The Global Nutrition Report is three things. It is global, it's about all countries. It's not just Africa and Asian countries, Latin America, it's all of them. 193, it's about nutrition in all its forms. So not just about stunting or micronutrient malnutrition, but it's about overweight and obesity and diabetes as well. And it is a report, we try to make it more than a report, try to make it an intervention as well. So we spend a lot of time putting it together and we spend a lot of time trying to get it into the hands of people who can use it and trying to get it into, trying to develop shareable content, easy to use content. The report itself, maybe not that easy to use, but there are a bunch of other products that are, we think hopefully stickier and snappier and more country tailored to countries and regions. So what you've got is the mothership there that the big document. It's, there are three co-chairs, my other co-chairs are Corinna Hawkes and I'm one of them, I'm Don Kessmally at Mahidol University in Thailand. And there's a group of 20 experts on the independent expert group that actually vouch for the independence and the quality of the report. And there's a group of stakeholders that set broad strategic directions which are countries, donors, the big four UN agencies. And who have I left out? Some academic and research institutions. And then there are over 70 authors who contribute to the report. Our job as co-chairs is to stitch all that together and come up with a storyline that's semi-coherent. So this is what I want to talk about a little bit about nutrition and the NDGs and progress on nutrition status, progress on actions, finance and capacity, climate, food systems, business and accountability data. And I only got sort of one or two slides on each of those. So it's very high level. Some of you may find that a bit frustrating. So apologies. You might also find it frustrating my ability to use this name. Nutrition driving the NDGs. So we're in the SDG area. So we spend a lot of time in the report saying why is nutrition important? It's not just a marker of development, it's a maker of development as well. It's not just an outcome, but it's an input. It's a crucial input. So we spend quite a bit of time in the report saying for people who don't even know about nutrition or who are under investing in nutrition, why should you invest? So obviously there are rights-based arguments, especially for children. We have the Convention on the Rights of the Child. It's very important if you care about health and mortality, 45% of all under five deaths are related in one way or another to malnutrition. So that's 45%. And so that's one of these iconic numbers that if I were to wake you up four in the morning, you'd be able to tell me that. That's our goal. I mean, I would never do that, don't worry. But if I were, that would be a number that we would want everyone to be able to recite. It's a very credible number it's published in the Lancet in 2013. Intergenerational equity, the Sustainable Development Goals, sustainability is all about really, what are we doing in this generation that affects the ability of the next generation to flourish and thrive and develop? We usually think about it in terms of climate and resource use, but it's also really relevant for nutrition because what we do for adolescent girls affects what birth outcomes they have when they eventually give birth. What we do for those kids that have just been given birth affects their ability to have healthy babies themselves later on. So it's an intergenerational cycle that we must break. So if you care about intergenerational equity, you care about nutrition and if you care about economic development, you care about nutrition. Here are some estimates from the literature from the last two or three years. It's a very fussy slide, but the bottom line is you've got lots of different countries, lots of different methodologies, lots of different data sources and they all sort of generally come out at the same kind of equivalent result which is malnutrition seems to be a drag of about 10% per year on GDP. That's a massive, massive drag when you add it all up, all the different forms. It's a massive drag. And in fact, the 2014 report tried to calculate what are the, so they've got this massive loss, but can we do anything about it? And the 2014 report estimated the benefit cost ratios of investing in nutrition interventions. And it said, it estimated some costs of how much it cost to scale them up. So 90% of the population that needs them gets them. And then it said, what are the benefits of scaling those up in terms of prevention of malnutrition? How do they pay off in terms of school attainment? And how does that pay off in terms of the labor market? So when you discount those benefit streams from 30 years down the road back to the present and then you compare them to the costs, you get ratios for 40 different countries and the median of the ratios is 16 to one. So half the countries are above 16 to one and half are below 16 to one. I was just in Philippines and Thailand last week and their ratios are in the 40s to one. So it's a fantastic investment. So those are the reasons to invest. Now how are we doing in terms of progress? So the report, again, it uses just UN data. It's UN data, which of course derives from the countries. The countries submit the data to the UN. The UN puts it through a sort of basic quality adjustment and quality thresholds. What passes those thresholds makes it into their databases and then we, with their help, use the UN data for our progress assessments. The assessments are based on the World Health Assembly targets, which are global targets. So the World Health Assembly, which is all the ministers of health in the world in 2011, they said we're going to reduce stunting from 160 million kids to 100 million kids by 2025. So we apply and they do that for a whole range of indicators, that kind of thing. So we apply those goals at the country level. Some countries have their own targets, but not many do, so to be comparable, we apply those global goals at the country level. And we say if a country's on course, if it's making rapid enough progress that it'll meet those goals in 2025, then we designate them as on course. And if they're not making rapid enough progress or they're stalling or going backwards, we say they're off course. So for stunting, and I'm assuming, I don't know if I need to explain stunting, stunting is a short height for age. It's sort of a chronic omnibus indicator of malnutrition. It combines chronic, but also acute, episodes. The kids don't look necessarily terribly malnourished. They look in proportion. Their heights and weights are usually in proportion, but you think they're five, but they're really eight or nine. They're just very short for their age. We don't really care about height per se, but we care about height because it's a marker for cognitive development, immune system development, all the things we really do care about. So in terms of stunting, if you look at 2014 and 2015, we go from 24 countries that are on course to 39 countries that are on course. Notice that not all 193 countries are here. That's because a lot of countries don't have data in the U.N. databases. A lot of those countries actually, middle income and high income countries who can't be bothered to put their data into the U.N. databases. But they're gonna have to now because we're in the SDG world. We're not in the MDG world anymore. So I don't know if Ireland doesn't have many, many data points in the U.N. systems. So Ireland will need to get its act together. Maybe not so much for stunting, but for women's anemia and other kinds of obesity, overweight, those kinds of things. You're gonna have to start getting your data into these systems. So the good news is that 39 countries are on course. 60 are making, 60 are off course, but they're making some progress, which is great. And only 15 countries are really off course and not making any progress in the red. That's good. There's, in terms of wasting, which is very thin for height, low weight for height, these kids really do look malnourished. They, again, a small majority of countries are on course. That's good. The trend is good. The absolute number is not very good, but the trend is good. For under five overweight, again, the number of green, the number of countries in the green is increasing. So, again, a good positive trend, but you can see there are plenty of countries that are off course or making no progress. These first three indicators that I've shown you are going to be in the SDGs. They're gonna be the SDG indicators for nutrition. So everyone's gonna have to take them very seriously every country, including the rich and the rich countries. So stunting and wasting may not be so relevant for Ireland and the UK, which is where I'm from, but under five overweight certainly will be. We talk about other ones, but I don't have time to go into all of them. I thought I'd show you exclusive breastfeeding rates because we didn't look at these in 2014 because we didn't have the rules for whether they're on course or off course. In 2015, we worked with UNICEF to develop the rules and you can see for 32 countries are on course, the target is 50% coverage. 50% of mothers are exclusively bred who are for kids in their first six months of life. 50% of them are exclusively breastfeeding. So no water, no sugar water, no honey, nothing. Just breast milk. 32 countries are on course. Quite a number of countries are off course and there are six countries where there is a massive reversal between the last two surveys. Massive reversal means a 10% decline in exclusive breastfeeding rates and the 10 are listed there. So that's the under nutrition size of things but in terms of obesity, we were really shocked to find that no countries are making progress in stabilizing adult obesity. In adult obesity, I think there are three countries where it's relatively stable and 190 countries where it's increasing. That's from WHO, that's between 2010 and 2014. So we look at these numbers a lot and we were shocked when we saw this. And so what we do in the report is develop a global scorecard. The numbers of countries, each of the rows is a different indicator that the World Health Assembly is set as an important. All the ministers of health have signed up to this. We want obviously not so much red and orange and lots of green. So that's kind of why we get up in the morning to try to support our champions within countries to get their countries into the green space which is to be on course to meeting these targets. And when we do presentations in Philippines and Thailand, for example, we'll do a regional one of these. So we did one of these for ASEAN, the 10 ASEAN countries and we did one for Thailand and one for the Philippines. And it's quite, it's very simple visual, are you on course or off course? And they seem to be quite powerful. But we don't just measure outcomes, we also measure actions. We also, a commitment is we will do something by this time, by this, to this extent. So we, there are plenty of organizations that measure outcomes, but not many that measure actions as well. So we start off with the nutrition for growth commitments. This was this big summit that was held in London in 2013. I think somewhere like $15 billion was pledged. Additional money was pledged for nutrition at that event. There's going to be another nutrition for growth summit in Rio in August of this year. Who knows whether it's going to be a similar pledging event or not, I hope it is. But our starting point was what are these nutrition for growth commitments look like and who's delivering on them and who's not. So we did an analysis for the first time and said how many of these commitments are smart? You know, specific, measurable, assignable, realistic and time-bound, that's what you want. You don't want a commitment that says we will reduce malnutrition. What indicates over which period, by how much and how you're going to do it is what you want. So we did an analysis, we found that 30%, actually 29% of the, there's two or 300 commitments were made at that conference. And only about 30% of them are smart. So it means it's very hard to track the non-smart commitments. They're vague and fuzzy and vague and fuzzy commitments usually don't lead to actions that reduce malnutrition. So that's, so for the Rio event, we're really encouraging stakeholders to make their commitment smart. We're showing them in the 2016 report, which is coming out in June, how to do that. At least giving them some guidance on that. In terms of who's reporting and who's on course and who's off course, these are the, there are about, as I said, about 200 or 300 different commitments made by companies, countries, donors, UN agencies and research organizations. And about the same percentage are on course or have met their commitments, about 40% in both years, about green between 2014 and 2015. But we noticed this year that about 20% of the commitments were not even reported on, even though we chased people to the ends of the earth kind of thing. They were sick of us by the end of it.  We also look at interventions. So on the under nutrition side, there are 12 sort of Lancet approved under nutrition interventions that are very direct interventions, things like breastfeeding promotion, vitamin A supplementation, salt idolization, iron folate supplementation, those kinds of things. And we looked at how many indicators do we, who's tracking whether these programs are getting to the people they need to get to. That was the thing we started out with, but we found out it's really, actually really hard to answer that question because the data on coverage are not even being collected for six of the 12 interventions. So we're not even collecting the data. We talk about scaling up nutrition and some movement wants to do that and everyone wants to do that, but we're not tracking whether we're able to do it or not because the right data are not being collected by DHS surveys, by MIC surveys, by national surveys. Only for three of the 12 indicators, or three of the 12 interventions do we have comparable national data. So we need to do better on that. We also talk a lot about healthy food environments and food policies. And we say how many policymakers have lots of choices about things they can do to make food systems more nutrition friendly. But again, the best data we have show that there's a real implementation deficit. We went to the nourishing framework with a nourishing database and found that only 63% of high income... First of all, we found only 67 countries that have implemented any of these food policies designed to improve healthy diet. So only 67 countries. And of those 67 countries, most of them were high income countries. So very few or no low income countries are implementing these kinds of food system policies that are supposed to help improve diets. And only actually quite a small share of high income countries are doing so as well. So a big implementation gap. We also look at finance. And our bottom line conclusion is that every country is going to have to increase spending on nutritional policies and programs. Not just low income countries, not just donors who spend money from high income countries in low income countries, but high income countries for their high income populations. They're going to have to increase spending. In the 2014 report, we didn't actually have any data on how much do countries spend on nutrition. So it's really hard to calculate a gap. How much do we need to spend to meet these targets if we don't know how much you're already spending? So we only had data actually on three countries in 2014. But in 2015, we had data on 30 countries. And that's largely because the Sun network worked with these 30 countries who stepped up. These are the countries. They really stepped up in 2015. What was the... What did we conclude? Well, 14 countries completed the exercise in full of the 30, the others are still ongoing. Working with Sun, we calculated what the domestic budget allocations to nutrition were as a percent of the overall government budget. So as a percent of what governments spend, what percent is that on nutrition? Not just on very specific nutrition programs, but a broader... There's quite a broad definition of what is nutrition. And the number is... The average for the 14 countries is 1.3%. So 1.3% of government budgets are spent on nutrition. Broadly speaking, so they would look at agriculture. They would look at education. They would look at water and sanitation. And say, of these 100 line items in the agriculture budget, we think these 10 are nutrition relevant. And we think this percentage of each of them should go to nutrition. And the countries themselves decided what that would be. So they're not crude estimates. They're quite... And you go through this document here. In those of you who know Zambia, that's the Zambia Revenue and Expenditure document for 2014. It's not... There's no PDF version of this. So the Sun CSO network in Zambia had to go through each one of those pages looking at all the budget line items and saying this budget line item looks like it's relevant to nutrition. What percent of that line item goes to nutrition? So it's not a high concept exercise, but it's a really laborious exercise. The upper bound was 4.1%. So they did what we really think it is and what we think it has the potential to be. So I think 1.3% seems low to me, but we don't have any benchmark, so who knows. But the good news is that the upper bound is 4.1%. So there's some room for nutrition champions to say, okay, on average it's 1.3%, but we can fight to make it 4% in the future. Donors spending 4% of their spending on nutrition. So that's good. They're spending one billion on nutrition-specific interventions. These are things that are explicitly designed to have an impact on nutrition. And that's really amazing because that's up from a quarter of a billion only 10 years ago. This is real dollars. So it's adjusted for inflation. So donor spending on nutrition is quadrupled in the last 10 years on nutrition-specific. But it's still only one billion and the envelope for overseas development assistance is about 130 billion. So it's one billion out of 130 billion. Other piece of good news is that nutrition-sensitive spending, this is stuff, this isn't all agriculture, but it's the bit of agriculture that we think has a big impact on nutrition. It's the bit of education that we think has a big impact on nutrition. You add all of that up and that's four billion. So five billion out of 130 billion is about 4%. So that's going up, so that's also good news. 13 of the 29 OECD donors don't spend, they spend hardly anything on nutrition. That includes some donors who spend a lot on ODA, but not much on nutrition. So it includes Denmark, Sweden, Norway, a couple other donors who spend a big percentage of their GDP, much more than 0.7% on development assistance, but hardly anything on nutrition. So an example of the report as an intervention, we wrote to NORAD in Norway and said, please let's have a launch and let's talk about some of the investment opportunities for NORAD and Norway in nutrition. So we're doing that next month, actually. There are some estimates about how much we need to spend to get to the World Health Assembly targets. The World Bank and a group called R4D in Washington have done this. Their conclusion is that governments are going to have to double spending on nutrition if we're going to reach these World Health Assembly targets by 2025. And the donors are going to have to quadruple their spending by 2025. The good news is that donors have quadrupled it over the last 10 years. Of course, it's more challenging to quadruple a bigger number over the next 10 years. But the donor stuff is a bit of a sideshow. It's really got to be governments that begin to invest in nutrition more. If governments don't invest, it doesn't really matter what donors do, it seems to me. The donor investments will be temporary and not sustainable. Governments have to really invest. And this is what we're trying hard in the 2016 report is to make it easier for them to do that, to give them some examples, success stories, tools, guidelines, to bring all of that together and make it accessible. We talk a bit about climate in the report. There's a nice chapter in there. We talk about climate because this is, I think, one of the agri-diet conclusions. I'm talking to the agri-diet team. You may not realize it, but we often say you're lucky if you're born in a certain country in terms of your nutrition outcomes. We're lucky we're born in Ireland and the UK, I guess, in terms of our nutrition outcomes. But in many countries, the luck is not, is which month you're born in. So here's some data from India. It's a bit old now, but it probably still holds. It held for the previous two surveys in India, and it probably holds for the one that's just coming out now. And it says, how different is your height for age score, your standardized height for age score, by the month in which you're born in? It controls for income and education and location and all that sort of stuff. And it just isolates the month in which you're born. And these are extraordinary differences by the month in which you're born. And just to give you a sense of how big these changes are, that 0.2, that's the impact you'd expect from a really good complementary feeding program. And complementary feeding programs are when you improve the quality of the diet for kids between six months and two years of age. So if you have a very successful complementary feeding program, you would expect to get a 0.2 impact on height for age, said score. And yet, whether you're born in June or January, gives you a half a 0.5 height for age, Z score, twice the impact of a good complementary feeding program. So it's kind of a lottery which month you're born in. And this is why climate matters so much for nutrition because these seasonal cycles are going to be exacerbated in some cases. And in all cases, they're going to become less predictable. So nutrition folks have to climate-proof their work. You can't pretend that you're operating in a world where you don't have to climate-proof. But the reverse also holds true. Climate people have a lot to gain from linking more with nutrition and working with nutrition because diet choices affect greenhouse gas emissions. We know that certain types of foods result in greater greenhouse gas emissions either because they involve ruminants, large bowel ruminants, or because they use more energy. There's all sorts of reasons. But this is a paper that came out in Nature in late 2014, and it showed how different stylized diets, but based on real data, have different levels of greenhouse gas emissions. So you can see the global average was there, the Mediterranean is slightly lower, the pescetarian and the vegetarian. In other words, there seems to be a correlation. It's not perfect, but healthier diets for humans tend to be healthier diets for the planet. There's a lot of variation in that, but on average, that seems to be the case. We also talk a lot about food systems. Food systems are much more than just agriculture. They are about where do you buy the food? Is it processed, food marketing, food standards, food retailing, all that sort of stuff. Poor diet is the number one risk factor in the global burden of disease. It's a really important factor for under nutrition, as well as obesity, overweight, and diabetes. And yet, we don't really know much about how our food systems are affecting nutrition. Even if we ask the question, we don't really know how to assess how nutrition-friendly a food system is. So there's one chapter in the report that comes up with a dashboard for food systems. I think 13 indicators that any country could collect from existing data sets and begin to, it's not the last word, but it's a starting point for a conversation about how nutrition-friendly is our food system. We talk about business quite a lot, and we try to confront this issue of, some people say, we have to work with business because they're already involved in nutrition quite extensively through fortification, through processed foods, through drugs, through water, through mobile phones, all logistics, all kinds of things. Another group of people say, look, I can't trust business. I'm not gonna work with them. And another group that says, well, you can only build trust by working with them. So we're in this chicken and egg situation, I think, with nutrition and business. So we try to take it on by talking about mechanisms for promoting transparency, mechanisms for promoting monitoring, because we think those two things build trust, and we think trust is worth having because there are lots of opportunities for businesses to advance nutrition. There's lots of opportunities for them to set it back as well, but there are opportunities for it to advance. But in order to do that, transparency has to be high and monitoring has to be good. So we propose or recommend a register of public-private partnerships. If you have a public-private partnership between a government and a business sector, put the terms of that contract in a publicly available space, much as the people who are trying to get greater transparency in land, acquisition and land grabbing contracts, get them, if you put them up on a public available site, there's something called the Extractive Industries Transparency Initiative that's been quite successful in getting oil and mining companies and governments to make their dealings more transparent. Maybe we could do something like that in nutrition. ATME is the Access to Nutrition Index, which looks at large food companies and says are they, it ranks their governance, their disclosures, their lobbying activities, their labeling activities, it rates all of them, it promotes transparency. There's an enforcement litigation fund that the Gates Foundation and the Bloomberg Foundation have put into place that helps governments fight litigation from the tobacco companies because governments, whenever they try and enforce their anti-tobacco laws, the companies push back and governments have three lawyers and the companies have 300 lawyers. So Gates and Bloomberg have set up this fund. Maybe there should be something similar in nutrition and there's very little research on the role of business in nutrition as well. I'm often on panels with folks who are from the business world and they say, we're doing great things for nutrition. And I say, well, where's the evidence? I say it politely, where's the evidence? And they say, look on the website. And I say, well, I'd like to see an independent assessment of that done by UCC or UCD or Ivory. And there's virtually none. There's quite a few in the fortification area, but outside of fortification, virtually no impact assessments done by independent research groups. There's no research program that's dedicated to understanding the positive and negative role of business in nutrition. So for research funders, we make a strong pitch to them, set up a research program and they're somewhere in the world. I'm nearly finished. One of the big recommendations coming out of this is we want the UN agencies together with others to establish some kind of time-bound commission to begin talking about roles, responsibilities, areas that the company should stay out of, areas that they should go into, under which conditions, for which age groups and which processes. There's no real dialogue at the moment, as far as I can tell. The Sun Business Network is promising, but I don't, and this is my, the only thing I'm not very happy about with Sun is that I think there's not enough dialogue going on within the Sun Business Network between, I think it's, I think it's people who all believe the same thing, talking to each other, and they should be expanding the circle of dialogue, not just intensifying it, which I think is what they're doing. Accountability and data, in addition to the reports, we produce 193 of these two-page documents, one for each country, that pulls together over 80 indicators of outcomes, but also spending, legislation, policies, underlying determinants, poverty, inequality, GDP, and they're all available, they're all available on the website, downloadable, I encourage you to look at them. We focus a lot on data gaps. There are 99 countries in 2014 that had enough data to be able to assess whether they were on course or off course for four of these indicators. If I showed you the graph for eight, you'd get really impressed, because there are very few countries that can track all eight indicators, so I'm just showing you the graph for four indicators. The good news is that that went up, so 99 countries in 2014, 108 in 2015, but still a lot of countries that don't have enough data to track their progress towards targets that all 193 Ministers of Health signed up to five years ago. That's pretty shocking. I think the SDGs will give an added impetus to data collection, and I very much hope they do. So finally, calls to action. I've basically talked about all of this already. We all need to do a better job of elevating nutrition as a development thing. It's not just a health thing, it's not just a food thing, it's a development investment. We need to do more accountability on nutrition. Very few countries have national targets. Very few. We need to strengthen the nutrition for growth. Nutrition for growth was great, 15 billion extra commitments. Also policy commitments, program commitments, lots of commitments, but not enough of them are smart, not enough of them are ambitious, so we can do better in 2016. We need to implement actions. Lots of people have pro-policies, but they're not implemented. Lots of countries are doing things, but they're not documented. We need to implement a document. We need more funding for nutrition action. That's, you know, we can do better with the existing funding we have, but there's no getting away from it. We need more. We need to build alliances with unusual suspects, climate and nutrition. We were, there were three, I think there were three nutrition events at the December COP conference, and two of those were GNR events. So, you know, three events out of thousands of events at the COP. Development indicators for nutrition-friendly food systems, or we're doing, a lot of people are doing work on that now. The Committee on Food Security in the UN is going to start doing work on that too. Build a greater understanding between nutrition and business, identify the data gaps, that hinder action, and fill them. That's my final slide. Tom's seen this before, maybe some of you have. It was something that came out in the Economist in the autumn of last year, and it was about designer babies. And it was talking about this rather dystopian future where we can perhaps select certain traits that we want in our future babies. And these are the traits they highlighted in the picture. I added the GNR, just for a bit of playfulness. So, you know, you look at these traits. High IQ, sprinter, so that's all about long limbs and strong muscle mass. 20-20 vision, low strokes.  If you want to design a baby, invest in nutrition, you'll get babies with all of these things. It's too bad they can't do anything about baldness, but I'm willing to do that. So thank you very much, everyone.


Last week we looked at RSA and we introduced the algorithm and we went through the example of how do we come up or why do we need these steps for generating the key that is if we say the algorithm is to encrypt is we take our plain text message and raise to the power of E mod n then we need to make sure that when we decrypt we get the correct plain text back and therefore we went through the steps for how do we generate the keys where the the values are the values of E the public exponent D the private exponent and N and we went through an example of using RSA we may see a few more examples of RSA today we've missed or skipped over some slides which we're going to return to and save a few more things about RSA what we went through last week I wrote a fair bit on the board but in this handout which you have in front of you as well at the end of the this set of lecture notes it describes or writes down some of that discussion from last week so if you didn't follow everything of how do we derive the keys in RSA then it's in these handouts here and there's some examples as well in the lecture notes so RSA can encrypt our data and different from symmetric key cryptography we have two different keys and importantly the two users do not need to exchange a secret beforehand because with RSA I have a public key and a private key as do other users I to encrypt it to encrypt a message to send to someone else I encrypt with their public key so there's no need for some secret exchange of keys before I send the message I just ask them for their public key and they publish it on a website and an email or give it to me somehow and I can encrypt and send confidential information to them so that's a very good feature of RSA and in general public key cryptography this independence of us as shared secret key and effective if we use long enough keys we'll talk about the length a bit later but if we use large enough values it's considered secure that is if our modulus n is large enough for example a 2048 bit number maybe recommended even a thousand bit number is considered secure in some cases if the numbers are large enough RSA is considered as secure and there are no no techniques that make it any less secure than our block ciphers like AES and triple deaths so what's the problem with RSA if we've got RSA why would we still need something like AES or triple deaths anyone have an idea what what may be wrong or problem with RSA if we say it's about as secure as the block ciphers why do we still need the block ciphers slow RSA is slow okay performance not really from security but it performs much worse than the block ciphers and that's a significant problem you have used in one of your homeworks you used open SSL which is in fact two things it's a program a command line program to encrypt using different ciphers and in fact do different security operations like it can generate RSA keys it's also a library in that if you write your own software you can call the open SSL function so you don't have to implement RSA you don't have to implement triple deaths your own software calls the the functions of open SSL and they implement it for you and one nice thing is that because it implements many different ciphers we can compare the performance it has a built-in speed test open SSL speed and we can either run it and it will test all possible ciphers but I don't want to wait for too long I'll just select some ciphers deaths AES RC4 remember we covered RC4 the first two deaths and AES are block ciphers RC4 is a stream cipher which should be faster than the block ciphers and we'll also add RSA there and what that does is open SL does some tests and you can see for three seconds it it encrypts using RC4 some some data in this case 16 16 byte 16 bytes of data and it just times how long counts how many encryptions it can do and at the end it's going to report some statistics of how fast each of those ciphers can be applied and it does for different combinations which one do you think is going to be the fastest of those four ciphers deaths AES RC4 RSA which one hand we'll have a vote you've got four options deaths AES RC4 RSA which one do you think is going to be the the fastest hands up for deaths okay AES no one RC4 anyone two or three people what about RSA or hopefully no because we just said RSA the problem with it is it's too slow let's have a look at the results and it takes some time it takes a lot of time in fact because it in fact it tries different key lengths with AES you can have different key lengths 128 bit key 192 bit key 256 bit key so it's done AES above it it's done deaths and RC4 it's doing RSA now RSA is a bit different because it's slow it's not normally used to encrypt large chunks of data it's only used to encrypt small pieces of data and that limits its application to not so much for encrypting messages but for authenticating messages to making sure that the message we receive is correct has not been modified and comes from the right person so with RSA the tests are slightly different they run for 10 seconds again RSA can have different length keys in fact it's normally the modulus and which is specified so a 512 bit modulus and a thousand and 24 bit and a 2048 and even tries 4096 the recommended values nowadays are a thousand and 24 and preferably even 2048 but the larger the value will see the much slower they are this gives some the summary statistics let's see if we can get it a bit nicer it's wrapped around but let's see and I'll just make notes of some of them on the board because there are many different values with the stream and block ciphers so RC4 des it also does triple des EDE 3 AES with the different key sizes the the open SL speed test tried different size of messages so encrypts a 16 byte message and then does it again and then again and again and it counts and then it did it for 64 byte messages let's just focus on the first column the 16 byte messages with let's try our first cipher that we covered des with 16 byte messages des using CBC the motor of operation this is 51,501 kilobytes per second that's the speed at which encrypt 51,000 kilobytes which is 51.5 megabytes per second so it's just encrypting a lot of data and the measurement here is saying using these small messages you can encrypt it about 51 megabytes of data per second okay let's look at the others des triple des EDE 3 means encrypt with des decrypt with des encrypt with des with different keys so the triple des here all right three des the speed is here 18,862 kilobytes 18 megabytes per second 18.9 megabytes per second approximately one third of single des because all triple des is really is applying single des three times therefore it's going to be three times as slow as single des okay we want to be able to encrypt more megabytes per second so des is of course approximately three times faster than triple des but triple des is more secure because it uses multiple keys that increases the key length the problem with single des is that uses a or it has effectively a 56 bit key to triple des increases the key length but at the expense of performance let's focus on AES with 128 bit key AES 128 bit key 80 megabytes per second 80.3 80.4 megabytes per second so AES which is about the same strength as triple des is about four times faster than triple des so there's the advantage of AES compared to des and triple des it's secure and fast compared to the others so AES was designed with their performance in mind so they designed the algorithmic considering that or trying to optimize so that also considers performance now there's some other things that are happening here although it's not shown some so my I ran this on my laptop which is a mobile Intel i7 processor some processors support AES instructions in hardware okay normally our encryption is done in in software so it's just encrypted in software on my computer but Intel have something called AES-NI I can't remember what NI means new instruction or I'll see if I can find during the break but it's a set of instructions that the processor executes that implements some parts of the AES algorithm in hardware which makes it much faster so if your CPU supports this feature and it's common in most recent Intel processors then instead of encrypting everything in in software it offloads some parts of the AES encryption some parts of the rounds to the the chip the processor and that does some encryption and speed things up so some ciphers are supported in hardware as well what else do we see so there are the three block ciphers we have different key lengths slows things down a bit you see with AES from 128 192 so increasing the key length decreases the speed that's a general trade-off the longer the key the more secure but the slower the encryption RC4 the stream cipher up the top 340 megabytes per second more than four times faster than AES in this case so that's the benefit of the stream ciphers in this case the speed you can even see if you use larger blocks that they increase in speed up to 600 650 megabytes per second so the stream cipher a bit stream ciphers are built for speed but as you saw in your exam there are some problems if you use the keys inappropriately in a stream cipher you shouldn't repeat the the key and the same plain text because you may be to this well from the cipher text you may be to discover the the plain text so you use initialization vectors in the right way to make sure the stream ciphers are secure last one and it's reported differently because RSA is not used to encrypt large blocks of data at once because it is slow what it's used and we haven't covered it yet but it's used to provide signatures to authenticate where this data came from so we have mentioned the fact that we can encrypt using the public key and then decrypt using the private key but we can also use the keys in the opposite direction encrypt something with the private key and send that message to our destination and then the destination can decrypt with their with with the sender's public key to verify where it came from so what I do is I encrypt the message with my private key send it to you you decrypt with my public key if it successfully decrypts it confirms that I encrypted it because only I could have encrypted it with the private key so that's an authentication feature it's the concept of me signing a message putting my signature to the message so that when someone receives it they assure it came from me not someone pretending to be me so open SL reports the time to sign a message that's at the sender I would sign the message I would send the message to someone else and the other person would verify the signature so the signature the signing part is performed using a private key and the verification part is performed using the public key so it reports both of them number of signatures per second let's focus say on a typical 1024 bit RSA 4000 signatures per second okay and it's only signing a small amount of data most likely I think in the order of 128 bit 16 bytes so if we compare to this column signing 435 times per second and if here we've got with the others we've got in the order of at least 20 or close to 20 megabytes per second 20 million bytes per second let's say each signature was just 16 bytes which I think is the typical size if we multiply about this by 16 what do we get 16 about 64 64 thousand bytes per second so roughly in the order of 64 kilobytes per second versus 20 megabytes per second so it's at least a thousand times slower than the block ciphers don't worry too much about the numbers the point is that okay here we're doing thousands per second here we're doing millions per second there are some slight differences in the size of the blocks that they operate on this 1024 is not the size of the data it's the length of the modulus and RSA is much slower when we have to sign data and verification is faster than signing so what is it about 10 at least 10 times faster in this case what's the difference between encrypt and decrypt operations in RSA if you look at them encrypt or the first one operation m to the power v mod n and the decrypt is the same operation the only thing that's different are the values and in practice the values of E and D normally E which is the public value is small and therefore taking some number and raising it to a small power to a small number is much faster than taking some number and raising it to a large exponent so normally is much smaller than D we'll talk about why later therefore when we encrypt or we are when we use E the public exponent using RSA it's much faster than we use D the private exponent because it's slower to raise a number to a large power than a small part and that's what's happening in the signature and verification in the signature part the sign what's happening is we're taking some value and raising to the power of D mod n and the verification is taking the receive value and raise to the power of E mod n and because E is usually much smaller than D the verification is usually much faster than the signing and that's what we see here that it's about ten times at least ten times faster with verifying and signing but in both cases much slower than the others all right so we need to be careful in terminology of signage decryption in RSA we can use in RSA we can use we can use the algorithm for confidentiality or authentication and when we use it for confidentiality it means we've got a message and we want to send it to someone such that no one else can read the message that's our normal form of secure communications that's the same as when we use des triple des and so on we take a message encrypt with a some key and send it when we're using RSA what we do we take our message to encrypt for confidentiality take our message and we raise it to the power and mod by n what do we raise it to the power of E more specific E of who we raise it to the power of the public E of the recipient okay that is if I want to encrypt something and send to you I need your value of the public key your value of E so what I do is I take the message I want to send raise it to the power of E mod n I get my ciphertext send the ciphertext and the receiver takes the ciphertext and uses the opposite value instead of E D the private value mod n and gets m back that's for confidentiality making sure the message is secret but we can use E and D in the opposite direction remember is the public value and D is private what I can do is I take a message I don't care if someone else sees the message what I want to make sure and especially the recipient wants to make sure that the message came from the person who they say they are so what I do is I create a message and I use I use the RSA algorithm and I use as the exponent D my private value only I have D and when I send that value of C to you what you do is you take my public key in particular my value of E and you take C raise it the power of E mod n and you get the original message back this is the authentication operation it's the receiver making sure that the message came from me because if someone else sent it if you try to decrypt using my public value my public E then it will only be successful if I encrypted it with my private D and the only person in the world that has my private value of D is me which confirms it must come from me if it's successful so yes this is the well this are these four operations are all the same it's the same equation we just change the variables or change that the the variables here so it's all take some value raise it to the some exponent mod n it's just in what order do we use them for confidentiality we use the public E and then the private D for authentication we use the private D of the source and then the public E of the source at the recipient authenticate and this is what's being done in this open SSL speed test we'll come back to this authentication we've got a few more topics on it in fact but try and understand the difference here between confidentiality and confirming that the message came from the right person in fact let's let's return and discuss that a bit more now the point here was that the speed stream ciphers are fastest RC4 in our case then block ciphers AES is is quite common in use today it's got fast software implementations and also some hardware support desk triple desk getting old in that they're much slower to use and public key cryptography is much much slower than symmetric key cryptography and that's the main limitation and hence in practice it's it's not very often used to encrypt files for example or to encrypt data as you're sending it across a network it's you mainly use for signing and verifying let's go back and talk about some general aspects of public key cryptography and to finish this topic and just make this concept of authentication and confidentiality clear so we're going backwards just repeat some things we've already said these two slides show this concept of encrypting with a public key and encrypting with a private key encrypting with the public key we use for confidentiality keeping the message secret so Bob has a message he wants to send to Alice he doesn't want anyone else to see that message so Bob encrypts that message using a public key encryption algorithm for example RSA it doesn't have to be using Alice's public key everyone knows Alice's public key ciphertext is sent if Darth intercepts then what can Darth the malicious user do then to decrypt successfully Darth needs needs to know Alice's private key and of course by definition Alice's private key is not known by anyone else except Alice so so long as you cannot determine the one key from another and that the algorithm is strong then someone who intercepts this ciphertext cannot get the original plain text unless they have the corresponding private key encrypted with Alice's public key it can only decrypt with Alice's private key and only Alice has that so only Alice can see the message that's confidentiality that's what we normally use our block ciphers for but it's slow when we use RSA if we want to encrypt last large messages what we commonly use RSA and public key cryptography for is this approach encrypting with the private key Bob has a message to send to Alice Bob doesn't care if someone else sees that message that's not the idea here the idea here is that when Alice receives a message she wants to be certain that came from Bob it didn't come from Darth pretending to be Bob so in this case Bob encrypts using his own private key and sends the ciphertext and something that's encrypted once one private key will only successfully decrypt with the corresponding public key so Alice thinking it came from Bob decrypts and it will decrypt successfully because if it was encrypted with Bob's private key Alice decrypts with Bob's public key which everyone knows and because it successfully decrypts Alice is certain that this message came from Bob what if some other user Darth our malicious user sent a message to Alice saying this is a message from Bob with the intention to fool Alice to thinking it came from Bob what can Darth do Darth cannot encrypt this message with Bob's private key okay because they don't have Bob's private key so the only thing that Darth could do would be to try and maybe encrypt some message with someone else's private key his own private private key so if Darth creates a message encrypts with his own private key sends to Alice saying this is from Bob then what Alice does to verify is Alice decrypts using Bob's public key and that will be unsuccessful because if it's encrypted with Darth's private key and Alice decrypts with Bob's public key that to the mismatching keys they're not from the same pair and therefore it will not successfully decrypt when you decrypt with the wrong key you'll get some indicator of that and then Alice will know this did not come from Bob it came from Bob if it successfully decrypts with Bob's public key if it doesn't it must have come from someone else or something went wrong and that way Alice will know that they have to somehow other and some other means confirm with Bob what's happening so this is for authenticating where the message came from confirming that the message came from Bob not from someone else you can combine the two this encrypting with a public key provides confidentiality encrypting with a private key provides authentication maybe you want both you want your message to be secret and you want to confirm where it came from then in fact you can combine the two take your message and encrypt with Alice's public key then encrypt with Bob's private key and send the result and then you do the two operations so you can combine that the operations together of course it makes it twice as slow because we need to do encrypt both side at the center twice and decrypt at the receiver twice so that's what the opener sells speed tested the signing and verifying this is just a different representation of those diagrams a more formal representation which shows the notation but the same idea for secrecy or confidentiality encrypt with a public key decrypt with a private key from the same key pair and the attacker krypton analyst here has the goal of trying to determine what X is what the message was if they can find the message that been successful and or find the private key if somehow they can find the private key of B then they defeat the system because it's no longer private and with authentication we encrypt with a private key and decrypt with the public key here there's no intention to find the message the message is sent in the clear we can find the message from the attackers point of view but if the attacker that analysts can find the private key then they defeat the security of the system and we can combine the two here encrypt with a private key of the source encrypt with a public key of the destination send the result Z and then decrypt with a private key of the destination and decrypt with a public key of the source for authentication so this provides both what do we say secrecy or confidentiality and authentication provides both of those services so public key cryptography can be used for different security services there are different algorithms here is a list of four common algorithms we've looked just the RSA it's maybe the most popular one maybe the most famous one but there are others it's something based on elliptic elliptic curve cryptography RSA uses modular arithmetic there's different types of arithmetic an elliptic curve some uses some different mathematics to form encryption Diffie-Hellman key exchange we will cover that one the way to exchange keys and the digital signature standard another way to sign things so just different algorithms RSA and elliptic curve can be used for encrypting data for confidentiality they're not commonly used for it but they can be they can be used for assigning information performing authentication and for key exchange which is a way to exchange a secret key from A to B via some network Diffie-Hellman is built for key exchange and we'll talk more about key exchange when we talk about Diffie-Hellman and how it works the digital signature standard was built not for encrypting or confidentiality but for signing things so they have different purposes these algorithms so what we need for public key cryptography to work we need to be able to generate keys so every user needs a pair of keys so the algorithm for generating the keys must be easy to perform by easy we mean can perform can operate in a matter of milliseconds okay so if I want to generate my key pair I need an algorithm and software to do that for me and it should be reasonably fast it shouldn't take forever note that the keys are related as we saw with RSA the keys the values of E and D are related some way it should be easy for some some user A if they know a public key and some message M to create the ciphertext okay they need to be able to encrypt apply the operation to encrypt and it should be easy for the other entity to decrypt so it should be easy to apply our algorithm using one key and apply the algorithm using the opposite key to get the same message back that that's normal requirements we must be able to encrypt and decrypt now for security so they are mainly for performance reasons for security what we need is that it's practically impossible or computationally infeasible for an attacker if they know the public key and they know the ciphertext C to determine the private key the ciphertext will be known C will be known it's sent across the network the public key PUB will be known because by definition it's public so if the attacker knows those two values we need an algorithm such that it's takes too long for them to determine what the private key is because we need the private key to remain private similar it should be computationally infeasible for the attacker to know to determine the message M okay if they know C and the public key then they shouldn't be able to find out what the original message was if I encrypt using my public key a message and I get a ciphertext I send that ciphertext if you can determine the message without knowing my private key then that's not secure and that's what this one's saying if you don't know if you know the public key and C you still should not be able to be able to determine M message now some of the algorithms RSA in particular has this property not all of them that we can use the keys in either order that is shown here if we encrypt if we take some message and encrypt with a private key and we decrypt with the public corresponding public key we get the original message back so we use the private key and then the public key or the other order if we have some message and encrypt with a public key and then decrypt with a corresponding private key we get the message back then that's a feature that's supported by some algorithms we can use the keys in either order not all algorithms support that RSA does because RSA that's what we have here encrypt with the private value decrypt with a public value or encrypt with the public value e decrypt with a private value d RSA we can do in either order so importantly for security an attacker cannot determine the private key nor find the message given the ciphertext assuming they know the public key in the algorithm now what's what algorithm what are the features of the algorithm to provide those security services all those requirements lead to some a need for some algorithm or a function that is considered or called a trapdoor one-way function so let's look at the the definition or the informal definition of such a function we need a function that performs our encryption and decryption we need to be able to find an inverse a unique inverse because we know when we encrypt and decrypt if we encrypt some value and get ciphertext and then decrypt that ciphertext we must get the same plain text back that's our normal requirement for security if we encrypt m and get c and then decrypt c we must get the same m back if we get a different m it doesn't work okay so we need a function such that there is a inverse and it's unique should be easy to calculate so that we can encrypt in reasonable time that the function must be simple to calculate but the inverse of the function so some function which we apply which is easy when we apply that function but when we do the inverse it should be hard to calculate unless some information is known so we need some function that takes some input x and return some output y this function is our is going to be our public key cryptography algorithm what are the requirements on that function that we can easily calculate this that we and defined here it's easy to calculate that function if what have we got I think there's a mistake here as well this should be x easy to calculate if k and x are known so if we have the the key k and the input x we can easily find why we need such a function but the inverse of that function f to the minus one if we know the input y and the same the key k we can apply the inverse and easy to get x which is equivalent to we will see our decrypt operation if we know the key it should be easy to encrypt that's what this one saying and the second one saying if we know the key it should be easy to decrypt that's all and decrypt is the inverse of the encrypt operation but it should be infeasible practically impossible to given why so why is known but the key is not to find x so decrypt if you don't know the key that should be impossible so these are similar requirements that we've said for all of our sites so what do we mean by easy what's in in feasible well there are different ways to measure that one of them you look at the computational complexity of the algorithm so choose a function that meets these requirements a common way to measure is to say that some function is easy if it can be solved in polynomial time as a function input so if it can only be solved in say exponential time then it's not considered easy so there is and I think you've seen in several in at least one other course computational complexity we can analyze algorithms and see how complex they are and give some big order or big o notation to indicate the complexity of different algorithms let's see what have we got RSA is one such algorithm that meets those requirements and we've gone through RSA what can an attacker do to try and beat public key cryptography they can try brute force attacks so if we have a key and the attacker doesn't know the key try and guess every possible value of the key try all possible values and we know the ways to prevent or at least make brute force attacks hard make the key large so make it such that the attacker must guess many times such it will take too long the problem so if we make the key large we can avoid brute force attacks but the problem and we started to see with all ciphers we make the key larger they become slower and it's especially for public key ciphers the larger the key the less efficiently algorithm we have still the results here with RSA here's were effectively it's n but indicator of the length of the of the key 512 bits up to 4,000 bits we see the speed significantly reduces increase the security of it make a brute force attack harder increasing this value makes the algorithm much slower just go back to that look at the numbers here we double the p-length or in fact it's the modulus here but double the length of the input and what have we got a factor of 4 8 times slower in that case so we need to manage and consider the trade-off between security preventing brute force attacks and performance efficiency and the result is that most cases public key cryptography is used only when encrypting a small amount of data because it's slow and therefore with a large amount of data it takes too long what other attack can a analysis do they try and determine the private key from the public key and we saw that last week when we looked at RSA with RSA we have a steps for determining e actually we we calculate n select e then determine d d is the private value if the attacker given e and n can find d then they'll break RSA with the algorithms available there are no known practical techniques to break those algorithms for RSA for Diffie-Hulman and so on so they rely on mathematics such that there are functions that it's takes too long to solve the equations for example discrete logarithms take long a long time factoring large numbers into their prime factors takes a long time calculating the totem cake takes a long time there are some other types of attacks the probable message attack is possible we'll see maybe later have an example but we try all possible values of the message m using a public key the public key is known so the attacker takes many different values of m using the public key and see if the value of c that they get matches the value that the other user has sent and if it does match that they know what m is so they can find the message it's an attack we try all possible plain text message it works if m is small okay then we can try all possible and the way to prevent that from work being successful is make m large and if you have a short message most algorithms can add some extra random data to that to make it much larger so there are simple ways to avoid such attacks so except on the special cases the algorithms of RSA DSS elliptic curve cryptography Diffie-Hulman are all considered secure and that there are no known general attacks there may be very specific attacks if you use the wrong values of the parameters but they can be easily avoided so they considered secure so long as the key lengths or the the parameter lengths are large enough we've covered how RSA works we've gone through the steps last week key generation after the break we'll have another example will give you some tasks on generating a key and in the quiz next week we'll have a quiz in the lecture next week you can generate a key and encrypt so we've seen examples last week we can apply of course RSA works on a single number m if we have a large amount of data we can just break it into blocks and this gives an example that okay if we have a large number we break it into n blocks and encrypt one at a time so that's a more more detailed example of applying RSA the numbers are a bit too big to go through in class what about the performance and some of the security aspects of RSA to finish with RSA we take some number m and raise to some exponent e or d and then mod by n how fast is it to perform such operations exponentiation generally is it is a slow procedure it takes a lot of time to take some large number and by large numbers we're talking about hundreds of bits in length and raised to some other large number if that other large number the exponent is also one hundreds of bits in length then we get a very very large number as an output and computers take a long time to perform that calculation but in fact when we're using modular arithmetic there are some properties of the arithmetic that make it relatively simple to calculate so one such property is that we can remember exponentiation really is multiplication multiple times 2 to the power of 3 is 2 times 2 times 2 so we can simplify the steps of exponentiation using some of the properties such as this property that if we have some some large number a thousand multiplied by 500 mod 200 is the same as a thousand mod 200 multiplied by 500 mod 200 or mod 200 and that makes things simpler because we're just doing a mod of a smaller number and we can break that down to to make it easier for your computer to calculate so even though we're using very large numbers it's possible for doing RSA encryption in reasonable time when we generate keys we need to choose a value of e remember the process is you have two random or two prime numbers p and q calculate n calculate the totion of n as p minus 1 times q minus 1 and then select e which is rent relatively prime with the totion of n how do you choose a value of e and remember is public is the value that we can tell everyone or you can choose different values but because it's public in fact you can use the same value multiple times different people can use the same value and some common values are equal to three so it doesn't have to be large 17 655 37 why these values using small values is good because when you take some message raise power of e mod n if e is small then this will be fast to implement because we're just taking some number raising it to a small power raising some large number to the power of three is much faster than raising this large number to the power of a very very large exponent okay so a small value makes it perform faster these other values help in some of the operations if you look at them in binary they contain only several values of binary one and many values of zero and you can start to use left shifts and perform the multiplication and exponentiation much fast much faster so there are some optimal values in terms of performance for e some values there are potential attacks but if you add some random padding that is increase the length of the message those attacks can be avoided so generally the value of e can be the same for multiple users so I have a public key my value of e is three you have a public key you can you also use the value of e would of three but we should have different values of our modulus and once we have a value of e then we there are algorithms for calculating d and d should be large although e can be small and fix d is our private value no one should be able to guess it so if you have a small value of d there's potential for attacks so generally d should be large and normally it's in the order of almost the same number of bits as n so if n is a thousand bits in length and d is close to a thousand bits in length with e is small there are algorithms for even if d is large how do we use d we take c raised with the power of d mod n if c is a large number say a thousand bit number and d is also another large number a thousand bit number we get a very large result here but again we can take advantage of some properties of modular arithmetic to make this manageable to calculate it's still manageable in reasonable time in the results we saw with open SSL using e we saw was the verify operation and using d was the sign operation I'm just going back signing is about 10 times slower than verifying because in this case I don't know what value of e was used but most likely it was a small value of e and a large value of d and it meant that this is faster than the signing of the other signing operation so there are some rules or some guidelines that the values of e you can use d can be calculated there are algorithms for calculating it and the other parameters that we choose a p and q they are the two prime numbers we start with they must be private so when I generate my own pair of keys I choose a two large prime numbers p and q they must be very large the reason they need to be large is because the attacker one of their objectives is to take n and factor it into its primes p and q if n is very large then that's considered impossible to do in reasonable time so if you make p and q very large you multiply them together then n will be very large and therefore an attacker cannot determine p and q from n very large again we'll see some examples but what was a number one of the more recent numbers the length of n of 768 bits so a value of 768 bits long of n took something like two years to factor into its primes p and q so make p and q large enough such that n is in the order of a thousand bits two thousand bits and it's considered secure it's not easy to find large prime numbers though and what normally happens is they algorithms choose large random odd numbers it may be prime it may not be maybe composite and then there are ways to test to to increase the chance that is a prime number so there are ways to get a very high probability that p and q are prime numbers how secure is it if you choose large enough d that it makes brute force attacks too slow except a large d makes the operation here slower sorry the signing operation the mathematical attacks which we mentioned last week were you either need to factor n into p and q it's two prime factors that's considered impossible if n is large enough you determine the totion event directly that problem is considered impossible if again n is large enough or you determine d for example by performing a discrete logarithm and discrete logarithms are considered impossible again if our numbers are larger there are no known ways if we use large enough numbers to perform those mathematical attacks most of the measures of security of rsa are based upon the size of n because the easiest of those attacks is factoring n into its prime numbers so that's how people measure how secure there are some very specific attacks timing attacks taking advantage of how long the implementation takes but there are usually countermeasures very easy countermeasures that will prevent those attacks so it's very easy to stop them let's just finish with some examples of how long it takes and the size of n this is a bit old this one's from the textbook but what have we got these are how long it takes to factor a large number n and here's the size of n in bits so 600 bit number a 2000 bit number and different algorithms have been used to try and factor we're not going to cover how they work I can't even I don't even remember the different sieves and this is the time measured in some number of operations to perform and so MIPS years in this case and we're talking about 10 to the power of 9 10 to the power of 10 MIPS years where MIPS is a measure of the the processor speed but more maybe more meaningful rsa the algorithm rsa the company who developed the algorithm had some competition where you win money if you factor large numbers and so there was some competition and you see over the years so the number of decimal digits and the approximate number of bits and for example in 1999 512 bit numbers so this is the length of n were managed to be factored into p and q how long to take the factor 8000 MIPS years so a measure of the amount of time and computation time to factor that and more recently 2005 663 bits and the most recent one which was part of the competition they've now stopped the competition 768 bits that is n 768 bits long it took approximately two years in real-time running multiple computers hundreds of computers at the same time trying to factor one number n into p and q it took about two years of real-time to factor the 768 bit and so if you've got it a thousand and 24 bit and it should take much much longer to be able to factor that given the known algorithms and if you have a 2048 bit and it's considered secure so it's just a matter of making making n long enough by choosing large enough p and q that brings us to the end of rsa what we'll do after the break is I'll give some examples and you'll have some some examples of a simple encryption and key generation with rsa and then if we have time after showing a few examples we'll look at another algorithm Diffie-Hellman key exchange we'll see how far we go let's have a break and at 240 we will continue with some examples