So, rwy'n ni'n rhoi Opening to Start by Clarifying That in this work we haven't actually broken A 128 bit secure elliptic curve dispute log problem. Sorry to disappoint anyone if the title gave that impression. This talk is really about the dispute log problem In finite fields in small captivists Who has the arise from pairings on super singular binary curves. It's a quick outline on the talk, just to give some background of motivation on this problem. I'll then talk about our contributions. I'm going to finish off with a recent result of ours ond it's not in this paper but actually kind of drew naturally from the techniques in this paper so hopefully that will be interesting and relevant. So what are super singular curves? Well a super singular elliptic curve is just one if it's in characteristic P it has no points of order P over an algebraic closure and more generally a super singular curve of higher genus is just one whose Jacobian is isogenous to product of super singular elliptic curves. And here's a couple of examples here over F2 so easier only one. And it's a basic property of super singular curves or these two in particular that for any odd prime P if we consider the curve over F2 to the P then the group orders are just given by these expressions here. So the history of super singular curves and cryptography is quite an interesting one and back in the early days of VCC point count and algorithms were not as efficient as they are today. And so having a group order given explicitly like this made them very attractive for early adopters of VCC. However, around 1993, thanks to Meneza's Ocomode and Banstone, they realized that one can take an elliptic curve DLP and map it via repairing to a finite field DLP in an extension of the base field over which the elliptic curve is defined. And they also knew that super singular curves have low embedding degree and as a result the first lesson for the crypto community regarding the use of these curves was that they are bad. And just to give an example, for this is an E1, they haven't been in degree 4 and so you have an easy attack, well not necessarily easy but you have an attack which is sub exponential. And so these curves fell out of fashion for about 7 years until a series of very nice results starting with papers by Jube, Bonnet Franklin and Sakai, Gysian, Casahara and so you realize that there are many constructive applications of parents in cryptography. And it was reason that well, okay, you may have an attack in the embedding field of a curve but as long as the DLP in this field is still hard then this is an acceptable state of affairs. And so the second lesson to take from the history of these curves is basically provided the applications are good enough and we can safely ignore lesson one. And so lots of implementers spend a lot of time, myself included, making these curves and parings over these curves as efficient as possible. And it's not only elliptic curves but also super singular hyper elliptic curves and as proposed of super singular opinion varieties due to Alice and Carl Rubin and so there's really a lot of work went into this. However last year this is all thrown into complete turmoil I guess thanks to a series of high impact results. And before I describe these I should just mention the DLP computation basically uses an algorithm known as index calculus which consists of two parts. So you have a first part which is to define a factor base and one attempts to generate relations between these elements and then find their logs. And the second part is to take an arbitrary element in the field and then attempt to write it as a product of elements of smaller and smaller degree until all of these elements in the product are in the factor base. This is known as the descent and previously these two stages are both sub exponential time. So the first result was in February last year, which was by myself and three colleagues at University College Dublin, namely Fruigologlu, Gary McGuire and Jenson Braigle. And what we showed is that the first stage in its calculus can actually be done in polynomial time. And also the hardest part during the descent, which is the elimination of degree two elements, that can also be done in polynomial time. And around the same time Antoine G was having very similar ideas. So he came up with a polynomial time relation generation method for degree one elements, which was different to ours, but essentially isomorphic to it. And he also had a polynomial time method for eliminating degree two elements, which was in batches, so slightly different to ours. But most importantly he had a descent method for eliminating other small degree elements, which are the hardest part during the descent after degree two. And with this he was able to get a heuristic other one-fourth algorithm. So that was a really big breakthrough. And then a couple of months after that, we have the quasi-pollinomial algorithm due to Barbara Leskiew, Gary Gigiw and Tomay. And here the descent they showed is quasi-pollinomial, an even bigger breakthrough. And as a result of this, the third lesson for the use of super singular curves in Cypto is that small characteristic super singular curves really are bad for cryptography. And I think Stephen Galbraith wrote in his blog, type one pairings are dead. It's quite dramatic. But that was the way it was. And furthermore, there's a lot of DLP records set last year which support the validity of these theoretical advances. So they're not just purely theoretical. And the last one of these was actually set by the team behind this paper, which is in a 9000 bit field. So this raises an obvious question which is, if the small characteristic field DLP is dead, then why should anybody bother studying it? And I guess just to extend the metaphor a little bit, the short answer is that yes it may be dead, but it's not quite buried. So I guess a slightly longer answer is deserved. So the first point I would say is that all the records I just showed you, well none of them actually arise or attack in fields which arise from parameters in the cryptographic literature. It's kind of seem mad to have all these new tools and algorithms and technology, to have all these parameters in the literature, and yet to declare everything dead without actually trying to attack a single one of them. So that was the first motivation. A second one is that all the DLP records I showed you use very special extension degrees, namely those which permit a cum extension or a twisted cum extension. And these are actually the easiest to break relative to fields of the same bit length. And that's because you can reduce the size of the factor base and also the descent becomes easier. So this leaves another question which is, how hard are the DLP's in the literature? And actually another team of researchers studied this very question, and when we looked at their paper we realised there was certain inefficiencies in their analysis that we could significantly approve upon. So that was a real motivation for this paper. And a final one is a bit of a meta consideration for this type of work, which is that sometimes if you saw a particular problem instance, you can actually gain theoretical insights, which you wouldn't have otherwise just by thinking about things purely in the abstract. And so I'll give you an example of that at the end of the talk. So the team I just mentioned who looked at this first was Ajmaniz's Olivier and Rodriguez Enriquez. And what they did was to take the techniques from Jews, Ella von Forth paper and the Quasi polynomial paper and analyse the concrete security of several DLP examples which arise from the parent-based literature, which were thought to be or were designed to be 128 bits secure. So concrete security just means you take all the different algorithms which you need to perform the computation, you implement them, and then you don't bother running them. And the reason you don't run them is because it would simply take too long to do. You can invoke several standard heuristics, and with that you can get an estimate of how difficult it is to solve a given DLP. So they looked at three fields in this paper. The first one is from the elliptic curve over F3 to the 509, which has embedded in degree 6. And what they showed is rather than 128 bits of security, using these techniques, it only has about 74 bits of security. And the unit of cost they use is this MR. It's a quasi notion of bit security. MR is just the cost of performing one modification, modulo the subgroup order of the elliptic curve in question. And the second one they looked at is this middle one here. This is a genus 2 hyper elliptic curve over F2 to the 367. This has embedded in degree 12. And again, rather than, that's not part of the talk, rather than 128 bits of security, it only has about 95 bits of security. And the final one there, it's an elliptic curve over F2 to the 1223, which hasn't been in degree 4. And interestingly, they concluded that all of the techniques do not reduce the security. So it's still apparently 128 bits of security. And, you know, this is perfectly feasible because these new techniques are asymptotically superior to the original L1 third function fields. We don't actually know the crossover. So this could still be secure. And people would still like to use it. I wouldn't recommend that. But there are several inefficiencies in their analysis. One I'll just point out here. So you'll notice that each of these cases uses a cake. This just means there's a quadratic extension of the target field. And the reason they do this is because you need to take an extension of degree at least to in order to get the relations between the factor-based elements. But what they then did was assume that the target discrete log is actually in this quadratic extension, which it's not. They're instantly trying to solve a problem which is in a field twice as big as it should be. So that was just one inefficiency, I guess. So we looked at this and we came up with a few observations and techniques and principles. And basically our contribution in this paper is to give a plan to follow if you want to attack a given DLP. I'm not saying these are the optimal ones, but they're certainly better than the ones that were there before. So the first one is that if you look at the classical descent and the eleventh and fourth descent, a basic property is that if you use a smaller Q in your field representation, then you get a faster descent. And if you use the original field representation, which basically means finding a... You just have to find an H0 and an H1 which is defined over FQ to the K. So this first polynomial here, H1 of X times X to the Q minus H0 of X, has an irreducible degree N factor. And so you need to choose a Q larger than N in order to represent such a field. What we did is just choose a slightly subtly different polynomial to just bring the Q to the inside. This polynomial then has a degree Q times the degree of H1. And so if you want to represent a field of degree N, we can just choose the degree of the HIs to be greater than 2, such that we get a Q which gives us a smaller descent. So that's what we did. A second thing we proposed is something called a principle of parsimony, which basically means do the minimum amount of work you can in order to solve the problem. So in particular, the descent should always take place in the target field. You should use this quadratic extension or cubic extension. And only when you can't work in the target field, for instance, when you're trying to solve the logs of the factor-based elements, can you make an extension of the base field? So that's necessary in some circumstances, but you shouldn't do it if you don't have to. So the third thing is the observation that if you do have to extend the base field in order to get the factor-based logs, then actually you can use this to reduce the cost of the descent. So if you have a quadratic extension, for instance, then during the descent, if you have an irreducible element of even degree, at any time you like, you can just factorize it over the quadratic extension, thereby halfin the degree automatically. So that speeds up and we use this judiciously during our descents and our estimates. And finally, it's actually possible to get the factor-based logs without taking an extension at all, just using k equals 1. And this also means that we can use the element on fourth techniques to eliminate elements of a higher degree than previously. And as a result, we didn't actually need to use any parts of the quasi-pollinomial algorithm at all. It's asymptolically very efficient, but it's not actually necessary in this case. So as a result, what we showed is that in this elliptic curve over F2 to the 1223, which the previous team of researchers still had 128 bits of security, actually only has 59 bits. And in this genus 2 high-pliptic curve over F2 to the 367, rather than 95 bits of security, we show that it only has about 48 bits of security. And the time on the right there is actually the time required to solve the discrete log problem. And we did that in practice. So let's give a couple of details here. So this is the genus 2 high-pliptic curve, super singular. We take this representation for the degree 367 extensions, and notice we're using the alternate polynomial here, where q is 2 to the 6, rather than 2 to the 12, which makes the descent much faster. And I guess the most interesting thing in this solution of the DLP was the small degree elimination. So here's a flow chart which tells you exactly how we eliminated elements, irreducible elements of a given degree over F212 on the bottom row and over F224 when we needed to on the top row. So I won't explain all this in all its detail, but I'll just point out a couple of things. So you have a degree 1 element over F212, but we can just lift this to a degree 1 element over F224, which is where we solve the factor-based logs. So those logs are automatically known. If we have a degree 2 element, this is irreducible over F212. If we just factorize it over F224, again, this splits, so we have the logs of those elements as well. And we can perform the same trick for degree 4 to degree 2. We just factor over the extension, and we could do it for 6 to 3, but we didn't there because we found it faster to descend along the bottom row. For 8, we just go straight to 4, and then we can descend along the top row. So there's lots of kind of nice tricks to get everything, and all of these probabilities kind of balanced out, and it's all very nice. So we ended up solving this in about 50,000 core hours. And I should just mention a couple of days before we did this, before we announced this, the team of Agitel solved the first instance of a DLP arising from parameters in the literature, but it was only for a 1,303-bit field. So it was more of a proof of concept than really trying to attack something that was meant to be 128-bit secure. So I wanted to mention a recent result of ours, which really grew from that small degree elimination flowchart I just showed you. So assume we're going to try and solve a discrete log form in a field FQ to the KN. We consider this as a degree N extension of FQ to the K. And we only have two tools available. The first one, we'll assume, is the polynomial time algorithm for finding the logs of the degree 1 elements. So assume that's done. That was in our crypto paper and also Antoine's newspaper. And the second thing is to assume we can take a degree 2 element and we can eliminate it, which basically means writing it as a product of degree 1 elements in polynomial time, which is also in our crypto paper. And that's all we're going to do. So let's assume we have a degree 4 element. Well, how are we going to eliminate this? Well, what we can do is use the trick from the previous slide. So we just take a degree 2 extension. This gives us a product of 2 degree 2 irreducibles. We can then apply the polynomial time elimination from degree 2 to degree 1. But we don't know the logs of the degree 1 elements over the quadratic extension. So what do we do? We just take a norm back down to the original subfield. So the degree 2, we just eliminate it over the quadratic extension. We apply the norm, gives us the original degree 4, and then the degree 1s, they give us either degree 2s or the square of a degree 1. So then we apply the degree 2 to 1 elimination again. We end up expressing the degree 4 irreducible. That's the product of q squared degree 1 irreducibles. And we can do the same trick for an irreducible of degree 8. We take a degree 4 extension. We apply the elimination from degree 2 to degree 1. We take the norm back down to the quadratic subfield. We tick-tack our way back down until we get an expression in terms of, well, you have q cubed degree 1 elements expressing the degree 8 irreducible. The same thing for 16. And any power of 2 we like, we can just go up and then just tick-tack our way back down, eliminating taken norms, eliminating taken norms. So we end up expressing any irreducible of degree 2 to the e as a product of q to the e to be 1s. So this is a quasi-polynomenal algorithm, and it's completely different to the one from Barbara Leskiew at L. The problem is it only applies to elements of irreducible elements of degree of power of 2. We do this for any element just by taking a random multiple of the field defined in polynomial, such that, and we add it to the target element, such that this has degree 2 to the e, and we choose 2 to the e to be greater than 4n, such that we can apply theorem due to 1 on, it's a Dirichlet-type theorem on prime-synarthometric progressions. Then we get an irreducible element and we can apply this descent. And so we get a new QPA in fixed characteristic. And interestingly, because this method, this descent method is very algebraic, we can actually argue that it relies on no heuristics whatsoever. As soon as we have a field representation, where the degree of HI is at most 2, then this works. And so we get a theorem. I run out of time, but I'll quickly say it. So for all primes p, there exists infinitely many extensions, fp to the n for which the DLP in this field can be solved in quasi-polynomenal time. And this is the preprint, which will be available very soon. And thanks for your attention.


In just a moment, we will bring you the old Fall River line starring Brian Donlevy on the Cavalcade of America. But first, here is Gain Whitman for DuPont. When the leaves come down in the fall, the rugs come up, Hall House Cleaning. And there's no better way to brighten your home than with DuPont Speed Easy, the easy-to-use wall paint. It goes on easily with roller-op brush and dries to a velvety finish in an hour. Speed Easy is an oil emulsion paint, thinned with water. It costs less than $3 to paint an average-sized room. And it comes in white and 11 harmonious colors. When you are thinking of house cleaning, brighten tired-looking drab walls with Speed Easy. Ask your DuPont dealer for this product of better things for better living through chemistry. America, the Pony Express, the Covered Wagon, America, the Steam Boat, America means skyscrapers and haylofts, the crack of a pioneer's flintlock and the sound of the Riveter's Machine, the glow of a fireside and the glare of a blast furnace against the midnight sky. America is your story. America is you and everyone you know. Tonight the DuPont Company, maker of better things for better living through chemistry, presents Brian Donlevy in The Old Fall River Line on the Cavalcade of America. For 90 years, the Fall River Line sent its steamers down Narragansett Bay around Point Judith through the waters of Long Island Sound. Presidents and farmers, businessmen and adventurers, brides and grooms, they all took the Fall River Line to Boston or New York or Newport or Fall River. Our story opens as one of the steamers, the Priscilla, nears New York. In the captain's cabin, a gray-haired man gathers his belongings. It is his last trip on the steamer he has commanded for 10 years. He is about to leave when... Come in. Captain Hamilton, we're almost to New York, sir. Oh, come in, Mr. Carter. Thanks, sir. I... I mean Captain Carter. You'll have to get used to hearing yourself called, Captain Ed. Yeah, I guess I will. Can I send you any of your things? No sense in you taking it all off tonight. All right, Ed. Some things in my desk I want to take along tonight, Joe. What's that? Oh, just an old tin box. But there's 45 years of steamboating in it. I don't understand. Look at this. I guess you'd call it junk. Nothing in here worth anything to anybody but me, except maybe this. A quarter. That the first one you ever earned? Well, something like that, Ed. It was when I was a kid, working on the line. No gold braid then, and no gray hair. I was cleaning the afterdeck, cleaning it at night because it was the only time I could get at it. Handling a brush and a bucket wasn't my idea of romance on the steamer. What's the matter? Yes, sir, Hamilton. I... Yes, sir. Get a move on down there. That going to take you all night? No, sir.  Who's that? Oh, just a passenger. Oh. You tired of doing that sometimes? Tired? Just let me set foot on land and I'll never want to see one of these tubs again.  I sure do. Going to that job pretty well. Can't hate it very much. Look, mister, to me, it's a job to get done and the quicker it's over, the better I'll feel. Oh, well, maybe you don't feel like talking. Oh, I don't mind. Go ahead. The passenger is always right. You're pretty bitter. And why don't you like your job? Because it's not what it's cracked up to be. Steamboats, romance, yeah. Work your way to the top, they said. The only place I'll work to is the hull of this tub and that's by where and through of this brush. That's a wonderful sound, Mr. Hamilton. Oh, there's a lot of steam blowing through a whistle. Oh, you're wrong. It's America. America? What's your first name? Dan. Well, look, Dan, to you, that whistle's just steam. But to me, it's America. Just like the four river lines, America. Eh? I don't get it. You will. You will when you see and hear beyond the steam and the whistle. You'll get it when you remember the years that have passed and look to the years ahead. You see, Dan, not too long ago, the water we're going over now was once part of a wilderness, a wilderness that looked impenetrable, a barrier to Americans. But it didn't stay that way long, Dan. We broke into it with our eyes fixed ahead, building a new country where we could look ahead, where we could build. You see? Well, I don't know. What's that got to do with me? I'm a deckhand. So was I. On river boats in Ohio.  What chance have I got? I was once a carpenter. I worked hard at it. Oh, well, maybe a word. But what's all this got to do with me? Just a moment. Here. Hmm? Here's a quarter. Thanks. Oh, it's not to spend, Dan. That's not where I give it to you. Well, then what's the idea? Just look at it for a long while, Dan. Study it. And you'll see why I've talked the way I have. And maybe what you'll see there will give you the answer to all your questions. It'll tell you why scrubbing a deck now is all right. Oh, thank you, sir. I've been looking for you. Your cabin's ready. Thank you. Good night, Dan. I enjoyed our talk. I, uh... Hey, you. Wait a minute. Yes, what is it? Who was that? Are you joking, youngster? No, I'm not joking. I couldn't see him. Who was it? That? That was the President of the United States. It was a long time ago, Ed. Yeah, but the quarter? Well, I looked at it a long time. I wanted to ask him what he meant, but I couldn't get up the nerve. But I finally found out, Ed. What? On the day they made me a steward, a step up. I took another good look at the quarter, and something hit me right between the eyes. I knew what made it possible for me to be a steward and not stay a deckhand. One word stamped on this quarter. Liberty. I see. But, Dan, the rest of this stuff, it wasn't all given to you by Presidents. Oh, no, Ed. Lots of other people traveled on the Fall River Line. It was like a cross-section of America. Uh, what's this? Oh, that's Songsheet? Yeah. You've heard this song, Ed, the old Fall River Line. Harry von Tilzer wrote it. Well, what's it doing in this box? Well, there are two people mentioned in it. Dan and Susan. You? That's right. Me and Susan. It was right after I'd been made Captain of the Bristol. Yes, I got to be Captain, took 15 years, but I was still young. I guess the gold braid and the brand-new uniform puffed me up a little. Well, anyway, I was standing on the afterdeck. We were a little late in pulling out over an hour, I guess, when all of a sudden I heard... Oh, Stuart. Stuart.  Are you talking to me, Miss? Well, there's no one else around, is there? No stewards, anyway. Oh, you... Is something funny, Miss? Oh, I called you Stuart. I heard you. You looked like a Stuart. I happened to be Captain of the Bristol. Oh, yes, yes, I see now. It's in gold braid on your hat. It's really the only way I could tell. I'm sorry, Miss. You'll have to go forward. No passengers allowed back here until we're out. Why not? It's the rule. Who made it? It's the rule of the line. Well, it's a silly one. Why aren't passengers allowed back here? Because they might get hurt. Are you really the Captain? I thought all captains had whiskers. On the return trip, I'll wear a false beard. You're not very nice. Look, Miss, I'm very busy. We're over an hour late getting out now. Oh, that's what I want to ask you about. Will we be late getting into Fall River? Possibly, yes. But my aunt's giving me a birthday party. Congratulations. You aren't very nice, are you? Miss, may I ask you again to go forward? How long have you been a Captain? I've... Four days. Oh, and such a big boat. My, I'll bet you're proud. As Captain, I ordered you to go forward. Passengers aren't allowed back here before we start. I know, it's a rule of the line. Then please obey it. I believe you're angry with me. I'm not. As a Captain, I don't lose my temper with passengers. Is that a rule of the line, too? And a good thing. All right. I hope we meet again, Captain. More than I can say. You're having trouble with her, Captain. What? Oh, no trouble at all, sir. Well, I'm Mr. Warren, the new president of the line. Oh, glad to know you, sir. I'm Captain... Yes, yes, I know. Pretty, wasn't she? Who? Oh, who's that girl? I didn't notice. Oh, nice blue eyes, gold hair. And the spoiled brat. I think she got your goat. She did not. I mean, she didn't. Well, perhaps not. But somebody ought to give her a spanking. I told her three times. No passengers were allowed back here before we sailed. Oh, well, I'd better go then. Oh, no, no, no, sir, that's all right. You're not getting in the way. You sure? Yes. People like that girl that annoy me. They refuse to believe that they're not allowed to do anything they want to. You can tell them in a second. Spoiled, selfish, think they own the world. If that girl was my daughter, I... You would be an awfully young father. Yeah. Anyway, somebody ought to teach her a lesson. Why don't you? I'd like to. And then let me know how you did it, eh? What? I've been trying for 20 years. And she's my daughter. Captain Hamilton. Oh, good evening, Miss Warren. Our passengers are allowed here. Of course. Excuse me, I... Oh, please, don't go. I'm awfully sorry, Captain Hamilton. That's quite all right. Well, but it isn't. I was nasty earlier this evening. But, uh, I'll tell you a secret. Secret? What? I did it on purpose. What for? Well, when I came aboard, I saw you standing there, and you looked... Well, you looked like somebody who ought to have a little of the conceit taken out of him. I'm not conceited. Now, if you'll excuse me. Don't run away, please.  Oh, that's better. You look much more human when you laugh. But, uh, what made you say I'm conceited? Just the way you looked. So proud. I am proud, Miss Warren. You may call me Susan. All right. You said you were proud. What else were you going to say? Well, it wasn't pride in myself, but in what I'm doing. How? Well, I don't know exactly how to say it, but there's something that makes me feel proud when I come aboard my ship, not because I'm the captain, not because the Bristol is a great ship, but because the Bristol... the whole Fall River line is like America. That's nice. Go on. Well, you see, Susan, 15 years ago a man told me something where I heard just a whistle. He heard the voice of America growing strong, building. I'm part of that now. I'm helping. No, I like you very much. Thanks. Do you, uh, do you make the trip back on the Bristol too? I make all of them. Why? You know, I think I'm going to take quite a few trips on the Fall River line myself. You wanted to see me, Captain Hamilton? Uh, yes, Mr. Frailing. I, uh, have you the passenger reservation list? Yes, sir. Right here. Everything filled for the next trip? Oh, not quite, sir. Oh. Is, uh, is there anything wrong, sir? Oh, no. I, uh, I've been captain now for seven weeks. That's right, sir. Hmm. In that time, we've had quite a few couples in the bridal suite. Almost every trip, Captain. I, uh, is, is it reserved for the next trip? No, sir, it's not. Well, then make a reservation for it. Name, sir? Uh, Captain and, and Mrs. Dan Hamilton. You are listening to Brian Donlevy as Captain Dan Hamilton in the Old Fall River line on the Cavalcade of America sponsored by the DuPont Company, maker of better things for better living through chemistry. As the second part of our story opens, Dan Hamilton retiring after 45 years' service with the historic Fall River line is telling his successor how he rose from deckhand to captain and found not only opportunity, but romance. Yes, Susan and I were married. Harry Von Tilzer and his partners wrote that song about us. What's that you got there? That, uh, that's just the cabin boy's hat. It belonged to a kid named Tony. Oh? What's the story, Dan? Well, Ed, I guess it was Tony who, well, it was one night, the Bristol it was, on the run from New York to Fall River and we were well out in the sound and I was on the bridge with the watch. Half point starboard, Mr. Appleton. Half point starboard, quartermaster. Half point starboard, sir. Steady. Steady, sir. Nice night, Mr. Appleton. Yes, sir. Captain Hamilton, sir. Hiya. It's your cabin boy, sir. Tony's collapsed. Tony. Looks like a appendicitis. We've got to get him to a hospital, sir. Well, do you think he can hold out until morning when we dock? He's pretty sick, Captain. No doctor aboard. Has anything been done for him? Well, we're taking him below and trying to make him comfortable. Pain seems to be letting up a little. Mr. Appleton. Hi, sir. What speed are you making? Eight knots, sir. Hi, Mr. Appleton. Hiya, Captain. Captain Hamilton. Hi. Just pick this one up over the wireless, sir. SOS, the steamer Boston. Eastern Steamship Company is on fire. 600 passengers aboard. Position? Dead astern, sir. Distance about 50 miles. Mr. Appleton. Hi, Captain. Bring her about. But Captain, what about Tony? If we delay our arrival and fall river, it'll mean his life. Mr. Appleton, there are 600 people aboard the Boston. I know the routes and the latest estimated positions of ships along them. We happen to be the closest to her. But Tony's one of us, sir. Can't some other ship go? We can sacrifice 600 lives, Mr. Appleton. Or we can risk one. But you're talking about one of your own crew, sir. Have you ever seen a ship on fire at sea? No, sir. You will, Mr. Appleton. Bear a hand now. Bring her about. Hiya, sir. Quartermaster. Quartermaster, aye. Bring her about. Put your wheel over. Hiya, sir. Steady as she goes now. Steady as she goes, Captain. Mr. Appleton. Full speed ahead. How are you feeling now? Oh, I'm all right, sir. You just go ahead to the Boston. Don't worry about me. Oh, you know? Yeah. I heard the men talking. Rest easy. Rest easy now. Well, we make the Boston in time, sir. I think we will. Good. Good. Tony, I... Yes, Captain? Well, I just want you to know I'd have done anything to save you, and then that SOS came. 600 lives out there led, or... or yours. I was in a spot.  It was right what you did, sir. Thanks, Tony. It ain't me, sir. I... I got the thinking. I'm one person. That there's 600 on the Boston. A life is a life, Tony. Sure, I know that, sir, but I got the thinking about my folks. They came over here from Europe. Pop... Pop used to tell me how it... it made everything different. I got to go to school. Something I never would have been able to do if I hadn't been here. I got a job. A job doing what I wanted to do, not something I would have had to take. And all of a sudden, lying here, I knew why. Why, Tony? Because it's all the people that count. Not just one or even a few. It's all of them, sir. All of them. Everybody having the same chance. So, I figure, what's one against 600? You did right, sir. You made it to the Boston in time, didn't you? Yes, we did. And Tony? He... he didn't make it. Oh. Well, there are lots of other things in this box. Come in. Captain Hamilton, we're pulling into New York. All right. Thank you. Will you come in at the salon, sir? Salon? Something wrong? Oh, no, sir, but, uh... Well, will you come, sir? Come on, Dan. Now, wait, if this is... Oh, please, Dan, come on. All right. My head. What's all this? You didn't think you were going to leave cold, did you? Quiet! Ladies and gentlemen, you all know Captain Dan Hamilton, so there's no need for me to introduce him. Tonight... tonight he made his last run on the Fall River Line. And in a few minutes, he'll get down the gang plank for the last time as captain. But, well, Dan, here, we want you to accept this watch from us and from the line. I guess there are a lot of words the man could say at a time like this, but I... I can't think of any of them right now. Just... just thanks. Goodbye, Ed. Take good care of the Priscilla. I'll, uh, walk down with it. No, no, please don't. You stay here. I... I think I'd rather walk off alone, Ed. All right, Dan. We'll be seeing you. Sure. Sure you will. Our passengers are loud back here, Captain Hamilton. Susan! Come on, Dan. I'll walk off with you. All right. Didn't want to go in the salon, Dan. I would have cried. I know... Susan, I should have said something in there, something about the line, but I couldn't. Now, I can, to you, because you know what the Fall River line meant to me, to everybody who sailed on it. It wasn't just a line or boat, Susan. It was America. It grew. People made it grow the way they made our country grow. I'm leaving it. But I'm leaving it to men who'll go on from where I left off. That's what makes America great, Susan, because there's always somebody to carry on, to remember our traditions, and to keep them alive. In a moment, our star, Brian Dolneby, will return. But first here is Gain Whitman speaking for DuPont. Have you had trouble this past summer with bread turning moldy in the bread box? Good heavens, no. The radio announcers ask the most embarrassing questions. Moldy bread, not in my house. I'm glad of that. But you used to find moldy slices now and then, down at the end of a loaf of bread, didn't you? Well, a few years back, yes. The reason you've been having less trouble with your bread turning moldy these past few years is because chemists have developed mold inhibitors called propionates. Bread is one of the oldest foods we have and one of the very best. The Bible calls it the staff of life. Its very name has come to mean food. We speak of a man earning his bread when we mean earning his living. But all too often in the past, the golden loaf that reached you fresh and tasty from the bakery soon grew spots of mold. It happened usually on warm, humid days. It happened quite often in families where there were still four or five slices of bread left over for a few days. When that happened, what remained of the loaf had to be thrown out, wasted, and bread is nothing to waste, not these days when the world needs food. So a chemist in the baking industry went to work on the problem of keeping mold from attacking bread for just those extra couple of days that would let you use the whole loaf. He found that some foods contained a mysterious something. Nobody knew just what it was which retarded mold. And at last he discovered the mysterious something, propionates. The DuPont Company manufactures calcium and sodium propionates and supplies them to your baker today under the trademark Michael Ban. As a result, the bread you buy stays good longer, saving food and saving money. Because the Michael Ban has no taste, you don't realize it's there. But it's chemistry at work, serving your welfare. Michael Ban is one of the DuPont Company's better things for better living through chemistry. Oh, here is our star, Brian Donlevy. Thank you. Thank you, John. I've been on Cavalcade several times now, and it's always been a great kick to play the men who helped build our country. Pioneers who gave us everything we have today. There's a story coming up for next week's Cavalcade about another pioneer. I wish I could play the part, but it would be a little tough because it's about a 12-year-old boy, and I gave up those parts a few years ago. But John Heaston will tell you about next week's Cavalcade, John. Next week, the DuPont Cavalcade brings you Skippy Homeyer in one wagon westward. It's the inspiring story of John Sager, 12-year-old American pioneer. Alone and unaided through sickness and hardships across the unknown wilderness in a covered wagon, young John brought his brothers and sisters to Oregon in safety. Be sure to listen next Monday to One Wagon Westward starring Skippy Homeyer. Daylight saving time ends in certain areas on September 28. This may change the time at which the program is heard in your community. Please check your local paper for the time will be heard next week and each week thereafter. The music for tonight's DuPont Cavalcade was composed and conducted by Robert Armbrister. Our Cavalcade play was based on research made available through the courtesy of the New York, New Haven and Hartford Railroad, operators at the old Fall River line for almost half a century. Brian Donlevy may currently be seen in the Walter Wenger picture, Canyon Passage, a universal international production. In the cast with Brian Donlevy tonight were Mary Jane Croft, Carl Frank, Clayton Post, William Johnstone, Jerry Hausner, Sidney Miller, Herb Rawlinson, Ken Peters and Theodore Van Elks. This is John Easton inviting you to listen next week to Skippy Homeyer in One Wagon Westward on the Cavalcade of America. This is NBC, the National Broadcasting Company.