coming to you live from public's always organic if it's a choice i'm gonna film my eye makeup on camera good morning guys i am so stressed out right now because as you can see half of my room has like all of my boxes and bags and um trash bags full of like clothes and stuff like that it's not gonna be fun i actually went to athens for almost a week i was there to see ryan's brother and his brother's girlfriend graduate so i literally just dropped off my stuff here grabbed sofi and then went to athens and stupid me forgot my vlogging camera like i literally forgot my whole purse like my secondary purse i had my wall and everything and my little satchel thing i felt so stupid for getting my vlogging camera like that's so unlike me so i couldn't vlog there and that was really sad because like i feel like we made you know quite a bit of memories there but it's okay because we're gonna go back to athens like a couple times this summer i think so since i didn't bring my vlogging camera i decided to make a little short instagram story with my big camera and it's just kind of like a little mini guide to athens and i thought it would be really cute to show you guys so here it is we start unpacking i don't even know how because in my mind i feel like well i'm just gonna like i have to repack everything and go back to orlando so soon but it's not like actually soon it's like in august but like i don't know i just really don't want to unpack but i have to since i am moving into um my sorority house next year which also i guess i didn't really explain this in my um vlog about the apartment um advice one but basically i am moving into my sorority house because being on council you actually kind of have to or get the privilege to honestly because it's really competitive to get in the house so council gets like first pick of rooms and stuff like that so that's really cool and at first when i came into the sorority i was like no i'm not living in the house because i have to share a room with another girl but honestly i get lonely so easily and i just feel like it's gonna be a lot more fun when i have a roommate and so many other girls like just like knock on their door and be like hey what's up like let's talk you know what i mean so i'm really excited for that but the only thing is that i'm gonna have to downgrade a lot as you guys know i have like all my tech equipment and stuff like that which normal people don't have i'm like just not normal and another reason why there's so many trash bags on my floor right now with clothes in them is because i brought so many winter clothes down to orlando and that was such a mistake it's only cold for like maybe a week in orlando so i was very dumb when i did that because i brought so many like big chunky sweaters and like scarf blanket things and it just took up a lot of room so i'm glad i can take them home and just like leave them here um for the next winter this morning i went to the gym with ryan and then we swam a little and it felt so good to be in a pool i love swimming so much but it was like weird because it was like kind of cold outside and like this whole weekend it was like actually freezing here in georgia and i was just like did i jinx it because when i left orlando i was like oh such a good time to leave it was like burning out there but now it's like super cold up here i don't know i'm just very confused right now but today i'm going grocery shopping with my mom and i did want to eat a lot healthier this summer and like actually try to lose weight like last summer um because i don't have my sorority meal planned so i need to go to the grocery store and uh get some you know food veggies fruits all that stuff and i know some people like grocery holes so i'm gonna definitely do one later today and then i have to fix my freaking phone let me just show you if i didn't have a screen protector it'd be like probably stabbing my thumb and it's not like super bad and it was already cracked but like today i dropped it and it cracked even more honestly i was just waiting for it to like shatter more so i can get it fixed and i just found out that i had the sprint total repair plan thing so i'm wondering how much it costs to like actually fix my phone screen and hopefully i can get it done like today in less than like an hour that'd be like so nice i also want to film a video on this palette so coastal sense actually sent me this palette so i wanted to do like a little review for you guys just because i want to put out as much content as i can over the summer so i thought it would be like a cute idea to do just like a mini eye tutorial um and so it has like all these really cool shades it's like cool tone which is kind of out of my comfort zone but i thought it'd be cool to just do something different because i literally always use my morphe 3 5 0 palette i bet you guys are so sick and tired of like seeing that in my videos so um i'm gonna do a look with that and hopefully i can pull it off i feel like the last time i wore cool tones was seventh grade but who knows i got better at makeup so maybe it will look a lot better hopefully also if you guys are interested in this palette i'll have a link down below to it because it's their new palette it actually launches on may 9th so i think it might be launched by the time this vlog is up i just have so many blogs to catch up on so definitely check out this palette if you are into cool tones coming to you live from publics we have a lot of stuff you know stocking up for the summer got some what's it called this detergent and stuff like that and my mom's helping me with all the healthy stuff okay guys so i just went shopping we went to publics i'm gonna start with the frozen stuff first so we can get that in the freezer um so my mom got these these are like clobby's pops dark chocolate they're like kind of weird tasting i just tasted it and i really like it but she wanted them so that's hers so this is raspberry and mango these are for me there's the same cloby pops things and each one is 60 calories then i got some like cheese broccoli things i think there's like four in here and they're just like cups that you can just stick in the microwave 40 calories apple gate honey and maple turkey rests my mom always says don't get the ones with nitrates in it always organic if it's a choice always organic they're not because it's more expensive then this is really exciting we actually got acai is that how you say it okay and this is like the pure acai one there was also one with like kale in it but i just want to try this first this is gonna be really exciting because i've never like made an acai bowl myself i went to brazil i think we had pure it was like really good but like the acai bowls like the smoothie bowls type things they're not like that it's weird when you buy it like i like places here then she got me cauliflower rice with like vegetables in it and stuff so i can make it like fried rice this one is like sweet potato cauliflower fried rice so that should be cool i got two frozen organic strawberries for my smoothies in the morning so then we got stock i saman then i got this chicken breasts they're individually packed so they're going to be really easy to cook hopefully my dad specifically asked for this brand of eggs malleys free-range eggs so we got enough baby arugula baby spinach but we got some bell peppers then i got some balsamic vinaigrette it's like the blueberry one i don't know how it's taste but my mom recommended it then we got white cheddar and we're about to eat this right now it looks amazing it's like Hawaiian tuna roll Hawaiian roll tuna look how freaking good that looks for like a public's role like are you kidding me then i got sweet potatoes because i've seen like the like toast like you can cut them up into like red toast things and you can like eat them as like avocado toast so i thought that was cool and you don't really have to eat like bread and like feel super fruity caught cheese low fat organic feta cheese for salad baby sweet grape tomatoes for like omelets and stuff spaghetti squash because i've always wanted to like try this because i've always seen like tasty videos with this also wanted to try this for a while these are like dried coconut things and then i got orzo because i've seen like a lot of cool like pasta salad recipes with this red grapes some kind of apple i decided to try something else other than honeycrisps apples i was really upset about it but honeycrisps are just just like stupid expensive and i got bananas raspberries blueberries mozcatos pomegranate lines and parchment paper because it's more environmentally friendly than aluminum foil yes so this bio degrades a lot easier than aluminum foil okay and that's it for a grocery haul except for like detergent and stuff that that's kind of boring so i'm not gonna show you guys but we are gonna go eat our sushi and then hopefully go to a sprint store right there hopefully going to fix my phone in less than an hour we'll see about that so we just got to north point mall and we didn't realize the sprint store was in the mall we're just slightly annoying but also if it takes a long time then we can just like walk around in the mall i haven't been here in a while so we went into north point mall and the sprint store wasn't there honestly it probably used to be there and then it's just not anymore since that phone number didn't work i don't know but it wasn't there and then we found out this is the only closest one and it was like not even close to us so this one that repairs repairs yeah this one is the closest one that repairs phones and then we found out that i'm probably gonna have to send my phone out because there's an iphone 7 plus and they don't fix them in store so hopefully they have a loner phone for me and if not i could just use my old iphone but i mean it just be easier since so they can like do it all in store because i didn't really want to go back home and get my other phone so we are at the sprint store pretty far away and hopefully we can get this done really fast because i want to go home and film the video before i hang out with my friends tonight so i'm doing my makeup right now and actually i'm going to film my eye makeup on camera i wanted to do like a quick tutorial because i feel like i don't really do like just eye tutorials and i always repeat like all my products like makeup for every age she stick you know derma blend setting powder you guys know so unless i'm gonna do like an everyday makeup routine i feel like i should just like maybe just do the eyes because that's like what's gonna be different so i'm just finishing up my face makeup really quick i'm gonna do bronzer next when i was packing i went through like all the makeup that i don't use and this was in it the casino bronzer by nars it is honestly like one of the most perfect shades for me i don't know why i stopped using it i think i was just being like greedy because it hit pan and i don't know i didn't want to use it anymore i guess because i don't want to buy anymore because it's pretty expensive it's like more than 40 and i don't know it's just such a pretty color but i also do like a darker bronzer so i usually go over it with the darker bronzer but i just think it's like if i wanted like a natural bronzer this is like the best one for my skin color and again it's um casino bronzer by nars but yeah that's like almost the only thing that's really different from my face makeup routine so far so i forgot my vlogging camera because i ran out the house i actually was trying to edit majority of the video because i want to get this video up as soon as possible but right now i'm on my way to my friend jill's house but i'm not sure if i'm gonna vlog that much just because i haven't seen all my friends in a while and i kind of want to like you know enjoy it i'm starving um jill is actually making us burgers so that sounds really really good i'm probably gonna opt out of just like the bun part just to save a little bit of calories and carbs there but i think she's making baked beans too and when i was at um mike's graduation ryan's brother's graduation we actually ate at the bolton dining hall in uh uga and they had baked beans and i swear i haven't had baked beans in like forever and so i had to get them and i i literally couldn't stop eating them they were so good


I started taking classes about six months after I started here. I was sponsored by my boss at the time who recommended that I go to Blackhawk for the industrial maintenance program. My name is Samuel Hoffland. I started in 2021. I am doing the electrical assembly of our proprietary thermoformers. I've actually worked here the longest consecutively and I brought my little brother along. My name is Elijah Hoffland. I am a CNC set up technician at Prince Corporation. No, I didn't stop there. My older brother actually applied for a management position, which he got. Everyone in my family actually heard about how good it was and so one after the other we just kind of followed each other here. My mother actually started as an inspector packer. My dad actually retired after 35 years at Frida Lake to be able to pursue the job he's in now here. So it was definitely a very good career opportunity. Yeah, we all kind of take pride that we worked at Brent Corporation and we also take pride that we all have gone to Blackhawk for their courses and just learned a lot from them. My older brother did the one year program of industrial maintenance. My little brother's actually going to school for CNC and my dad is getting his CDL from Blackhawk as well. It makes me feel very valued by the company because they recognize, drive and desire to work hard and improve myself not only just for the company's sake but for my sake. They're really investing in my future and so that makes me feel very much appreciated.


Hi and welcome to the session. Let us discuss the following question. Question says, find all points of discontinuity of f where f is defined by fx is equal to 2x plus 3 if x is less than equal to 2, fx is equal to 2x minus 3 if x is greater than 2. First of all, let us understand that function f is discontinuous at x is equal to a if f n side limit is not equal to right hand side limit of the function at x is equal to a. Now we can say limit of x tending to a plus fx is not equal to limit of x tending to a minus fx. This is the key idea to solve the given question. Let us now start the solution. We are given fx is equal to 2x plus 3 if x is less than equal to 2, fx is equal to 2x minus 3 if x is greater than 2. First of all, let us consider fx is equal to 2x plus 3 if x is less than 2. This is given in the question that fx is equal to 2x plus 3 if x is less than 2. Now clearly we can say this is a polynomial function and polynomial function is continuous at every real number. This implies function f is continuous at all real numbers less than 2. We are given fx is equal to 2x minus 3 if x is greater than 2 real function and below polynomial function is continuous at every real number. This implies that function f is continuous at every real number greater than 2. Let us now check the continuity of the function at x is equal to 2. Clearly we can see the function is defined at x is equal to 2. So we can write fx is equal to 2. Function f is defined. Let us now find out the limit of the function at x is equal to 2. First of all we will find left hand side limit of the function fx is equal to limit of x 2 minus 2x plus 3 is equal to 2 multiplied by 2 plus 3. On simplifying we get 7. So we can write limit of x tending to 2 minus fx is equal to 7. Let us now find out right hand side limit. Limit of x tending to 2 plus fx is equal to 2 multiplied by 2 minus 3. On simplifying we get 1. So we get limit of x tending to 2 plus fx is equal to 1. Here we can see left hand side limit is not equal to right hand side limit. So by key idea we get the function is discontinuous at x is equal to 2. So the given function f is discontinuous at x is equal to 2. This is our required answer. This completes the session. Hope you understood the session. Goodbye.


you have critics like Michael Schellenberger, who I think makes a very powerful case that we're not doing what Portugal did, and instead we have a disaster unfolding that is likely to blow back on those of us who wanna see the drug laws liberalized. Zach, can we run that clip? I think you could get rid of drug dealing or drug use without a severe curtailment of our civil liberties, which nobody, not even the most fascist really in our society would support, but you can disallow open drug scenes, which is the homeless encampments. You can disallow open air drug dealing. It's hard, but it is, we do know how to do it, which is that you basically suppress any, if you see one dealer and one addict making a sale on the street, it's not a priority for police.  And so when you shut that open air drug scene down and open drug dealing down, it massively improves the security of the neighborhoods. So this speaks to a fear that I've seen a lot even when we were mentioning we're gonna have this conversation. It's been expressed in the comments that if you decriminalize all drugs in America, every city is gonna turn into San Francisco or Portland and there's gonna be tense cities everywhere. So does that need to be part of the conversation with drug decriminalization? And how do you address that? Well, I mean, yeah, it was something that Michael Schellenberg was saying, when it comes to the issue about the open air drug markets, that's one conversation. And then it comes to what do you do about all the people who are using drugs and others?  So I think that when it comes to, like Michael's coming out against, Michael Schellenberger became a leading opponent to safe injection sites, right? The supervised consumption rooms. That just seems the opposite of what he's talking about about public drug use. What we know, based upon decades of evidence from 60 cities around the world throughout Europe, Australia, Canada, et cetera, is that when you open up a safe injection site, it was now called an overdose prevention center, supervised consumption room, right? That basically, which are essentially needle exchange programs with a back room and a nurse where people can't get their drugs there, but they can bring in drugs they've obtained elsewhere and then use them there. What you find in the evidence is first of all, it eliminates overdose fatalities, right? There has not been, there have been, I think tens or hundreds of thousands of people who have now around the world had suffered an overdose in one of these facilities, not one of whom has died. Never mind the people who would have died out on the streets, right? Secondly, what it does is it enables people to begin to improve their health, right? There's a kind of quiet place where they can be, right? Where they're not on the streets, right? Where they're behind and they can get a cup of coffee, maybe wash their clothes, maybe talk to a counselor, you know, and have a safe place to use their drug and then chill out somewhere, right? Thirdly, the evidence shows that they significantly reduced the public nuisance, the open-air drug problem. You find fewer used syringes on the streets when you have a safer injection site, you see less of that kind of drug dealing because the consumption sites have an incentive to try to keep the people who come to their facilities from being involved in drug stuff on the streets, right? So though his opposition to supervise consumption sites just as antithetical to everything we're talking about, including what he and I and everybody else agrees with, which is that you can't allow open-air drug markets. Now the question about open-air drug markets, that's a different one. You know, and that's something where I look, for example, at what happened, another European model, they called it the Frankfurt model beginning 30 years ago where they had a major problems in open-air drug dealing and drug using in some of the parks in Frankfurt and other words. And what the mayor did was basically set up a Monday morning group where she had to head a police, the head of prosecution, the head of health services, the head of social services, the head of housing services and a few of the top people. And at that meeting, it was like, okay, what's the focus here? And the police would say, well, we're thinking of having a little crackdown on this neighborhood there. You know, and then the quite mayor would say, well, so what are we gonna do with the people that you're picking up? And then it would be, well, can housing take them? Can this take them? It was a coordinated policy of the sort that for example, Mayor London Breed in San Francisco has totally abdicated, has totally failed, right? It's a nobody, I mean, I was just in San Francisco last week, you look at the open air scenes going on there and it's unsightly, it's problematic, nobody wants to accept that. You look what happened in Europe and I think somewhat this happened in New York as well. A lot of that, remember New York used to have big open air drug markets, right? Part of what happened was a policing strategy which pushed people off the streets. I mean, a de facto policy that said that if drug use or even selling is happening behind closed doors and we're not getting complaints, it's not open air, it's not messing with a sense of community security, we're not getting complaints from neighbors, then that becomes a low priority for us. The key to dealing with open air drug markets is not getting rid of drug use, because you can't do that or you can only try to reduce it through other programs. The key is pushing that stuff indoors in ways that don't harm the rest of the community, right? That's the, in Rotterdam they called it the Rotterdam like dealer program or something where the police knew that's what you had to do, right? And then the other thing is distinguishing in policing among the problematic people involved in dealing and the less problematic or what I would call the distinction between the asshole dealers and the non-asshole dealers. If somebody, if you got a guy running a local bodega and under the table, they're selling a little heroin or cocaine or whatever to their local, the same people who shop in their stores. It's a kind of under the table, it's quiet. They know their customers are not selling to kids. Basically from a policing perspective, you wanna basically turn a blind eye to that stuff. Conversely, if somebody's out there on the streets and they're hawking this stuff or they're harassing people walking by or they're making people feel unsafe or they're selling to kids or things like that, that should be a number one priority of the cops. The cops should be stopping those people. They should be arresting those people. And if those people don't wanna take some, accept some kind of helping service, then those people need to be put off the streets in a serious way. Schellenberger's approach is idiotic because he takes a real problem about public drug use where we need real solutions and then he does something like opposing safe injection sites which is the opposite of what you'd wanna be doing in order to deal with open air drug use. When you look at say the way Portugal who pioneered this policy 20 years ago, in the early 2000s, they didn't say let's set up the treatment first and then do that. They do the two things simultaneously. You end the criminalization of possession and you're changing the system's approach as well. So you do both of those sorts of things. There's no place in America, whether it's Oregon and California or even wealthy cities that have fully enough access to treatment. These things can be expensive. One thing about harm reduction is that, people talk about we need quote unquote treatment beds. Most people with a drug problem don't need a treatment bed and treatment quote unquote beds are expensive, very, very expensive. You wanna reach people and hopefully be able to help them. Thanks for watching that excerpt of a live stream that Zach Weismiller and I did with Ethan Natelman, late of the Drug Policy Alliance about legalizing all drugs. If you wanna watch another excerpt, go here. If you wanna watch the full conversation, go here and come back next Thursday at 1 p.m. Eastern time because every week we've got a live stream with another great guest that you're gonna be into. Thanks for watching.


Hey everyone, welcome to today's Protocol Labs Readers Seminar. Today we are joined by Pratush Tavari, who is a third year PhD student at Johns Hopkins University under the supervision of both Matthew Green and Abhishek Jain. His research focus is on problems at the intersection of cryptography with privacy and verifiable computation. He has also collaborated with the Ethereum research team to build, attack, and study practical verifiable delay functions, and with the PSE team as a grantee where he went down the zero knowledge proofs rabbit hole working on verifiable machine learning. Today he's here to talk to us about his paper on algorithm substitution attacks on cryptographic puzzles over to you Pratush. Thanks a lot Liam. Hi everyone, I'm Pratush. Today we will be talking about algorithm substitution attacks on cryptographic puzzles and this is a joint work with my advisor Matthew Green. So let's get started. Backdoors are not something that's new. They've been around for many years now in the early 2000s. They were backdoors which were put in by computer worms such as Sobik and MyDoom and what they would do is they would install a certain piece of software which you would not know about on your computer and the goal was that the spammers then who installed this software can send junk emails from the infected machines. This actually led to a crazy uptake in email traffic in the early 2000s and it would work so that as soon as you received an email from an infected machine your machine would get infected itself. Other than software backdoors there are also hardware backdoors that we've heard about where manufacturers of hardware devices have messed up the design somehow or put in some root access that they shouldn't have ideally because they don't own the machine once they sell it to a certain degree. Then there's also cryptography backdoors which is kind of the focus of this talk and how it affects certain puzzle problems in the real world and these puzzle problems are very relevant to blockchains. A few years ago there was a big backdoor that was discovered in Primitive for deterministic random bit generation called Dual EC that was approved by the NSA but later people found backdoor attacks which were possible right so very exciting stuff. So are there different ways in which people can backdoor cryptography? There are many ways so in cryptography we have these keys which are sensitive objects similar for cryptocurrency wallets as well if you lose your keys then you lose access to secret information or access to a wallet and so this information has to be protected and the keys need to be strong. What that means is that if the key space is too small people can brute force and find attacks. There might be other sophisticated attacks depending on the cryptographic primitive you're using but if the key gene algorithm is weakened then that doesn't help at all right. Furthermore if you are using a cryptographic primitive and it has certain fixed backdoors fixed parameters they can lead to a backdoor and this is what happened in the instance of Dual EC. If you knew the backdoor then you could very easily find out more information than you're supposed to about keys which might apparently seem to be randomly generated but for someone with a backdoor they can predict that key much easier than just sampling randomly and trying to find a collision. This sort of malicious design of algorithms leads to apparent security where someone using it might think that the algorithm that they're using is perfectly secure and there's no problems but the person with the backdoor meanwhile can read their messages or break the security of the protocol. All these objects in cryptography which give us security come from the fact that there is a lot of entropy in cryptographic systems which means that your keys let's say like a long bit string if it's long enough and it's actually random which means it has high quality entropy then no one can just guess and find out what their key is right but if you reduce this entropy then you get in trouble. So our goal in this work is to see with the uptake in hardware devices used being used for cryptography we have certain manufacturers which are manufacturing these hardware devices or puzzle solving devices as we will call it and these devices can be thought of as mining devices now people are looking at zero knowledge provers which would be hardware waste and verifiable delay function hardware these are all puzzle primitives and we group them as such and we want to look at whether these hardware manufacturers can backdoor these devices so that they sell these devices to a certain honest party and then the honest party invests resources to solve the puzzles but the malicious manufacturer who backdoor these devices reaps the rewards. So let's look at what these cryptographic puzzles are. So the concept is very similar to puzzles in general right in any puzzle instance you you get the input or whatever the puzzle is you solve it and if you solve the puzzle you get a reward so cryptographic puzzles are very similar but they have a resource requirement which is kind of guaranteed right so if you're someone who's solving the puzzle and you don't invest the amount of resources as specified by the puzzle maker then the probability that you will solve the puzzle successfully is negligible. As an example if you look at proof of work this is computation so this means that on average you need to calculate a certain number of hash functions before you find a proof of work solution then we have verifiable delay functions which say that if you solve this puzzle then it must take you a certain number of seconds and the way this is emulated in a protocol is using computational cycles right so each device can have certain number of computational cycles in a second and if your protocol takes a set number of computational cycles to complete then you can emulate wall clock time using it right similarly if you look at proof of space then you need certain amount of disk space to be able to find a proof of space solution right and certain puzzle protocols are back for the environment so if you look at proof of work it uses a lot of electricity almost as much as a small-ish or medium-sized nation at this point so slowly we can see different protocols moving away from proof of work as it's here I'm dead recently. More formally and concretely we can look at cryptographic puzzles as the following algorithms right so you have a setup algorithm and where does it it decides the puzzle difficulty what your resource requirement is what your resources it also decides an input domain for the puzzles right so let's say I want to make a puzzle what I'm going to do is I'm going to run the setup algorithm according to my choices and then it's going to give me an input domain to select my puzzle instances from right and once I have this input domain I can sample puzzle instances randomly then of course you have the evaluation algorithm in which the puzzle solvers generates a solution and a proof certain protocols split this apart into two different parts so it's the evaluation itself and the proving and so but we group them just together so you you take a puzzle instance you solve it you get a solution and a proof which you can verify through the verify algorithm so the verify algorithm would take the solution the proof and the input and other public parameters and it'll check whether the solution is correct or not let's look at different applications of puzzles like why should we care about these right so in the beginning client puzzles were first used to solve denial of service attacks so if you have a server which performs a certain high quality activity or you want to prevent a service from running for properly what you can do is you can just overload them with connection requests and as at a certain point the server will get overwhelmed and the service won't be able to run properly anymore to solve this problem Jules and Brainard and at NDSS in 1999 propose something called client puzzles this means that if you want to send a connection request to a server first you have to do a certain amount of work or solve a puzzle and once you do that then you can send the request successfully and then what it meant is that to run a denial of service attacks the cost to run any such attack now increases massively right and so it kind of prevents these attacks or at least it increases the overhead of the attacker so that the attacker would need a lot of resources to run such an attack the most relevant application of puzzles to the audience here would be consensus in blockchains right and in consensus we just we have a certain high reward task and we want to perform we have different parties which are ready to perform it and we don't know how to select which one right and so for this we have various consensus algorithms which are basically utilizing certain type of puzzle constructions right so if you again like like we talked about there's a resource requirement to solve the puzzle and that changes so in proof of work it requires electricity or computational steps proof of space requires disk space etc right and a lot of these puzzle solvers are hardware based so whether this be ASICs or FPGAs or ZPUs so a lot of bitcoin mining is done on ASICs yeah and there's other other like things like litecoin and I think dogecoin they also use ASICs there's different proof of works which use GPUs and FPGAs so the key issue here is that you have a very high state application right you're engaging in this puzzle solving process and the first party that solves the puzzle it reaps a lot of rewards right so the goal for any such attacker comes sort of naturally right to attack such a protocol and we will look at what this means later right so algorithm substitution and tax on cryptographic puzzles right so what is the first part the algorithm substitution and tax or ASA means right so the setting here is that you are using a certain cryptographic algorithm it has some security and privacy properties right but the hardware or software implementation that was provided to you was provided by a potentially malicious party right and so can this malicious party break your crypto so whether it is breaking the security or privacy or some other guarantees relevant to your protocol and can they go undetected while they do so right and so a similar concept was first introduced as kleptography by Young and Young at the crypto conference in 1996 and in the seminal paper by Bilare Patterson and Rogovi they they looked at symmetric encryption and backdouring symmetric encryption using ASAs and different game-based definitions for this and a lot of the follow-up works actually build on these game-based definitions so now there have been ASA papers where people have looked at different secure messaging applications like signal and they study whether algorithms substitution and tax are possible on signal there's been at least five to ten very solid papers in the space now which deal with different scenarios there's also the crypto 2018 paper on correcting subverted random oracles by I think Russell et al and and they look at the fact that given a subverted hash function can you convert it into an implementation which is actually not subverted this is kind of similar to our work but we aim at a general puzzle-based definition and we'll show some interesting analysis uh attack techniques et cetera and also countermeasures soon so let's take an example from the BPR paper from 2014 and this is for symmetric encryption right so for the cryptographers here you have your symmetric encryption scheme which has it has like a certain key and you're trying to communicate to another party and they call the malicious party who's providing the implementation the big brother so that's what the BB is here so in the normal operation you are communicating using symmetric encryption you have a certain key and anyone who sees the cipher text which is the thing that you're transferred to whoever you're trying to communicate to they won't be able to find out any information about the content of your message right but in the subverted operation what happens is that since your implementation is provided by a malicious party what they do is they add the hard wire and extra key inside it and what this does is this malicious operation now seems benign to any other party other than the big brother but when the big brother sees the cipher text only they can actually find out what your message is so they find out what the content of the message is while both the communicating parties think that they're using a secure protocol and the big brother can go undetected right but puzzles are different right it kind of seems like there's no secret here to leak right so what would an attack here even mean in terms of encryption it's very clear that if the whatever your message is if that information is found out by an adversarial party then you're in trouble or if your secret is leaked then your protocol completely breaks down but how is this relevant to puzzles right so in most puzzle protocols the attacker or the subverting adversary that's the person who's malicious and they design the puzzle solving hardware or software right and let's say the honest party which is called the detector or detecting adversary buys this puzzle solving machine right and now this honest party invests resources to solve the puzzle and the attacker wants to subvert the puzzle solver such that they the subversion actually benefits the attacker right and the detector does not find the subversion and how it actually benefits the attacker we'll see soon right but in the let's look at this in the context of blockchain consensus right so you have a certain task to be performed the party performing the task gets a reward and so we have to decide which party right we have multiple willing parties and most protocols regardless of what consensus algorithm they use they decided in the following way they pick they pick randomly but proportional to investment right so if you look at a solution that use that uses proof of stake plus VRS or VDS people stake a certain amount of token whatever your token is and depending on what their stake is a random lottery is picked where your probability of winning is actually proportional to how much you state right in proof of work this is still true because the more number of mining devices you have the higher your investment and the higher your chance of solving the proof of work right and so in a certain sense that the randomness decides the winner and in most settings the winner there's only one river and winner and they reap the reward right which is the block reward for bitcoin and other proof of work things so the ASA's on puzzles would aim to attack this exact process right so if the process to decide this randomness that picks the winner is if the attacker can affect it then they can reap rewards more than their investment right here's a nice image from ledger.com that tells you how puzzle based consensus works it makes most sense in the proof of work setting so you have your network server right and there is a puzzle which is decided to be the puzzle for that block right and that's sent out to a bunch of parties which are willing to solve the puzzle right and all of them attempt to solve the puzzle they send solutions the party here x2 which solves the puzzle correctly gets rewards right and this puzzle solving actually is done in hardware in many processes as we looked before right let's take proof of work mining as an example here right to solve these puzzles you first need to buy hardware right and here's like an example of what are the different hardware this is just a screenshot from a popular hardware manufacturer this is what these devices look like right so you can see the amount of investment here might be okay for a for a big corporation but for individuals mining it's a pretty high investment these devices also consume a lot of electricity and so they're expensive to keep running and the hope is that you wouldn't reward which are fair right so proportional to your investment before we dig deeper here's a quick overview of the bitcoin proof of work right so there's a proposed block and it has a block header which is the sha256 hash of the block header then any miner would decide the transactions that they want to include in the in a block that they would propose so they would build a market tree using sha256 for these transactions and they take that the previous block header and the proof of work is to with those two inputs find the nonce such that when you hash all of this together you get a hash with a certain number of preceding zeros right and that decides the difficulty for that block and the miner that achieves this successfully and in most times in fastest gets the block reward right so I take the current bitcoin block reward is 6.25 bitcoin which is over a hundred thousand dollars and the hardware consumes a set amount of electricity every hour and it just turns away just keeps incrementing these nonces to find a solution and you can either mine by yourself so you do the whole exhaustion of the nonce by yourself or you do it in a pool so then in the mining pool what happens is there is a pool operator right and they orchestrate this process so let's say your nonce is whatever your nonce space is right whoever is in the mining pool the pool operator would divide the nonce space among the members of the pool and everyone would work on their shares or their work shares right so that's their set amount of puzzle input that they have to exhaust right this is an important statistic right here right so if you look at the hardware manufacturers for bitcoin a few of them there's roughly three or four which manufacture most of the devices right and you will see why this becomes a problem later the main issue is that the biggest the two biggest mining pools are also run by the people who manufacture these devices so they have a lot of control over the device that they may and sell and after they sell the device they're still communicated to the to these devices potentially using their mining pool right so if you look at bitcoin which is the biggest manufacturer they manufacture two thirds of the devices and they control the two historically biggest mining pools as well the situation is changing slowly but it has been the case for at least the last 10 years right okay enough about proof of work right so in in cryptographic puzzle manufacturing let's say there's a malicious manufacturer what are their goals right so you can see that these protocols are being used in consensus and other activities where solving the puzzle gives you a reward and your expected reward is proportional to your puzzle solving activity ability right so as an attacker what I want to do is I want to lower other people's puzzle solving ability right because the puzzle solving ability is always represented as a fraction of the network right so if you own let's say 10% of the network's devices your puzzle solving ability is 10% of the network now if I make let's say half of the devices go away which are not mine then my puzzle solving ability certainly doubles right so now it goes from instead of 10% it goes up to a 20% right so it's always respective to the rest of the network right and in the best case scenario what I want to do is like I just want to take other people's solutions so they do all the work they do the investment and I just reap the reward right so there's two main angles for the attacker goals that we're considering here which is you lower other people's puzzle solving ability and increase your fractional puzzle solving ability as a result or you try to exfoliate other people's solutions right so in this in this blockchain based setting let's look at the threat model right what's the threat mean so first one is the direct input model and in the direct input model what happens is you have this malicious pool operator who also made your device right and that's why the image I showed earlier right here becomes very relevant right because the person who's operating your pool also made a lot your device with high probability right so this is a realistic threat setting and it it's happening right now it's been happening for many years the other one is the blockchain input model right here you're sort of either mining individually or you join the mining pool which is not operated by the person who manufactured your device right so in the direct input model they can talk directly to your mining device through the mining software because they made your device and they also run the pool so they made the so they communicate directly with your device in the blockchain input model the malicious party may have made your device but the only way they can communicate with your device is through the blockchain because your device is reading information from the blockchain so they can indirectly try to affect the information on the blockchain and that would affect what goes inside your device right and so why does this become relevant right and the way it becomes relevant is we look at a couple of attack strategies that we have so the first one is the load shedding attack and so what the load shedding attack does is it load sheds attack devices in the network right so what this attack would do is it would lower the puzzle solving ability of the attack devices every once in a while right so you can think of it this way right you have a device that you bought from a malicious manufacturer and there is an input domain of the puzzles that your device tries to solve right now what the manufacturer does it if hard codes certain bad or trigger inputs within the device once the device sees any of these inputs it's just going to perform at it at a puzzle solving ability much lower than advertised and the reason it's interesting to look at it in this way is because if out of the box the devices didn't perform as advertised then people would just be like i received defective device there's an issue with this right but if you have an input trigger which sends the device into bad mode for let's say two days or something like that right what the malicious parties goal then becomes to trigger the device once it's online right so your device is performing perfectly well and then it sees a certain input and after that it its performance declines for a little bit right and so what happens is any person who buys such a device if they try to test it at home it would appear to be working properly there's no issues at all and then the device goes online and every once in a while it performance declines a little bit right and so it gives this sort of like plausible deniability to the manufacturer the effect doesn't seem negative enough for the honest party to cause a big issue they might just be like okay like there was a small issue with the device but it's working fine now and the attacker continues to reap the rewards because for every few blocks every once in a while their puzzle solving ability is just going to grow that much and we'll see a quick analysis for that so in the direct input model this attack is very effective right and the reason for that is in the direct input model the malicious party who made your device can communicate to it directly because they're also a pool operator so if they want your device to go into bad or triggered mode what they would do is they would just send your trigger input because that just looks like a hash for most proof of work right and as soon as you input this information into your device it's going to go into bad mode not puzzle solve with the ability that's advertised but in the blockchain input model this attack is not so effective right because if your input is coming from the blockchain and that's a certain hash then it's very challenging for any attacker to get us exact certain hash to be the next block header right and so we also explore a stateful variant of the attack in the stateful variant of the attack the mining device which is subverted keeps state over let's say 100 consecutive blocks right and so then the goal of the attacker becomes that they have to affect the entropy on the blockchain so that over the 100 consecutive blocks a certain function of the block header is a triggered input right so instead of them trying to get the next block header to be a certain hash now what they do is they try to affect the entropy on the blockchain little by little every block and they if they own a good enough hash rate it doesn't have to be too high even if it's 10% they can mount this attack and the analysis is available in the paper this is an interesting graph that we plotted and this basically on the x-axis you have the percentage of devices subverted by the attacker right so there's two to three different manufacturers which are making over each of them make more than 20% bit main makes two-thirds so it's like somewhere here and they make these devices right and they subvert these devices and let's say they sell them subverted right and let's say they also take part in the mining process themselves and they have a certain hash rate right so if I have a 10% hash rate and I make half of the other devices just go bad my hash rate goes up from 10% to 20% right my effective hash rate and you can see this plotted for different attacker hash rates and different percentages of subverted devices and so what is this selfish mining threshold here selfish mining for those who don't know is is an attack where let's say in proof of work you are one of the miners and you find the next proof of work solution but you don't advertise it the reason you don't advertise it is that you just keep working on this proof of next proof of work solution to build the fork of the chain and if you have enough of the network's hash rate you can actually build a successful fork so that you mine a bunch of consecutive blocks and other people's solution which might be a little bit behind are never chosen at all so they waste their effort and you mine consecutive block rewards and the other people don't have a shot at all because you keep your chain private until you know for sure that your chain would be the fork that is selected right and so from the work of y'all and I mean we know that the selfish mining threshold is one third so you need to own one third of the network's hash rate to mount a selfish mining attack but now what we get from low shedding is that if you sell subverted devices even if you have 20% if you have 20% of the hash rate and you subvert let's say 40% of the devices then you cross the selfish mining threshold and you can selfish mine and this is actually the case possibly in the real world because there is a manufacturer which has roughly 20% of the hash rate and they make more than 40% of the devices so we cannot say for certain if this is happening already but it is certainly possible the second attack strategy is leaching attack right so in the leaching attack the goal of the attacker is to exfiltrate puzzle solutions every once in a while right so you can think of this again as an input based trigger where the attacker tries to send a bad or trigger input to the device and once the device sees this trigger input the next few solutions it finds they'll try to exfiltrate them right but what does this exfiltration even mean the device is not not always directly talking to the attacker right so there is actually an exfiltration channel here so look at the setting where your pool and your pool operator also made your device and they're malicious and what the communication that happens between the mining device and the pool operator is certain lower level difficulty proof of work solutions as well right so let's say like the real world difficulties to find a solution for proof of work is 64 bits of preceding zeros in the hash right when you're in the pool only one of the members of the pool is potentially going to find a solution every once in a while right so how do you give people rewards for mining how do you like spread them sort of democratically what pool operators do is they consider these lower level difficulty solutions so while you're trying to find a hash with 64 preceding zeros you'll find a lot of them with 30 40 50 preceding zeros so what pool operators do is they select one of this lower level difficulty as the as the work reward kind of thing and then depending on how many of these you find they find out what fraction of the hash rate is owned by you and how much work you're contributing to your pool right what you can do here is the attacker would hardware the device with the secret key right and it then it's going to try to input a trigger to it and in the attack state the device will try to exfiltrate the ciphertext of the actual solution that it found at the actual difficulty level and the way it would do it is that it's going to encrypt that solution first and then it's going to submit low level difficulty puzzles so that at a certain bit for each puzzle you get the cipher text bit right and it works in both settings so you can either do one by one submission of lower difficulty solutions and in this case you would rejection sample so you are going to only send the lower level difficulty solution where let's say the fifth bit is zero right and you rejection sample until you find such a solution and if you're submitting low level difficulty solutions per block then yours is going to order them so that let's say a certain bit the ordering basically communicates the ciphertext of the actual solution right we also model the security games for something like this so what would that look like because having provable security is important right we have these attack strategies but are they do these attacks actually work so first we'll need to consider what security even means for algorithm substitution attacks right so we look at this subversion game first right so in the subversion game the malicious manufacturer or the attacker is talking to a certain device and the goal is for the manufacturer to figure out whether the device it's talking to a subverted or not right and it knows that if the device is subverted then it's going to run a certain subverted evaluation algorithm which is known to the attacker right so the attacker is allowed to query the device on some polynomial the security parameter number of inputs adaptively and then the attacker outputs its guess for whether it thinks the device is subverted or not right so if you look in the case of any input trigger based attacks what the attacker would do is just it's just going to send a trigger to the device and if the device is subverted then it's going to start performing at a lower efficiency or lower puzzle solving ability and the malicious party would be able to find out if the device is subverted right the other security game that's important is where the detector the honest party also needs to figure out the same thing right so the detector buys a device and they want to find out whether this device is subverted or not right so it's the same setting as before but the detector does not know what algorithm the subverted device would run it don't it only knows the the correct evaluation algorithm right so the detector tries to talk to the device on query it on a bunch of puzzle inputs and adaptively and then strike then it guesses whether the device is subverted or not right and so the if the subversion triggers are like a negligibly small fraction of the entire input space then the detector would never be able to figure out by random testing right especially with polynomial number of queries so this we call this the offline detection game as you can think of it as you buy the device and you're testing it at home right but another interesting setting is the online detection game so you say okay like my device works fine at home but does it work in the real network right and I'm going to test it so everything else remains the same but we add an attacker oracle right so what this does is that now not only does the detector talk to the device it can what it can do is it can see it can have oracle access to an attacker and it sends a start attack symbol to the attacker and the attacker would then give it messages to send to the device right and then the detector forwards this message to the device or computes a function of it and continues this conversation and this emulates the setting when your device is online and an attacker might try to mount an attack and if you're looking at the information that is input to the device and the outputs of the device can you figure out whether your device is subverted or not so this greatly improves the detector strength so most of our attack attacks actually are not offline detectable so in most settings you won't be able to detect at home whether your device is a subverted or not and as I said it's very easy for the attacker to trigger the device but in the online detection setting only some of the attacks succeed or have plausible deniability because once you see an attack in session you can kind of figure out that maybe this conversation is what is what's making your device perform negatively right and so what are the real world concerns here like fine we have we have these like detection things like cryptography games but how do we detect stuff detection is certainly useful but only if it's fast right because testing and profitability is at odds there's a paradox here so let's say you don't trust your manufacturer and so you're testing your device a lot the more you test your device the more your device is online right so while your device stays online other people's fractional hash rate is that much higher so distrust in the malicious manufacturer actually benefits them right and there's also simple timer based attacks like I just put a timer in the device so that it starts failing after a year of being online and these devices actually have a small lifespan 18 months until they're profitable after which you have to take them out at least in the case of bitcoin and the attacker could only subvert real-world difficulty parameters since there's so many devices in the network a single device finds the solution every once in a while so a device which is $5,000 would find a solution like once a year or if it's operating by itself and like even huge mining rigs with millions of dollars in investment find only solutions in a few weeks or so right but each solution is over a hundred thousand dollars right now right so we need to study puzzles which are easily testable so that at home I can test it and be sure that it's actually going to be fine in the real world as well right testing also doesn't work because a lot of these hardware devices have hardware errors and they operate within a certain error rate right so as you can see for this device its puzzle solving ability operates in a plus minus three percent error rate so as an attacker I can just always make the device work at its like lower strength and it's still acceptable right and let's say your device is exfiltrating solutions are failing on certain inputs it would look exactly like how it looks in the real world with hardware errors so with hardware errors what you have is on certain inputs your device stops working and on your mining software or portal it would say that there were a few hardware errors on your chip and you say okay maybe you know it overheated or some cycles ran out or something like that but if I'm an attacker I would make things look exactly how they look right here right I exfiltrate the solution and you just think you had a hardware error right and statistically testing your miner with some statistical confidence so you want you want to know for sure that with probability higher than 95 percent your device is actually subverted so what you can do is you can try to measure its hash rate over time depending on like how many solutions it finds and we have this nice graph that we've plotted so for depending on the miner hash rate if you buy a device that's a thousand dollars it'll take you roughly 600,000 blocks to test which is a lot of blocks and your device's lifespan will run out before that so unless you own mining rigs over a hundred thousand dollars you will never be able to test your devices with high certainty before their lifespan is actually over so we suggest that people collaboratively test their mining devices to figure out whether they're subverted or not we also talked about another counter measure which is preprocessing so certain puzzles allow the puzzle solver to enter entropy into the puzzle solving process and so then what happens is the information that is input to the device is not exactly selected by the malicious party right so you can add entropy so that the malicious party doesn't know for sure what would be input to the device we model this as a cryptographic game and this unpredictable preprocessing actually prevents most input triggered based backdoors right you could also mask your puzzle inputs so you can do an algebraic transformation so that if you have an input x you transform it to x prime which the malicious party does not know about and then your device solves for x prime and it finds the solution let's say y prime and you can unmask the output from y prime to y which is the solution to the original input x before masking and for algebraic protocols which have a lot of structure you can develop these masking protocols so in our paper we have a masking protocol for phx vdfs and the overhead for masking is very small so 10 to the negative 6 almost overhead over the actual vdf evaluation cost and time and for other algebraic protocols such as the Veselowski vdfs and any other puzzle construction which has this structure you can devise similar masking based protocols so that in the future if these devices for vdfs are being run in a space where solving the vdf and finding the solution is a higher reward process then input based triggered backdoors are not possible right so that's it thanks a lot here's a link to the paper on e-print


Positive thinking. Want more joy? Want more positivity? Then brainwash yourself to success. I am the architect in my life. I build its foundation and choose its contents.  I build its foundation and choose its contents. I am full of energy and overflowing with joy. I am superior to negative thoughts and low actions. I am superior to negative thoughts and low actions. I have unique and special talents that I utilize daily. I forgive those who have harmed me in the past and peacefully detach from them. I forgive those who have harmed me in the past and peacefully detach from them. I forgive those who have harmed me in the past and peacefully detach from them. I possess the qualities to become successful. I possess the qualities to become successful. I respect and learn from my leaders, but I never worship them. I aim to surpass and go beyond. I respect and learn from my leaders, but I never worship them. I aim to surpass and go beyond. I get up every time I fall. I never lose. I either win or I learn. I get up every time I fall. I never lose. I either win or I learn. I replace bad habits with new and positive ones. I replace bad habits with new and positive ones. I acknowledge my own self-worth. I am happy being me. I acknowledge my own self-worth. I am happy being me. I am in full control of my life and accept all responsibilities. I am in full control of my life and accept all responsibilities. I overcome any obstacles that gets in the way of my dreams. I overcome any obstacles that gets in the way of my dreams. I am constantly evolving towards the person I dream to be. I am constantly evolving towards the person I dream to be. I know life can end at any moment, so I make every moment count. I know life can end at any moment, so I make every moment count. I allow myself to be happy and inspire others to be happy as well. I allow myself to be happy and inspire others to be happy as well. I am enthusiastic. Confidence is my second nature. I am enthusiastic. Confidence is my second nature. I feel every cell in my body vibrating with energy and help. I feel every cell in my body vibrating with energy and help. I surround myself with people who help me reach my full potential. I am extremely laser focused and engage in the task at hand. I am extremely laser focused and engage in the task at hand. I am always becoming smarter and wiser than who I was yesterday. I am always becoming smarter and wiser than who I was yesterday. After this, I will expand my mind. I will improve a skill or learn something new, and then schedule my plans for the day. After this, I will expand my mind. I will improve a skill or learn something new, and then schedule my plans for the day.


ASUC elections are upon us. I'm Olivia Pakula for CalTV Entertainment, and I'm here on sprawl to see how students feel about the upcoming election. How do you feel about the upcoming ASUC election? Pretty nervous, a little excited. To be honest, I don't know much of anything about the elections or what the Senate does. I'm excited to see the new group of people that join our Senate. Do you know anything about the different platforms of the different parties that are running? I know that there's three different parties and they all stand for different things. Nope, not it. If you would like to tell us, that would be great. I'm aware of the parties and I think I know the platforms since I wrote mine. I do because I actually seek them out to find out the different platforms to see which candidates will fall more in line with what I believe in. What are your thoughts on the various strategies used by the different candidates?  I feel like they're all kind of the same, just kind of barrage social media and then put picket signs in your faces and be really annoying.  At least pretend to get to know me or care. I mean I understand that that's how you campaign, but sometimes it's like... You don't want to be approached. Be sure to vote for the ASUC elections next week. Again, I'm Olivia Pakula with Cal TV Entertainment. Thanks so much for watching.