choose them as a config option. And they are same policies defined with the KXK kernel check as secure boot. They are not custom-modifiable, but the problem is these are hard-coded. Once it's built, it's returned, it's built into the kernel, it's built. Those won't handle the secure boot state of the system because that is what we need. We need something with this runtime which at the boot time understands the state, secure boot state of the system, whether it is an audit mode or a user mode or a setup mode because the setup mode may not need any verification, but the user mode needs verification so it can define the policy, it can check the policy accordingly. It should not be custom-modifiable, nobody should be able to override it and it should be preserved across KXK. Since every KXK will actually should be checking the secure boot state and accordingly defining the policies, and the state of the system will not be changing, so that way it can be preserved. So to handle this, we propose another policy called architecture-specific policies which can be defined specific to each architecture based on their requirements and these are loaded at the boot time. These are based on the secure boot state. They are of the highest priority. If these are defined, no other policy will be overtaking them. These are the ones which are given the priority. They cannot be overdone by boot parameter because these are specified at the runtime. No boot parameter is required to define them. One more thing is there is an IMA press-type flag. You can make it... the IMA press-type can be used as a log and force or fix. So I might have defined the policies, but if I make the IMA press equals to fix or log, I can still boot an unsigned tunnel. So this flag has to be very carefully used along with the policies. So when the architecture policies are enabled, the IMA press-type option, boot parameter option is disabled so that it can be configured again at the runtime. This option can be enabled by IMA ARC policy. Here I'm showing an example of the policies as we are considering for the open-power solution. For the setup mode, we do want to do measurement, but we don't want to do the appraisal, and this is where it's the... don't appraise, but for the audit and user mode, we want to do both measure and appraise. So based on the secure boot state, the runtime, the code will actually load one of these. So we started saying that IMA can be used for this in a generic way, but we found some problems. We just talked about the solutions for those problems, and if we combine them all together, here is how you see the solution of it as a complete work. The boot kernel is loaded. It checks the secure boot mode of the system. If it is in the setup mode, we don't need any kernel verification. So no keys are loaded onto the platform key ring. No policies are set, but if we get into the audit or user mode, we need the keys, so we load them. We need the keys from the platform, so we load them to the platform key ring, and now these keys are locked. Nobody can modify them later, and these are isolated from other keys of which the kernel uses. These are specifically available only in the platform key. If it is in the audit mode, the policies for audit and the user mode are the same. The only difference is the IMA press flag is logged for the audit mode, but in case of the user mode, IMA press flag is enforced, because here we want to make sure that if it fails to verify the kernel, it just doesn't boot. Then we have the keys, we have the certificates, we have the policy, and the petite boot fetches the kernel image. It verifies the appended signature. We have the appended signature on it, so it verifies the appended signature, and if it is verified, then host service is loaded. This is how all three solutions for those developments combined together gives us a complete solution. Here is the patch set status. We talked about three features, appended signatures, platform key ring, and architect specific IMA policies. The two patch sets IMA support for appended signatures and the platform key ring are awaiting the acceptance. They are posted and are available on these reference links. For the IMA support for architecture-specific policies, we are soliciting acts and reviews for the ecetistic-specific patches, which we have in that. Then the carry IMA measurements file across Kexec is already up to stream, as Tiago mentioned. Then the loading keys into the platform key ring, these are based on David Hovel's patches, his patch set keys, blacklisting and UEFI database load. We have used two patches in that, like add EFI signature data types and add an EFI signature block parser because OpenFAR also uses the ESL format for the keys. This is a work in progress, and the power-specific art policies is the work in progress. In summary, IMA provides the kernel-based solution for verifying the hostOS to give us a secure boot solution, I mean as part of our end-to-end solution. We had three problems out of it for the key ring, for the signature, and for the policy, we fixed them by introducing platform key ring, icon-specific policies and appended signatures. We have the patch sets either in the state of up-streaming, awaiting acceptance, or awaiting reviews or work in progress. We welcome the community to test them, give their reviews back, give your inputs and feedbacks, whatever you think about those. And this is where I have the demo for these patches. If anybody is interested, I can show that later afterwards. These are the references, and this is acknowledgments for our team who had worked, the IBM LTC security team who is working, and we work in collaboration with the security research group, and the IBM Power Security and the Power Formula team. Yes. Questions? Could you give us some more details about key exacting crash kernel and signing its user space? So, what details do you need? Actually, key exact is very often used to launch a crash kernel, which is able to export the memory of your crashed kernel and use PROC VM core to dump its memory. Is it somehow affected? And there are two, in this, so basically the key exact file load is doing the signature verification, and then in order to, and there are two patches in this patch set which disable key exact load as well. If you have the IMA policy, then, and you're using the, and you're using the IMA signature verification, then it will prevent the key exact load. But if you're using the regular signature verification, kernel, the architecture specific one, then if you're not in secure boot mode, it won't disable the key exact load. So, it depends if you're in secure boot mode or you're not in secure boot mode. Right, that was the compromise. No questions? If not, let's thank speakers.


Okay The next slides Our next speaker is this is the technical problem session This TCC community is trying to meddle with us Our next presentation is going to be a greater gift Struggling gift against statistical cryptonosis by link soon Bartoneel way Wang and making Wang and Ling is going to Present by recording Hello everyone the name of the presentation is a greater gift Strengthen gift against statistical crypt analyze We start with the motivation of this work The work in this paper is inspired from the automatic searching results Related to differential and linear crypt analysis of gift 64 We first look into the sufferer in itself and try to discover more properties Apart from the quantitative information about activist boxes differential probabilities and linear correlations In the second part Given the gap between the upper bounds on the differential probability and the linear correlation We wonder whether we can find a violent with analogous security levels under the differential and linear settings Now we briefly reveal some preliminaries Gift is a family of led with block suffers proposed by panic at all We consider gift 64, which is a 64-bit block sufferer with 128 bit K and with 28 runs each round consists of three steps The sub cell operation applies on an invertible 4-bit S box to every neighbor of the suffer state Then the perm bit operation permutes the state in a bit oriented manner Following that the upfront K operation as the round K and the round constant Gift was designed at 10 years after the publication of present It has much increased efficiency in hardware and software implementations And this is realized by using an S box with a lower implementation cost At the same time to avoid consecutive one-to-one bit differential and linear transitions in the sufferer The design of the bit permutation is carefully studied The 16 S boxes are grouped into two different ways The first one is the quotient group and the second one is the reminder group With this notation the design of the 64-bit permutation is converted into the construction of four independent and identical 16-bit permutations That maps the output bits of the quotient group to the input bits of the reminder group The BODF paradigm is a guideline for the creation of the 16-bit group mapping It considers the one-to-one bit DDT of the S box and Sets the input and output positions into four sets Notice that a bad output could come from a one-to-one bit transition through a certain S box in the current round To ensure that the exciting one-to-one bit transition will not head to another one-to-one bit transition In the succeeding round the differential BODF permutation artificially maps the active bits of the potentially bad output To an active bits of some good inputs in the next round Similarly in the linear case the linear BODF permutation can be derived regarding the one-to-one bit LAT The BODF permutation should be differential and linear BODF permutations simultaneously Forgift the BODF permutation is fixed as the identity mapping Now we introduce the first part of this work and give theoretical explanations on differential and linear properties of gift 64 Through analyzing the automatic searching results related to differential quick-analyze We observe that the minimum number of differential active S boxes SD is linearly dependent on R for all R greater than seven Further after decoding the optimal differential characteristics With the maximum probability from the output of the set over We observe that the optimal characteristics covering more than seven rounds always have two active S boxes in each round So we wonder is there a characteristic with a single active S box in some rounds achieving the maximum differential probability To answer this question we first consider a small set of differential characteristics D1 the characteristics in this set have at least one round Activating a single S box and the input difference of the active S box equals one They managed to calculate a lower bound on the number of active S boxes for characteristics in this set The automatic method is applied to accomplish this task and We split the search into three steps In the first step They explore the lower bound for characteristics with input difference having a single non-zero label being one then the characteristics with output difference having a single non-zero label taking one are considered In the third step, we note that the characteristics in D1 can be created with the characteristics in the first two steps So the lower bound for characteristics in this set is derived from the experimental results in the first two steps The experimental results reveal that the lower bound on the set D1 is strictly here than the original bound when the number of rounds is greater than seven The same results hold for all set DI without taking any non-zero label So we draw the first proposition If are greater than seven the optimal iron differential characteristic of gift 64 With the minimum number of active S boxes must have two active S boxes in each round Then with a similar analyzing regarding the differential probability we give the second proposition If are greater than seven the optimal iron differential characteristic with the maximum probability must activate at least two S boxes per round Now it seems that differential characteristics activating two S boxes in each round There is a crucial rule in the security evaluation for gift 64 So we wonder whether we can involve more properties of this characteristics apart from the quantitative information about active S boxes Before looking into this characteristics They first devise an alternative description for the round function In the alternative description, we keep sub cells and add round K operations and further decompose perm bits operation into two sub operations the group maps operation evokes a 16-bit imitation and independently applied it on each of the quotient group The following trans-nable operation works in label This alternative description is called a beta-oriented one If we recognize the separate state as a four multiply four metric of labels The beta-oriented description can be replaced with a label-oriented one The label-oriented description is more concise and facilitates the following analysis Now, given a differential characteristic with two active S boxes per round We assume that the two active S boxes in the S rounds are located in the same column and Donates the differential propagation of the group mapping on this column as this We show that this propagation should meet four conditions So that the differential characteristic Based on it can sustain two active S boxes in round R-1 and R-1 In other words, these are necessary conditions for propagation in long differential characteristics with two active S boxes per round Summarizing all analyzing the proof of four conditions, we derive the third proposition For an R-round differential characteristic activating two S boxes per round if the two active S boxes in the R-th round are located in the same column Then for all R-bases in equality, the two active S boxes in the R plus two S rounds are located in the same column Then we derive the lemma which tells the head of the target characteristic For the sufferer, if a differential characteristic activates two S boxes per round Then the two active S boxes in one of the first two rounds Must be located in the same column of the magic state Based on lemma-1 and proposition 3, we conclude that all differential characteristics with two active S boxes per round Can be decomposed into several pieces of two round characteristics For which the two active S boxes in the first round are located in the same column Furthermore, the differential Purportation abstracted from these two round characteristics fulfills four conditions On the other side, the characteristics with two active S boxes per round can be constructed artificially Consider two differential propagation validating four conditions If gamma i to r5 are possible transitions Then the two propagation are said to be compatible with each other As shown in the figure, we can craft long differential characteristics activating two S boxes per round with compatible propagation We implement a test and find 26 propagation validating four conditions Then we evaluate the competitiveness among them and illustrate the result in the figure After removing some isolated nodes and the short parts We notice that the graph contains several cycles On the one hand, this cycle theoretically explains the existence of long differential characteristics with two active S boxes per round On the other hand, accompanied by the preceding analysis We conclude that any differential characteristics covering more than seven rounds with two active S boxes per round must utilize certain passes in the figure In addition, the cycle also enables us to enumerate all optimal differential characteristics by hand They propose an explicit formula for the differential probability of the optimal characteristic And prove that there are 288 optimal characteristics with an odd number of rounds And 10,400 optimal characteristics with an even number of rounds In parallel to the case of differential setting We derive some analytic results in the linear setting Similarly, we show that if r is greater than 9 The optimal r-round linear characteristic of gift 64 with a minimum number of active S boxes must activate two S boxes per round The linear correlation bound is also studied However, unlike the case in differential setting The optimal linear characteristic with a maximum correlation can contain characteristics with a single active S box in some rounds We check the properties of linear characteristics with two active S boxes in each round And find that these characteristics also can be constructed artificially We find 46 useful linear propagations and analyzed compatibilities among them Based on the cycle in the graph We also theoretically explain the existence of long linear characteristics with two active S boxes per round Next, we turn to the question Proposing the first beginning Can we improve gift 64? Note that there are 2,304 group mappings meet all requirements for the winding gift 64 So, we managed to find a variant constructed with a new group mapping that processes comparable upper bounds on the differential probability and linear correlation To reduce the number of candidates, we implement a classification Proposition 7 points or sufficient condition for two variants being equivalent to each other Based on this proposition We define an equivalence relation on the set of all gift 64 leg samples and partition the set into 168 equivalence classes Therefore, we only need to check the property of one representative in each possible equivalence classes And the number of candidates is reduced from 2303 to 167 We apply the automatic method to search for upper bounds on differential probabilities and linear correlations of 167 representative variants The test results are illustrated in the figure It can be noticed that the security of gift 64 against the differential cryptanalyzed is moderate among all representatives And the capability against the linear cryptanalyzed is almost among the best of candidates Then we consider the combination of differential and linear properties According to the length of the optimal effective differential and linear characteristics The 168 representatives can be divided into 17 groups The performance of gift 64 resisting differential and linear attacks is good And 40 representatives achieve similar security levels to gift 64 Moreover, we identify that one representative may achieve comparable security level against differential and linear cryptanalyzed And its optimal effective differential and linear characteristics achieves 12 rounds We donate this equivalence class as gift 642021 This equivalence class contains 24 elements And all variants share the same differential and linear properties As in the figure, comparing to gift 64, the new variants have comparable upper bounds on differential probability and linear correlation The clustering effects of differential and linear characteristics are evaluated Similarly to the case of gift 64, the differential and linear half properties of the new variants are not significant Beyond that, we implement the automatic search of impossible differential distinguishes their correlation linear distinguishes and the integral distinguishes for the variants The experimental results indicate that the security levels of the variants be standing in possible differential attack Their correlation linear attack and the integral attack are similar to those of gift 64 Note that the best attack on new variants achieve 18 rounds which is two rounds less than the length of the best attack on gift 64 We clamp that for the variants if the security in the related care tag setting is not required, 26 rounds could be used rather than 28 rounds For the simple and clean design strategy, gift offers extremely good performance and even surpasses both skinny and salmon for round-based implementations As in the table, we compare the hardware performance The new variants achieve higher throughput and requires lower energy consumption than gift 64 On this basis, the 26 round variants may become one of the most energy-efficient sectors as of today and is probably more suitable for the lower energy consumption use cases than gift 64 Now, we give a conclusion The paper studies gift 64 with both automatic methods and mathematical analysis This hybrid method uncovers new insights into the security of gift 64 and the sum of its variants For gift 64, we prove some properties of differential characteristics Activating two S-boxes per round show that all optimal differential characteristics takes covering more than seven rounds with the maximum probability can be constructed manually This says the properties of linear characteristics with two active S-boxes per round are also provided In the second part, we find variants with analogous security levels under the differential and linear settings and show that the 26 round variant may become one of the most energy-efficient sectors as of today As to the future work, firstly, if one is concerned with related care tech, they conjecture that the resistance of the variants regarding related care differential attack can be lifted by carefully crafting the case schedule Secondly, the cases where the group mappings operating on different columns are distinct is an open problem. Lastly, checking the existence of a balanced variant for gift 128 will be interesting future work That's all for the presentation. Thank you for your attention So while we're trying to figure out if we have one of the speakers online or present in the audience, just a second, are there any questions? So I have questions for you Bart, unless we find the link online The tables and all the analysis, what are the success rates for the attacks that are reported there? Give or take? I'll have to look it up like probably 50% or so. I have to look it up and check with the others again. This is a while ago but thank you. Are there other questions? Do we have one of the If not, see you in the next session in 25 minutes And remember there is a membership meeting. We should be there