And we're focusing on how to distribute shared secret keys or symmetric keys. So again, symmetric key cryptography, like AES, triple desks, both sides need the same key. And for that to work, we somehow need to, what usually happens is one side chooses a key, say a random key, and then gives it to the other side. But when we give it to the other side, we must make sure that no one can intercept and find that key. So the problem is, how do we distribute a shared secret key or a symmetric key across a network? Or the approaches we're looking at currently are using symmetric key encryption. Generate a shared secret key and encrypt it before we send it to the other side. Encrypt it using symmetric key encryption. But we have this recursive problem. If I need to encrypt my shared secret key with another shared secret key, how do we get that other shared secret key to the other side? We'll encrypt it with another shared secret key. But how do we get that to the other side? So we have this recursive problem. And the way that we solve it is we assume that some of the secret keys are manually distributed. By manually, it may be I write it down on a piece of paper and I go to the other person today and give them the shared secret key. And then later, we use that key to encrypt a new key. And we can do that second step automatically by sending packets across the network. So there's the manual distribution. And it may not be writing on a piece of paper. It may be taking a USB disk to a special computer, which copies across the key in a manual step. But then after that, we use that key to encrypt other keys. And with that, we arise two different types of keys. We talk about master and session keys. So we'll distinguish. We'll say a master key is one that we'll use to encrypt another key. And that other key we'll refer to as a session key. So usually the master keys exchange manually. So I need a master key shared with someone else. We'll come together and exchange that master key manually. But then we will use that master key to encrypt a session key and exchange it automatically across the network by some protocol that does it on our behalf, our computers do it. And then when we want to encrypt the data, we encrypt the data with a session key. So encrypt session keys with the master key, encrypt your data with a session key, this hierarchy of keys. And you could have multiple, more than two levels if you want. The idea is that the master key, it's very inconvenient to exchange because of the manual process, but we don't do it very often. So it's not so bad. We only do it say once at the start of the system. We come together between two users and exchange a master key. We keep that master key, but then we use it to exchange automatically a session key and we can change that session key on a regular basis. So let's say every day we change the session key. That's to achieve this principle, don't use the same key forever. Use it, change it as often as possible. So session keys will exchange using some protocol. So our software on our computer will automatically exchange with the other computer and will usually change on a regular basis. Master keys that we exchange manually and not so regular as few times as possible. How regular? What is the lifetime of a session key? Well, it depends upon different factors. So different applications or systems will use a different lifetime. But the trade-offs are, coming back to one of our earlier principles, the less, the more we use a key, the greater the chance for the attacker for discovering the key. That was one of our earlier principles. So from that we say the shorter the lifetime of a key, the less we use it, the more secure. So we want a short lifetime for security purposes. In other words, I'd like to change the session key as often as possible. But the problem with that is that every time we need to change session keys, there must be some exchange of messages to do that. There's some protocol that takes place and introduces some communication overhead as well as some small delay in our communication. So change the session key as often as possible to be more secure, but not too often such that the overhead of doing it is too much. Some examples of how session keys are changed. For example, you have an application that uses TCP. Like web browsing, email, file transfer, they use TCP. And we know with TCP, before you send data, you set up a connection. How do you set up a TCP connection? What's it called? Three-way handshake, sin, sin, act, act. I know you're learning it. You've learned it with Dr. Conwood, okay? You're experts on TCP. You set up a connection and then you send data. And then when you finish sending data, you close the connection with what? How do you close a TCP connection? What type of message? Fin for finish, okay? There's a special fin message in TCP to finish a connection. And then if we want to communicate between the same application to the same server, we'd open another connection, exchange our data, and then close the connection. So in TCP, we have concepts of connections. For example, if I want to send an email from my computer to the email server, then my computer will create a TCP connection, send the email, then close the connection. Or if I want to download a web page from a web server, my computer will create a TCP connection to the web server, request the web page, receive the web page, and then close the connection. So the connections are usually short-lived. Depends on the application, but maybe seconds, minutes, maybe they are longer in some cases. But often they're quite short, seconds, minutes, maybe hours. So one way to change keys is for every TCP connection. That is, I want to encrypt the data I'm sending using TCP. Then what I do is I create a new session key for each TCP connection. I connect to the web server to download a web page. For that request that I send to the web server and the response I get back, I will use one session key for the encryption between me and the web server. Then I close my TCP connection, and maybe a few minutes later, I access the same web server, download another web page. So when I create the new TCP connection, I will get a new session key, and encrypt with a different key in this case. So one common way to consider the lifetime of session keys is related to the protocols being used. For example, TCP has connections. So every TCP connection use a new session key, or it could be over a set of connections. UDP, how does UDP work? Is there a three-way handshake? UDP is much, much simpler than TCP. You just send the packets. There's no concept of a connection in UDP. I just send the packet to the server. So in that case, if we consider what's called connection less protocols, then we cannot correspond the session key with the duration of the connection. We usually may have some fixed period or some certain number of packets. That is, I'm sending UDP packets. Every five minutes, create a new session key. Or every 1,000 packets I send, create a new session key. That could be set up with connection less protocols. With the trade-off being the more times we change the key, the better for security, but the larger the overhead of doing so. Because changing a key involves sending some packets across the network. What do we skip over here? This principle, change keys frequently. And we, last lecture, looked at one way to exchange a key in a decentralized approach. And today we'll look at a centralized approach. So just, we went through the notation in this picture. We had the decentralized approach. This assumed that the master keys were already exchanged. Before we send these three packets, A already knows the master key that it shares with B, and B also knows. Somehow, A and B got together in the past and exchanged one master key. In this picture it's denoted as KM, the master key between A and B. So assuming we have a master key, then this scheme is used to exchange a session key. And the steps were A sends its identity and a nonce value to B, a number we use only once. B responds by encrypting a session key, KS, as well as the identities and the nonce values, encrypting that with the master key. Only A can decrypt that because only A has the master key. No one else does. No one, the intercepts can decrypt. And finally, A responds by confirming just a final confirmation that we've received it, like an acknowledgement, encrypting the nonce value. We said some function of the nonce. Let's just say increment by one. It doesn't have to be complex with a session key. These three steps are to exchange a session key. So we may do this now, and then five minutes later we may repeat these three steps with a new session key. But still using the same master key. And then five minutes later do it again. New session key using the old master key to encrypt that. With the AIM, the session key is only used for a short period of time before we change it. And the master key is not used very often. It's only used when we apply these three steps. We only use the master key in one case here, here. So let's say every five minutes we do these steps. We're only using the master key once every five minutes. So this principle. Don't use the same key too often. The advantage of this, compared to the next approach we'll go through, is it's decentralized. The two entities, A and B, do it between each other. They don't rely on another entity, a third party. There's no central entity involved. The problem with this is the number of master keys that need to be manually exchanged. We looked at that case in a bit of detail, but let's just look at the number of keys. I think we calculated, but a simpler case to start today. We have, instead of A and B, let's say we have A, B, C and D. Three entities in our system. And we want to use this decentralized scheme. How many master keys do we need in the system? Not to the power of, well let's list them. How many master keys? Remember the master keys are exchanged manually, and we want to do that as little as possible, so we want to have as few as possible master keys, because it's very inconvenient to exchange them. So if A wants to communicate with B, they need a shared master key. I'll list it. Maybe we'll call it KAB. That's the master key between A and B. So the master keys, if A wants to communicate with B, they'll need to exchange a master key. If A wants to communicate with C, they would need a separate master key, and with A and D. If B wants to communicate with A, we already have a master key, KAB. In both directions we can use the same master key. But B wants to talk to C. They'll need a master key. Or B with D. And last one, C's already got a shared master key with B and A, but we'll need one with D. And D now has, in this list, master keys shared with A, B and C. So a total of six keys, if we have four entities. And you know the equation for calculating that with N entities. It's N times N minus 1 divided by 2. 4 times 3 divided by 2 gives us our six keys needed. There are six pairs, in this case. But if we have 100 users, not just 4, then it becomes 100 times 99 divided by 2, which is about 5,000 master keys needed. And that requires a lot of effort to exchange them, a lot of manual effort. So that starts to become inconvenient. So that's the problem with this decentralized scheme. Lots of master keys needed. So let's look at a centralized scheme that tries to overcome that problem. We'll use a central entity called a key distribution center, a KDC. Think of some special server that will distribute keys to the users, to the entities. We call the KDC a trusted third party. It's a third party. It's someone who's not normally involved in the data communications. They're just there to support the key distribution. And they are trusted. We'll see that the other users must trust this KDC. By trust, we'll see that the KDC will know the keys of other users. We'll see that as we go through the protocol. And we use the KDC by first manually exchanging a master key between each user and the KDC. So that's the manual step. And then when a pair of users want to communicate, A wants to talk to B, then they will exchange a session key between A and B but making use of the KDC. So the master keys are manually exchanged while the session keys are automatically exchanged. But we'll see, compared to the decentralized approach, much fewer master keys are necessary. We can see that immediately, in fact. Similar approach. Instead of exchanging master keys between each pair of entities with KDC, I'll draw it slightly differently with... So that was the decentralized approach. There's no central server or distributed approach. Let's try a centralized approach. And keep it simple. We still have A, B, C and D, four users. They want to be able to communicate with anyone. We also have a fifth entity, the trust of third party, the KDC, the key distribution center. The manual exchange of master keys is done between each user and the KDC. So between A and the KDC, we exchange a master key. And let me just confirm the notation we'll use. In the picture that we'll show in a moment, we'll call that key KA. So master, we'll just call it KA, meaning the master key exchange between A and the KDC. User B will exchange a master key with KDC. So with C and D. And then when, for example, A wants to talk to B, they'll automatically will see the protocol for A to exchange a session key with B. And the data that's sent between A and B will encrypted with that session key. How many master keys? In the centralized approach, we just need four master keys. In decentralized, we had six. In general, the decentralized approach, the general equation was N by N minus 1 divided by 2. If there are N users, N by N minus 1 divided by 2 master keys. In the centralized approach, how many master keys? If there are N users, we will need N master keys. Here we have four. We have four users, four master keys. If we had 100 users, there'll be 100 master keys. If we have 100 users in the decentralized approach, there's about 5,000 master keys. And you see that the advantage of the centralized approach is much, much fewer master keys need to be manually exchanged. So that's the good thing here. So what we'll look at next is that once we've exchanged master keys using a manual procedure, how do A and B exchange a session key using an automatic procedure? Using some network protocol, for example. What messages do they send to do that? So we'll assume that A knows KA. Let's list them here. Actually, we'll go back to decentralized. In the decentralized approach, what master keys does A know in this one? What master keys does it know? It knows KAB, KAC, and KAD. Everyone that we share with. Similar, B knows KAB, KBC, and KBD. We know the master keys that you're involved with the pair with. A does not know KCD, because A is not involved in that pair. It cannot know what they're using, and therefore A will not be able to intercept and decrypt messages encrypted with KCD. Now, in the centralized approach, what key does user A know, KA? That is shared with the KDC, so the KDC also knows that. B knows KAB, so does the KDC, and D knows its own master key, which is shared with the KDC. The point here is that each user just knows their own master key, but the KDC knows every user's master key. And this is why we say it's a trusted third party, because the KDC knows everyone's key. It can see what anyone else does. We'll see that when A wants to exchange a session key with B, the KDC will be able to decrypt that. The KDC will be able to intercept, if it wants to, the messages between A and B. So we must trust the KDC, that we know that they can intercept our messages and see the content. That's why we call it a trusted third party, which leads to one of the problems with this approach. If the KDC is compromised, then the whole system is compromised. Because if we trust the KDC, but then some malicious user gets access to the KDC, they have access to all of the user's keys, that's the problem. We'll return to that after we go through the protocol of A sharing a session key with B. Any questions before we look at this protocol? Here it is. So this is the automatic part. This is the part which is done by sending messages across the network between the three entities now. A and B. A wants to initiate communications to B. So A wants to send some data to B, and B probably will want to respond with data. So to do that, A and B need a shared session key. They both already have master keys, but they'll need a session key that they'll use to encrypt their data. And to get that session key, they follow these five steps. And we'll just make note of what we know in these five steps. Before these five steps take place, what is known by each entity? This happens after the manual exchange of master keys. So the master key known by A at the start is KA. And known by B is KB. And the KDC also knows KA and KB. That's known before these five steps. The aim is for A and B to have a session key. And in this protocol it will be denoted as KS. To be more precise, we could call it something like KS between A and B. What happens? The steps are numbered 1, 2, 3, 4, 5. So the first step, A wants to initiate communications with B. What they do is they first contact the KDC. They send a message to the KDC, IMA. I want to talk to B. And here's a nonce value. Let's say some random number that we haven't used recently. There's a high probability that we haven't used this number in sending such a message to the KDC in the past. Now, in practice, it would have been used in the past, but in most cases, but maybe a long time ago or very, very unlikely that this one's been used recently. So N1 is what we call a nonce. And the KDC receives this message and realizes, ah, A wants to talk to B. So they will need a session key. And what the KDC does, because it knows the master key of both A and B, it will create a session key, KS, and send it back in message 2 to A. But in a particular format, which we see here. So the KDC creates a session key. So I'll add that to the list of what's known now. KDC chooses KS. And in the message that they respond, there's really two parts, and it's all encrypted. So the first part is this, if you can see this part here. This is, if we look at the contents, it's the session key, KS, combined with the identity of A, the identity of B, and the nonce value from the first message. So this is a message that is going to go back to A and say, okay, you just requested a session key between A and B. The request contained nonce value 1, N1. Here's my response. Here is the session key, KS. And here are the values that you sent me in message 1. And so that no one can intercept and see the session key, all of that is encrypted with KA. KDC sends to A, and therefore encrypts with a key it shared with KA. The purpose of including the contents from message 1 is so that when A receives this, it knows this is a response to my previous request. And we may see later that if someone does a replay of the first message, then we'll normally be able to detect a replay attack on that. Because in a replay of the message, a new one, a fresh message, should use a different nonce value. If it's a replay, it will contain the same nonce value and we'll be able to detect that. So, user A can decrypt this part. It was encrypted with KA, A knows KA, therefore they can decrypt it. And when user A receives this part, they decrypt it and learn KS. So on reception of message 2, A now knows KS. The second part of message 2. This is KS combined with the identity of A, but encrypted with KB. Can A decrypt that? Why can't they? Encrypted with KB, only B can decrypt that. So the second part, even though it's sent to A, A cannot decrypt it. What's going to happen is in the third message, it will be forwarded on to B. So it contains the same session key, KS, and it contains the identity of A, the one who initiated this, but encrypted with KB. A does not know KB. It doesn't need to for this to work, and it shouldn't. So in the third message, if you look at the third message and compare it to the second, it's the second part. All A does, they cannot decrypt it, they just really copy and paste that part and send it in the third message. It's identical. When B receives the third message, it decrypts. B knows KB. When it decrypts, it learns KS. And it checks. KS is for me, B, to communicate with A, user A. It knows it's with user A, because the identity of A is included in that message. So B knows this session key is for me to use with A, and A only, not others. B gets that session key, and effectively now we've achieved our aim. Our aim was get a session key between A and B, and we've done that. A and B both know KS. Let's look at some things in terms of the attacker. Can the attacker see KS in the third message? Some other user that intercepts all messages. If you look at the third message, can another user see KS? No, why not? They don't know KB. Only B in the KDC knows KB. So the session key in the third message is confidential. In the second message is the session key confidential. Again, yes, KS encrypted with KB. Only B can decrypt that. KS encrypted with KA. Only A can decrypt that. So a third user, say C, cannot find the session key, because it's been encrypted with the master keys. So the session key is confidential, which is what we want. The last two steps are just some confirmation messages to be sure that this message is between the right pair of users. When B receives message three, it replies. It replies using KS to encrypt some other nonce value N2. B chooses a random number. N2 encrypts it with KS, sends it to A. Only A can decrypt that. Is that true? Who else can decrypt message four? B sends it. A can decrypt. Who else can decrypt? Anyone? The KDC can decrypt this. Remember, the KDC knows KS. But we trust the KDC. It's like, if I'm the KDC in the network, you trust me. You don't care if I decrypt all your messages? Well, in some cases. So the attacker cannot decrypt the fourth message. So they will not learn N2. And the final fifth message is the user A really confirms the reception of that fourth message saying, thank you for the fourth message, N2. And we apply a function on N2, which is, say, increment it by one. So if N2 was a random number, the attacker would not be able to learn that. They can't guess the random number if it's large enough. They cannot decrypt. And A increments that, say by one, applies a function and sends it back, and the responder checks, okay, I sent some random number to A. If we receive a response which decrypts and we get that random number plus one, then this confirms that we are communicating with A. Because only A could have decrypted this to learn the random number. Similar, when A receives message four, A knows it's communicating with B. Because the only person who can encrypt with KS is B in that case. So we use those last two steps to confirm who we're talking to. We may see them what happens if we have an attack shortly. So before this procedure, we assume we have master keys known by A and B. At the end of the procedure, we also learn the session key, KS. And our trusted third party also knows the session key. Now put on your attacking hats. What can you do as an attacker to try and defeat this scheme? Either learn KS or fool one of the others into thinking it's got the correct message which it's been modified or repeated. Can the attacker learn KS? KS, if we check, is encrypted with KB and KE, a KA in all of these messages. So the attacker cannot learn it unless they know KA or KB. So KS is confidential, that's good. So the other aspect of an attack we may look at is can the attacker, for example, replay or send a message and fool one of the other entities into thinking it's from the original entity? Let's try some different cases. And we'll not draw them, we'll just look at most of them quite simple. What if an attacker sent the first message pretending to be A? That is, the first message is not sent by A but some malicious user, but the contents of the message are IDA, IDB, N1. Can the attacker receive the response? Yes, the KDC will receive it. It doesn't know it's not from A. The identity says A. So it's from A. The response that comes back, can the attacker decrypt the response? No, because if this is the identity of A and the identity of B, the KDC will use KA and KB to encrypt the session key. So a first and attempt in an attack is to send a fake message 1. And that will not be of any use to the attacker because when they receive a response, they cannot learn KS. We can try and draw that. Let's consider some different attacks and then see why this is considered a secure scheme or what the flaws may be. What's the name of our attacker? Anyone? We'll call them I. I for the imposter. We used to call him Mao for the malicious user, but I is the imposter, the fake user. So we'll consider what he does. Not I in terms of me, but I as in terms of the imposter. I send to KDC the first message. Let's try. And I'm pretending to be A. So I set those three values. That's exactly the same as the original one. KDC sends back a response. I may not draw it all, but look at the protocol and what will the response be. Importantly, KDC receives a message thinking it's from A and it's going to go to B, so they'll encrypt the first part with KA and the second part will be encrypted with KB. If you compare that to the protocol, you'll see what's inside those encrypted messages. But of importance here, the response that comes back, which includes the encrypted session key, the imposter I cannot decrypt. They cannot use that information. So that doesn't really help them in that case. If they then send that message on to B, for example, let's see what they can do. So they don't learn KS. Let's say step three, they now send that on to B. What happens? That is, we've just done step two and now we send the second part on to B, which is this component. What happens next? B responds. Does B know anything's gone wrong? Does it know it's from the imposter? Not yet. It just received a message. Can it decrypt? Yes. It's encrypted with KB. So B decrypts. B learns. This is B here. This is the imposter. KDC. B learns KS. The KDC knows KS. It generated the value. It's inside these parts. I does not know KS because it cannot decrypt this. What happens next? B responds with message four. What is it? Encrypt. Using KS. Encrypt. Using KS. And two. Good. Message four is B takes the received KS. Chooses say a random number. Encrypts it. What happens next? What can our imposter do? We don't know the key. We don't know KS. So we can't decrypt this. We're trying to fool B into thinking that B is communicating with A. So authentication is really about from the normal user's perspective is they want to check and make sure nothing is unexpected. Nothing has gone wrong. So we want to detect if something does go wrong. So can the imposter send back a reply? B is expecting a reply. The normal protocol requires a fifth message that B must receive and check. The fifth message must be encrypted with KS and contain a function of N2. Let's say N2 incremented by 1. What can the imposter do? Send back the fifth message. They need to encrypt using something. Something. They need to encrypt N2 plus 1 with KS. They don't know N2 and they don't know KS. So what they send here, whatever it is is something that B will detect is wrong. Whatever they do, it will not be N2 plus 1 because I doesn't know N2 because it cannot decrypt this because it doesn't know KS. And similar that it will not be able to encrypt with KS because when B receives this message 5 it will decrypt and find that the contents of N2 plus 1 so that indicates to be error. Something's gone wrong. Our steps have not successfully completed. Don't trust this session key. Ignore what's just happened. So that's just one example of what if an attacker tries to modify something or tries to replay or tries to pretend to be someone else. In this case it was the imposter pretending to be A. It worked out. Maybe that was detected by B. Something was detected to be wrong. I'll try another one. Any suggestions of what our imposter can try to do? Let's just roll back a bit. Let's say we got to this stage same as before. Imposter sent message 3 to B. B responded with message 4. What if A receives message 4? The imposter did not intercept it. It went to A. What happens? A cannot decrypt it. So message 1 was from I to the KDC. Message 2 was back to I. The imposter. Message 3 was sent by the imposter. But for some reason if message 4 goes back to A the real A A doesn't know KS. It hasn't seen any of the other messages. Therefore it will detect an error. I've just received a message. I have no idea what KS. I cannot decrypt. Something's gone wrong. So if that happens again A detects it. So you can try different scenarios. What if A receives the second message? Again the imposter sends this message KDC sends it back. It doesn't go to the imposter but goes to user A. Again it detects this because of the nonce value. The response encrypted with the KA includes N1 but user A did not send a message containing N1 previously. So it will know that this is a response to a fake initial request. Let's see if the imposter can pretend to be the KDC. Normal user A sends the first message to the imposter thinking the imposter is pretending to be the KDC here. What happens next? First it can try and send back a response. What's the response contain? It should contain something encrypted with KA and when A receives the response it's going to decrypt and because the imposter doesn't know KA so if it tries to send a response the first part will be encrypted with some key it will not be KA so when A receives this response it will try to decrypt with KA because whenever I receive a response from the KDC it should have the first part encrypted with KA and A will detect that it will not decrypt. So that one won't work from the imposter pretending to be the KDC. Any other attempts? Let's try a man in the middle attack slightly different the imposter will intercept the messages between A and the KDC and see we'll get the similar behaviour. So A sends the first message the imposter intercepts it and is going to forward it on to the KDC the real KDC Let's try this. They use the original identity IDA and they change the identity to their own. You're correct well done. IDI So all the imposter does is change the identity of the recipient, the responder instead of B it will be itself the imposter. What does the KDC do? Try to do the next step and see what happens when it gets back to A So KDC has just got a request from A to I so respond the response will be encrypted the first part is encrypted with KA and let's just look in the slide what it is the response is the session key the identity of A the identity of the responder and N1 all encrypted with KA and then the second part So KDC received a message it takes that it generates KS and combines with the message it received IDA IDI we'll fit it in N1 and then all of that is combined with the second part KA what? KAI We don't need that because we'll see it when we do this So KDC received a message Initiator A Responder I therefore sends the response the first part is encrypted with KA the second part is encrypted with KA What happens next? What can I do? Can it learn the session key? Looking for the second part is the session key plus the identity of A So yes if it intercepts this the message can learn KS I knows KA so they can decrypt and learn the session key KS What can I do with that? Well if this message comes back let's say I doesn't doesn't modify anything Remember A initiated the message I has learned KS if this message comes back to A what happens what should happen so A is respecting is expecting a message to come back and then should forward on to B that's the normal behaviour so if KDC if this message is sent to I and I then forwards it as is it doesn't modify what does A do when it receives this message Do they trust it? Why don't they trust it? The IDs don't match okay user A sent a message IDA IDB it receives a reply encrypted with KA what's in this encrypted message the session key ID of A and ID of I the imposter so user A will recognise this this session key is not between A and B it's between A and I I did not request this I requested a session key for A to B so the user A detects if they receive this message as is they detect something's gone wrong okay that arises if this message comes back A will decrypt this part and see it's IDI here and detect an error so it will see IDI in the message and that tells A something gone wrong so then the question is can we modify it can the imposter modify the identity in that message can they modify this value it's encrypted with KA the imposter doesn't know KA so no they can't modify it not without going detected by A so they will not be able to modify the identity it is set by the KDC so this IDI is set to whatever the KDC received encrypt with KA and the imposter will not be able to modify it because they don't have KA to successfully encrypt it again so A is going to detect that wrong identity in the receiver any other approaches any questions so far we're just going through some of the different attacks that we could try as the imposter and seeing that they don't work they'll be detected eventually and that's trying to indicate that this is a secure scheme that attacks will be unsuccessful any other suggestions imposters a man in the middle attack which is successful good question so we'll get to that in a moment you can try other cases in this case so you try what happens if the imposter changes it and you find that it will be detected so in this case we've seen I think three or four cases there are a few others that can be attempted there is an attack that is successful on this there's an attack that involves a replay of message 3 so the imposter intercepts message 3 from a past communications and then later replays that message then if the attacker has learned the session key then the attack can be successful so there's a special case if the attacker does know KS then they can fall B into thinking that this is the correct session key let's try that and I think that's the only known attack against this scheme the imposter replays message 3 let's try so let's assume these five steps have happened between the normal users A and B but when they happened the imposter intercepted message 3 and took a copy so one last attack the attacker or the imposter has intercepted message 3 and we're going to send it as the imposter onto B this assumes I knows KS there's no way that they know it from the protocol exchange we saw that KS is confidential but maybe some other way they've through other means they've found KS which is require some maybe KS was sent using some other scheme and it was released or revealed to the imposter and KS was learnt by I then how can I use that what I does remember these users should change keys so they repeat this step they repeat this protocol to change keys so what I does is replays message 3 remember message 3 it was encrypted with KB it contain KS and IDA is that correct so that's message 3 I cannot decrypt this they don't know KB but they can replay it that is they intercepted using TCP dump in the past they recorded the packet and just copied those bits and sent it again at a later stage B receives this what does B do what's the normal behaviour for B can they decrypt yes B decrypts they learn KS then B does what responds message 4 in our scheme and we choose a nonce and we encrypt it with KS the imposter intercepts that and because the imposter we know we said from previous attack has learnt KS they can decrypt and find N2 and the imposter can send the 5th expected message they decrypt find N2 and then they encrypt again using KS and increment N2 for example send it to B and B thinks everything's okay so this attack is successful from the perspective of if the imposter replays message 3 after it was sent earlier and if the imposter knows KS through some other means then the imposter can fool B into thinking to use KS as the session key and now B uses KS to encrypt data and the imposter can decrypt that because it also knows KS how do we stop this attack change KS B uses whatever it receives in the 3rd message it thinks this KS was set by the KDC we trust the KDC I receive message 3 it contains some random set of bits let's use it what else can we do and we may not even check that this KS is the same as the previous one it may have been days ago we don't check that how could we stop this attack and it's a simple way how do we generally stop replays we could try to incorporate some additional timing information what we need there are different ways to do it but what we need is that B detects this as a replay it can include a nonce value or a time stamp inside this message as well so this message contains a time stamp today's date and time so that if it's replayed at a later date and time when B receives that replayed message it will detect this is the same message as I received this message has a date and time which is not current today so a simple way to stop replay attacks is usually to incorporate something inside the message that will identify that this message is a duplicate of a previous message a time stamp can work in many cases or some nonce value some sequence sequence number a time stamp in here cannot be modified if it's encrypted with KB imposter I cannot modify so if it's encrypted with KB it cannot be modified the problem with time stamps is that the clocks of the computers involved need to be as accurate as the time stamps are that is if this is happening on a these messages are being replayed at a microsecond level my computer clock may not be accurate and it will not work correctly but if this message is replayed tomorrow then my computer clock will be accurate enough to realise this is an old message not a current one so there is an attack on the basic protocol here but there is a way to defend it as well we haven't covered all the possible avenues for attack but we've covered several and it's a good way for you to understand the protocol is what happens if we try something else will it be detected and if you try different things you should eventually find that everything that we try as the imposter eventually gets detected so this scheme is used in networks which require usually the computers to share master to share session keys so let's say we have a network of servers or a network of computers which need to encrypt their data between each other so with a thousand computers in that network we cannot manually distribute the master keys because there's too many there's 500,000 master keys that need to be distributed so what we do is with a thousand computers we distribute the 1000 master keys manually to the KDC and then the KDC distributes the session key between pairs of users and an implementation of this in some networked applications it's still used in some networks Kerberos is the protocol that is used for this that implements this what's the problem one problem we must trust the KDC if the KDC is compromised returning to one of our earlier pitches where was it if the KDC is compromised that is the imposter can access the KDC the imposter learns the session keys and all the master keys so the KDC must be very secure let's say it's a server on our network if someone can physically get access to that server then that's a big problem because they can learn everyone's keys and that's the problem with any centralized security scheme that that central point becomes a point of failure there may be some performance problems every time two users want to communicate they need to send some messages to the KDC so the KDC the server has to be fast enough to be able to handle and process those messages so it doesn't slow things down but it's good in terms of there's fewer master keys to distribute to make it work even better where there's a large network many different thousands of users rather than one KDC you can have multiple KDCs and they all talk to a higher level KDC you can have a hierarchy for example you have a KDC for the land at this campus you have a KDC at other lands for part of the university and a central KDC for the entire university and it can distribute the load across different servers so we've looked at different approaches for getting a shared secret key between users the first one which we covered on Tuesday was the decentralized approach the users share a session key direct between each other and the second one covered today was a centralized approach where we go via the KDC the KDC is better in terms of fewer master keys are needed but worse in terms of we rely on the KDC what we'll look at probably next week is how to do a similar thing distribute shared secret keys but with public key cryptography or asymmetric encryption


Good morning and welcome to Moments with Melinda. I am your host, Melinda Moulton, and today my guest is Joe Citro. How are you today, my friend? Very well, thank you. I want to thank you so much for being with me. You and I have a lot of similar thoughts about a lot of things. But for my viewers, let me tell them who you are. Joe Citro is a Vermont author and folklorist who has extensively researched and documented the folklore, hauntings, stories, paranormal activity, and occult happenings in New England. Is that about right, Joe? That's about right. I would add just that I specialize in Vermont lore. And I started doing that in 1994 because no one else had ever done it. So it becomes sort of a mission for me to get the collect the Vermont stories. Well, when I was at camp at O'Gon's camp when I was six years old in New Hampshire, I had, I first heard about Vermont and it was about a vampire bat that had bit some farm boy.  I want you to know that I did bring my crystal for us today. And I'm going to pull a tarot card that's going to, because I do tarot readings, which I will do for you someday, which will define our reading for today. Let's see what I picked. Oh, I picked the three of coins. This is our card here, Joe. It's the three of coins. And let me throw the pentacles and let me tell you what the meaning of that is. It means talent rewarded, creative ability, bringing material gain, recognition by an employer, status through accomplishment, abundance, a new home or place of residence, redecoration and pregnancy. Well, I'm not going to worry about that at all, but it is, it is a reformation of who you are and who I am as we move through life being to people who do believe in the strangeness of life. So let's start right now talking with you about your life growing up in Vermont.  Secretly, yeah. I tried not to appear that way, but I have my secrets as two most Vermonters, I suspect. Yeah, yeah, I was a little bit of an outsider. We didn't have goth kids in those days. But if I could turn back the clock, I would probably be a gothy sort of kid. Aha.  And I'm goth because I wear black all the time, but that doesn't mean anything that you wear black. But I was a creepy kid and I would have loved to have known you when I was a child, because I think you and I would have gotten along. So from an early age, you had an interest in horror. Tell us about what piqued your interest in horror as a child. What got you into this kind of cultist place where you live? Well, I think it was kind of a strange alchemy between my parents. My father was something of a storyteller, oral. He knew all the lore, all the towns around where I was kid. When I started being a kid, we were in Ludlow. And that's where my father was from. And he knew all the strange happenings and haunted houses and monsters and murders and things like that that had happened in that area. My mother was a reader. My father wasn't, but my mother was. And her recreational reading was sort of mystery stories like John Dixon Carr and Conan Doyle and Hillary Queen. And I think Perry Mason was at the lighter end of that. But yeah, so I think there was an inevitability about it. I was just going to be picking up on weird stuff. Did you have siblings? Yeah, my brother, who likes to consider himself an only child, he still lives in Rotland and he's far less tuned into this sort of thing than I am. Were you the older sibling? I was the older one. Yeah, he's three years younger than I. Frightened him when he was a child? Did you frighten him with your creepy... I think I frightened everyone, really. My brother, no, I don't think so. I think he frightened me more than I frightened him because he tended to be sort of accident prone. So he was getting hurt all the time and I was trying to take care of him. If you read my short autobiography, you'll get some stories from my brother and his adventures. But maybe you haven't seen that. That's the more normal side of me. If you've seen just the collections of stories you haven't seen everything. Well, I have not seen everything because there's so much out there on you. There's tons on you but I do have a lot about you that I've learned and I'm glad to know that you have a younger brother who you took care of because sometimes people, young kids who are into creepy stuff, can scare their younger siblings and I'm glad that you did not do that to your brother. What was your first interest in horror?  I know that when I was three years old, my father would wake us up. I had four siblings and he would wake us up at three in the morning and march us downstairs to the den where we would watch shock theater. And I was about three and our mother was asleep but she never knew that he did this. Oh, look at my shadow on the wall. That's kind of creepy. And we would mark this down. And I'd be three years old sitting there watching, you know, Bella Lugothi and, you know, all these creepy, the wolf man and it was just, I was raised on creepiness. And that's what made me a little bit creepy as a child. What was it that made you kind of go into this as a child? Melinda, I don't think that's your shadow. Don't turn around. I don't know. I think it was my father, actually, because he, for example, when we would go from Ludlow to Rutland, we'd go by Cuttingsville in the Bowman mansion. And my father would tell the story of how Mr. Bowman lived there after his wife and kids had died spending his years looking for ways to bring them back from the dead. And that would do it. And he supposedly had employees that lived in the house after he died to prepare, to keep the house up and to prepare a meal every night in case Mr. Bowman and or his family should shambles from the crypt and come back to the house and arrive hungry. Hungry and need to eat. And that would, that would peak my imagination as a little kid. And I think that is probably the first scary story that I ever heard.  I was never frightened. I just was enthralled. I was enthralled with it all. I was not frightened. So tell us about some of the horror books that you've written. You've written Shadow Child, The Unseen, Guardian Angels. Tell us a little bit about your writing and some of the books. It starts with those stories that my father told. And when I wanted to take up writing, it occurred to me that some of these old Vermont stories had lasted for a really long time and could be told to a modern audience in a modern way. So I started to put those together as novels. The first novel I ever wrote had to do with a guy who was looking to prove that there was a critter in Lake Champlain. So I built a whole story around the possibility that there's a critter in the lake. That was the first one. That was the first one I ever wrote. That wasn't the first one to be published. But it's a good example of how I tried to use legitimate Vermont folklore and myth and history to build modern novels. That was fiction. So you were a collector and reporter of creepy unexplained happenings, legends, even UFO sightings in haunted houses. And you were the keeper and the share of these collections. And you have been called the bard of the bazaar, I believe, by one of the great newspapers, the Boston Globe. We have them to thank. Yes, you do. You've been covered by a lot of great newspapers and writers. So you are considered the bard of the bazaar. Now, you said in an interview that you are not weird, but indeed, your fascination with the occult and unexplained paranormal realities of human existence does make you a bit out of the ordinary. Yes. That's for you to judge. Well, I think it almost has to be to dive into some of these mysteries around life. And do you feel like sometimes the mysteries of life help you to understand death? That's an interesting question. And maybe that's what set the root of the whole search. I don't know. I don't know. It's interesting to think that there might be something on the other side of the veil. And as I get older, maybe that becomes more more real. The possibility of finding out. Well, if there's nothing after the veil, of course, we'll never find that out. But if there is something after that on the other side of the veil, you know, what could it be? I frankly, I don't, I don't believe that the dead return. I don't believe in ghosts. What I believe in is the ghost experience, that thing that people have that convinces them that they have seen a ghost. Robert Brunel and I did a book where that's considered to some degree. It's called the Vermont ghost experience. Robert illustrated it, I wrote it. And that's the book where I talk most about the possibility that ghosts are not the spirits of the dead. I find it really hard to believe that that they are. Do you believe that ghosts are spirits of the dead? Well, you know, it's so weird that that's one of the things, the questions that I always have is why me? Why am I here? Why was it me that all the time? And especially as you get older. But listen, this is where you and I differ about ghosts, because you do not believe that ghosts are spirits from the dead, but a spiritual phenomenon. Now, I do believe that they are spirits that are living with us. And I do believe they're of the dead, because I've had a ghost living with me for 40 years. And I know who he is. And I know how he died. And I know when he died. And I know that he is, he is, he was a real person. And I know that because people who have come to my house who don't even know about him, who have slept in our guest room, have seen him. And they've seen him in a doorway, and they've asked to be put in another room. And there's been people, and we've experienced him over and over again over the last 40 years. So I do believe that that that ghosts can be and often are spirits who just have not left. And we have his brother to try to do an exorcism and everything. But at the end of the day, that's where you and I sort of disagree. Have you ever heard of a spirit holding down a person while they slept? Yeah, yeah, I've heard of that. Let me ask you this. When you see, have you seen this ghost? Yes. Is it naked? That's not the, that's not the image that you get. It's more, no, it's, it's, you know, I know that that this, that he does not have any legs and he's floating and it's an apparition. But more it's the incidences that happen throughout our life that we've experienced. And then incidences that have gone from my house to another house where he used to hang out. So I'd like, I'd like to meet him. Well, I would love you to come and meet him too. I had a friend, I had a friend of mine, Maureen, who was a spiritualist and she came, she knew nothing about this. And she came to dinner at our house and had a beautiful dinner with her husband. And and we had a great time laugh, listen to music. And when she left, she turned around and she touched my arm and she said, look, I just want you to know in case you don't know that you have a spirit in your house. And I said, yeah, I've been living with him for 40 years. So anyway, let me let me just I used to believe that ghosts were the spirits of the dead. I agree. I believe that there was some possibility that my grandfather or grandmother would come back and communicate with me. But then there's one thought that I had that got me thinking along different lines. And that is, there's no reason why ghosts should have clothing on, because clothing doesn't produce, doesn't survive death. Ghosts should all be naked.  But the ghost clothes do not produce ghosts. But apparitions, but literally apparitions, meaning a movement of a light of some kind of a figure. But that'd be said, I hope someday you get to see a naked ghost. And when you do, let me know. Now I'm going to move on to the vampire. Because I have often thought that I could be a vampire. Now, my first scary movie was the Bella Lugosi. My favorite vampire movie is the one with Gary Oldman. But anyway, I have often thought that I could be a vampire.  And I feel a deep connection. I think they're very sexy. So what is your favorite vampire movie? My favorite vampire movie, that's a good question. You know, Vermont has a great history of vampires. A lot of them here. You know that. No. Well, you must. But let's back to movies. I like, let the right one in quite a bit. Have you ever seen that? No. Let me write that down. Yeah, yeah. There's two versions of it. One is a foreign film, and one is an American remake. They're both equally, equally good, I think. Another one is, I haven't even thought about vampire movies, but I'll leave you without one. Well, tell me about a vampire in Vermont. Is he still here? She here? How do I meet them? Where are they? You know, I introduced Bob Standard to the vampire in Woodstock quite recently. That's probably the most famous one, but I think Bob already knew about the one that was in Manchester. I think Bob Standard could be a vampire. I'm just kidding. I'm just kidding. Anyway, he knows we're kidding. We know we're kidding. So you wrote Green Mountain Ghosts. Tell us about Corwin the Vampire, that poor little boy. They dug him up.  He's the one that was in Woodstock. And it's important to keep in mind that the New England vampire is really quite different from the European vampire. Tell me, how is that?  And eventually the person will die, allowing the vampire to continue to live. It's a very different tradition from the European tradition. It's explored pretty thoroughly in a book by Rhode Island's former folklorist, Michael Bell, a book called, I think it's Food for the Dead, I think is the name of the book. And he, more than anyone else, talks about the New England tradition of vampirism. There's a poem by Amy Lowell called Oddly, The Dracula of the Hills, where she talks about that very same thing. So Corwin is, Corwin was a member of a family and the family was being wiped out by something that people then perceived as vampirism and called it vampirism. Today we would call it tuberculosis. So vampires are wiped out as long as the diseases wiped out. But there were a bunch of different stories all around Vermont of families that had a vampire in them. The one in Manchester, I'm trying to think where I, which book I talked about that one in, it might have been the book Passing Strange. It was Green Mountain Ghosts, wasn't it? I don't know. I can't remember if I talked about the Manchester vampire in Green Mountain Ghosts. Maybe I did. Corwin, okay. I need an index in my head, which stories are in which book. Anyway, as far as I know, no one has ever written a book or made a horror movie about the New England vampire. And I always saw that as part of my mission, but I never got to it. You ever want to make a movie just so you know my husband and I are filmmakers? So we would love to partner with you on that. And I definitely want to be in the movie, because I'm also theatrical. Would you like to play a ghost? I would play anything. I would play the victim. I would play the victim. Oh, I'm fine with that. And I wanted to do the play Dracula by Bram Stoker at the black box. Oh, yeah. And I wanted it to be directed by Mark Nash or have Mark Nash. And then I thought, you know what, maybe I'll make take Bram Stoker's play and have a woman be directed. I could change the genders. And so anyway, that's something that I still have in my heart to produce and to direct on stage is Bram Stoker and have Dracula be a female. Now, let's get back to this. All right, let's get back to this. So the vampires. So you're talking about the New England vampire.  And so I'm not sure if they're vampires or not, but it happens often as humans that we do have people in our lives who suck the life out of us. I know.  Now, you wrote about Champ. So isn't he or she somewhat of a novel mystic legend here in Vermont? And I have a friend who saw him four times and actually took a photo, had a photograph taken and it was in Life Magazine. Are you a believer of Champ? Pretty much. Yeah. The only the only thing lacking, be totally convinced that I haven't had a sighting, but the evidence is overwhelming. And in fact, I'm working right now on a new edition of my book, Lake Monsters, which is about the guy that comes to Vermont to search for Champ. So I might say I'm diving into Champ again right now as we speak. That book is in progress and should be out, I don't know, sometime next year. Well, fans, when it comes out, I want to interview again. So where do you think spirits go when they die? Well, I'm not entirely convinced that there are spirits that go anywhere. So I think if it were me, I'd probably want to go to Canada, I guess. I thought you were going to say cancun. I like the idea that the spiritualists had, which was somewhat at odds with Christian tradition. And that was the idea of the summer land, that when you die, you go to what they call the summer land. And do you know about this? It's just a place that's like a beautiful Vermont summer day where the birds are flying and tweeting and the grass is green and the trees are full of leaves and the air is temperate and perhaps fragrant with flowers and everybody lives smiling and happy in the summer land. That was the notion that the American spiritualists had at the end of the 19th century, early 20th century. I always said that appeals to me much more than the duality of heaven and hell.  That would be a problem for me too. I think I'm a bit of a pagan for sure. And I believe that God is nature and the trees are talking to me all. You and I are kindred spirits. Now, do you want to be buried or cremated? I do not want to be burned. I told my husband that's in my will because I believed that I was a witch and I was burned at the stake in a past lifetime and it haunts me still. So I want to be laid in a coffin and buried and I have my whole ritual written up. I wrote it up 30 years ago. Do you want to be buried or cremated? There's another choice. What is that? It's sort of a green burial where I'm just sort of planted and I become a tree. The idea of getting cremated seems like air pollution to me. Buried in a cemetery puts me off. So I think I just want to be planted in my backyard and become a tree. What tree would you want to be? Oak tree. An oak tree, beautiful, fabulous. They do not yield. They bend. They do not bend. They fabulous. Okay. So do you believe in past lifetimes? You know, I look at the evidence from time to time and some of it is very convincing, but I think there must be another explanation. I like the idea that we have sort of a combined consciousness when we die, that we don't remain as separate entities, but we combine into one consciousness and perhaps in subsequent lives people can tap into a bit of that and think they're tapping into their own past life. But I don't know. For me, I'm such a skeptic and belief requires evidence and personal evidence from me. So I don't know. I'm waiting to pick up some baby some time and recognize it as my mother, but it hasn't happened yet. I don't know about past lives. Well, so do you believe in reincarnation?  I'm willing to be convinced, but belief to me is irrelevant. You know, belief is for church. In what I consider in my version of the real world, there's just no way to know that lacking experience. So if I'm reborn and have some fragments of memories of this life, I may become convinced. I know there are some very convincing stories about past life experiences. There was a teacher in the Bellows Falls school system who convincingly hypnotized one of his students and brought forth a bunch of past life experience about being shot in the Civil War. The teacher and his assistant and the kid went back to the place where all of that happened and was able to verify a lot of information that the kid had given under hypnosis. So it's a very convincing story. I tell it briefly in my book, The Vermont Ghost Experience, but there's a lot more information about it. So yeah, but I don't know what to make of that. I'm not convinced that the kid actually lived before, but maybe he did. Well, I have some great stories I want to share with you. I would be delighted to hear that. Truly. I'm very open-minded. I'm a researcher. I'm very open-minded and you're asking me how I feel about things right now at this moment in the here and now. So which is not to say there is no critter in the lake, which is not to say ghosts are not the spirits of the dead, which is not to say that reincarnation never happens. I'm just saying where I'm at on those subjects and I'm willing to take another look at anything. Well, you're an occultist though.  And so for you to be able to write about it and to dive into it and to in many ways sort of promote the occultism that lives inside of your sort of pagan being, there has to be some kind of understanding that this stuff might actually be or then because you're not a charlatan, you're not making this stuff up. It's got to come from some of the mysteries and I'm a detective.  And so I become a believer, but I was going to say maybe I'm a little older than you, but I don't think I think we're both probably. How old are you? Do you mind if I ask? We're both old spirits. We're young and hard, but are you my age? I'm 72. I'm older than you. How much older? How old are you? In January, I'll be 75. Oh, you look so young. You look very good for 75. You have a very kind and very Santa Claus-y look about you, very generous. And now we're coming to the end of my show, so I just want to let you know that I just installed a cemetery on my meadow and I did it five years ago and I am fascinated with death. I lost my parents when I was young, and my grandchildren, they find it all fascinating, but they're a little weirded out by me. When I put this in, I explained that I wanted to be close to them, so it's right near where everybody lives. And this is where I'll be and I know where I'll be. I know what my view is going to be and I'm planting flower gardens and everything. And I believe that it'll be extremely hard for me to leave this place. And I fully well realize that I may become a spirit that lives here for all eternity, and I'm really good with that, quite frankly. Drop by if you go first. I'll stop by and see you and I'll make sure I don't have any clothes on so that you know that it's me and you believe that actually I am, that I actually am who I am and that I'm there. So I really do hope that you'll come visit me up here and that I can come visit you. I'm going to be down to see Bob and Allison some time after he's in the next couple of months and I'm assuming you're close to them, so maybe we can all get together and chit chat. I'd love to invite you up to Huntington. We have a lot of stories up here in this town that are fascinating and I'm so glad that you are who you are and that you do what you do because we need more people like you telling these stories. They're fascinating. I think my skepticism is really an aid to what I do because with the stories that I've collected, if I told them as if I am a believer that would eliminate a lot of readers and if I told them as if I were a denier would eliminate readers. The fact is I'm right on the fence and I've been that way for years and it can be painful sitting on this damn fence after a while but that's pretty much where I am. If you were a believer, people wouldn't believe you. I totally get that.  You become a believer that yes that was something very, very occult and strange and I have so many of those stories that have happened to us in this house. I would love to talk to you about those things. I've had weird things happen, things that I can't explain, things that if I thought about it differently might convince me that there was something beyond but I think the fact that I can't explain something doesn't mean it can't be explained and I've had weird experiences in my own home when I was living in Burlington. I've had a weird experience in Emily's Bridge and Stowe, the allegedly haunted bridge in Stowe. I actually had two weird experiences in my home in Burlington, the one I had a home down on St. Paul's Street for years and it was pretty old but we don't have enough time for those stories and we'll talk about them someday. Well and what brought us together was my picture on social media about the forest and how at that stone wall at that particular place in the same forest the trees on one side were beautiful and lush and alive and colorful and the ones on the other side were dark and scary and how I believe the trees do absorb energy and so on that note I love your energy. I just love now that I know you in a personal way and I hope that I can have you back when you finish your next book and that you'll come visit me in Huntington and that we can forge a creepy relationship together. Let's keep in touch on Facebook until then and thank you very much for having me on your on your show. Thank you my friend.


Well, hello and welcome to Jonathan from the Heart. I'm Jonathan Astley of Jonathan Astley.com And I'm so excited to be shooting this short video for you today. Our topic when a man deeply loves you, loves you He'll say or do these things Alright really quickly if you're brand new to my YouTube channel Please hit the subscribe button hit the bell so you can be notified of new videos And if anytime during this video the content resonates with you Please hit that like button so I can be seen in the YouTube Algorithms really quickly. These are my weekend videos. I shoot out on my balcony very similar to the videos I shoot my private group called midlife love mastery This is a group where you can have direct access to me on a regular basis and based on the questions you ask I shoot personalized videos just for you just for you So check out the link below to my VIP group called midlife love mastery. All right We're gonna talk about what men say when they're deeply in love with you and what they do when they're deeply in love with you Before we do though, I want to address something that I've noticed Well, I mean everybody has noticed what I'm about to share and I believe men and women are rather Miserable with the dating mating and relating process that exists today And I think it's important to discuss this because before you ever can be in a relationship With someone where they actually genuinely deeply love you you actually have to make that happen You have to two people have to meet one another and We are in a rather dysfunctional world these days Which makes it difficult just to meet somebody that actually Shares your values whose lifestyles is blendable with you and who has the emotional maturity in the relationship skills to actually be in a relationship Not to mention the desire for chemistry that desire for physical attractiveness and so, you know and because of these devices because of these dating apps and such Where's the dating apps? Bumble here's a dating app for example It's made it increasingly hard to connect with people on a real heart-centered level on a real emotional level on a real organic level and You know for the longest time I've been the biggest advocate for online dating and to some degree I still am because here's the reality of it whether we like it or not Roughly about 50% of all new first dates are happening through an online connection And that probably is going to increase for those that are no longer in an environment where they're surrounded by single eligible people I want you to think about people in college. You know, they they're all Congregating together. They're usually most likely single and most likely eligible So there's this, you know depending on which college campus you're at. There's a good chance you can meet someone But then when you move out of college, you know, it's interesting my son after he moved out of college or moved or moved back home You know his his dating his dating pool dropped Substantially, I mean they went to a school with 30,000 students and Literally, there was no one right in front of him anymore And he actually had a little bit of a withdrawal after that period. My son now is 25 So I bring this up because I think this is a really important topic to address beforehand How are we going to meet that partner that genuinely deeply loves us that that wants to lean into a healthy relationship and because the dating process is hyper focused on chemistry and romance I'm gonna repeat that hyper focused on chemistry and romance it oftentimes misses the more important things that are needed to be To address in the relationship process and that is as I said a moment ago shared values blendable lifestyles and emotional maturity via relationship skills and It's difficult to know and by the way, there's this grand assumption I mean it cracks me up how many women and men just assume that that's a given if There's chemistry with one another and we have learned over and over again if you follow my channel that intense chemistry oftentimes leads to intense disaster intense pain Because there's this hook of dopamine and serotonin and testosterone and estrogen and oxytocin and And yet it brings two people together and yet if they're not able to stay together when that when that Relationship ends it can leave a real emotional hole within a person. This is why why I wrote my book What the heck is self-love anyway? Here's a copy of the book. By the way, there's a link below to all the books I'll be recommending today. This is a journey of personal development self-help and spiritual work So it's like a vaccination to emotional chaos because the reality is Most humans and particularly women this is gonna sound a little judgmental This is but my perception is many of you women are operating from the premises I need you to love me so I can feel good about myself. I need you to love me so I could feel good about myself I need you to love me so I can feel good about myself We are suckling on that nipple And I'm here to invite a different narrative. That's why my channel continually recommends over and over and over again different books to read to shore up your Emotional health so you're not so dependent upon a man in a relationship for you to feel good And also I give you the tools with a variety of different books to actually prepare yourself for that guy And by the way, the men have to be doing this too ladies I'm here just any man who's watching this you should be reading the books I recommend you should be doing the inner work that I recommend to do that personal development Self-help and spiritual work so you can actually lean into a healthy happy relationship with someone that you actually deeply can love Men are thirsty for this too. Both men and women are thirsty for Connection, companionship, copulation, coitus, whatever you want to call the the other c-word for sex And yet here's the distressing problem today We are living in an environment where there's no commitment needed to have sex with someone Repeat that there's no commitment needed.   Stop stifling your voice If you read my book chapter 9 says if speak, you know If it's sincere and from the heart you can't say the wrong thing to the right person Ladies you should be speaking up communication is critically important for relationship and you all talk about this You say this over and over again. How important is communication? How important is communication?  This is why I recommend these two books lately Couples guide to communication couples communication guide and how to build trust in a relationship because trust is what's going to Trust is what's going to make a man deeply love you trust means You can count on each other trust isn't about fidelity as much as it is Can I count on this person and let me tell you the reason why this isn't happening? And there's an there's an irony here because I'm wearing my t-shirt that says friends And you can see all the different quotes from friends Pivot pivot pivot. How you doing? What's distressing lack of what I'm noticing today in the dating process is two people genuinely becoming friends with one another Because again, as I said earlier, there's a hyper focus on chemistry and romance and not enough attention built to or addressed In the building of the friendship and let me tell you how friendship is built First off, it's doing stuff together By the way, my weekend videos are supposed to be my calmer videos and I realize I'm in my passionate intense moment here.  It's through doing things together social activities hobbies Mutual interest spending time with family and friends traveling together Going on hikes going on walks going to do events It's not built over the telephone You can maintain some level of friendship through the phone But many of you are spending more time on the telephone with someone and that's a false sense A false sense of intimacy Intimacy is built through the doing things together But Jonathan, I'm in a long-distance relationship and we can't do things together. Yeah It's going to be hard to really build that deep roots of trust that bond That's actually going to make a man deeply fall in love with you be on the sexual piece And I talked about this before ladies If you haven't read the book Eight Dates by Doctors John and Julie Gottman read this and read this with a man before you sleep together This will actually help build the intimacy between the two of you is talking about What you both want Stop being naive to this stop Expecting the man to be the leader of this you were in charge of your relationship destiny not the guy But Jonathan all the feminine energy coaches tell me to let the man lead Ladies Are men really good leaders of a relationship? I got to tell you some all the happy Couples I know the women are literally in charge of the relationship in a healthy way They are in charge of the social calendar. They're the they're the They're the social concierge of the relationship and that's what that's why I know so I personally know so many happy couples And I will tell you these are women unafraid to speak up And they're unafraid because it's they're not caught up in the gender rhetoric All the gender rhetoric is one of the reasons why you're miserable in the dating process If you want to change your narrative read the book if the buddha dated if the buddha dated it throws out all the gender rhetoric And says how can we connect at a soul level? How can we connect at a heart-centered level? How can we connect at a friends level? So in a moment, I'll share with you those things that men say or do Really quickly my mug says to say just keep swimming This was a gift from one of you beautiful folks out there. Thank you so much I I am so grateful for all the kindness loving care you send out there. Thank you so much I really appreciate you And by the way, if you're finding value in this right now, please hit that like button for me Please share this with your friends. Please post a comment I'd like to get a discussion going on this because ultimately if you want to be in that relationship where a man deeply loves you He'll say or do these things. So I'm going to put on my trusty glasses. We're going to pull up our notes wish All right So one of the things I'm going to give you some examples when a man genuinely cares for you Start to pay attention for these things Does he start using we language when you talk and by the way, let me be clear about this This is well after the Heightened chemistry phase that you might experience. This is for those couples that are actually starting to move into a more significant they've spent significant time together And I just said they use we language So I want to just differentiate because guys who use we language in the early stages of dating That's usually to copulate. That's usually to get coitus. Okay That's usually just to get sex. I'm talking about after you've slept together a number of times What does a man demonstrate? He starts using we language with the two of you. Hey, we should go do this. Hey, let's let's we should It's either we or us. Okay. We are us, but he oftentimes says we And again, this is after there's been sex and it's been a Season starting to become a seasoned relationship. He'll start using we language Now by the way, this isn't a guarantee or an absolute I know that plenty of people will use we and then still break up But these what I'm about to share are good signs that it's moving in the direction Of a fully committed relationship in number two He knows when something's off or bugging you He know he can feel your energy when a man can feel your energy and he's asking He's just checking. He might say can I check in with you? Are you okay?  You know, I'm talking about there's a subtle thing that's off A man who genuinely deeply loves you will recognize that and he'll lean into it Men who are not in love with you or men who are avoidant will when they notice your mood is off They will go the other direction Or needy men will do the opposite. They'll start going. Do you need something? Do you need something? Do you need something? Do you need something? Do you need something? Why don't we think about you do the same thing ladies? So this isn't singular to men This is both men and women alike when they're in a needy mode They want to fix right away and when they're in avoidant mode, but a healthy secure male and woman male and female Checking in something feels off. Are you okay? And it's an opportunity to communicate again ladies you talk about the importance of communication and yet so few of you Oftentimes are afraid to speak your truth because you believe That he's going to run away That's not how intimacy is built intimacy is through the conversations If you need some help with that, I highly recommend checking out this book I hear you the surprisingly skills behind extraordinary relationship Check this book out.  It's like a a life vest If you fell into the water deep out in the ocean, by the way, can you see the ocean there? All right, number three He pays attention to you pays attention to your needs. He pays attention needs He will say things like I'll get that for you. I was in a relationship with a woman. I'll give you an example here I was in a relationship with a woman Why am I crossing my arms? I'm just a little cold I was in a relationship with a woman and she had two big dogs and You know, I knew that um, she would or she would purchase dog food and they were 50 pound bags Or maybe 40 pound bags and you know, I realized, you know, she was doing it by herself We had just started dating and I eventually went to the store on her behalf and would go buy the dog food for her I say I'll get that for you To make her life a little bit easier when by the way, you do the same for a guy You know, when you recognize something is off or you know, he needs something you go I'll get that for you. That's what couples do when they genuinely start loving each other This isn't rocket scientists. You know this And I just want to give you some insight into how men operate when they genuinely care about you versus the men Who don't they're not paying attention to these things probably because many of you are in relationship with guys where you barely see each other It's more of a hook-up casual relationship instead of something that's growing together And I'm going to talk about that in a second and number four He starts doing the things that you do and I'm going to give you an example I've shared this before but um Not but and I was in a relationship with a woman and every time we went out to dinner She wanted to yelp the restaurant just to read the reviews and she did this for amazon purchases everything She reads the reviews. I never did that But and then we started to do that and it gives us some insight into the restaurant or things we're going to purchase Well, now I start to do something that she does Or she well, this is a former relationship But my point is when we're in relationship with someone we start to take on their habits their their Their way of doing things not always but just enough And it becomes very you know, it's it's really saying to your partner. I accept you for who you are I appreciate you for who you are And that's a great example and last but not least He invites you into his life his family his friends He's progressing the relationship forward He wants you to be part of his life and those are great signs and again I said this before be careful of it in the beginning beginning stages If a guy uses we or he introduces you in your life and he tries to do things for you remember That's when a man is in the hunt mode. He's hunting. He's hunting. I'm talking about afterwards So as my mom always used to say You know what I used to take what you're in the beginning I took what your father said with a grain of salt again. I'm not talking about the beginning stages I'm talking about once you start to establish a relationship with one another and the reason why it's becoming Increasingly hard to get there. It's because folks today. We are meeting total strangers We're two meeting total strangers and I want to wrap up with the idea of reading this book talking to strangers by Malcolm Gladwell what you should know about the people you don't know Folks if you want to build a deeper relationship Then you're going to have to ask better questions and you're going to have to start paying attention because here's the problem We really don't know someone it takes at least a hundred hours of face to face time Just to get to the first layer of trust the first layer of trust the first layer of friendship And then there's another hundred to 200 hours for the next layer Another hundred to 200 hours for the layer after that It's gonna take I mean it takes a good six months just to get to know someone at a base level Sometimes it takes years to get to know someone. I know a lot of you have been in relationship where you realize after 20 years You never knew the person Because you went in blindly you went in cavalier Lee you went in naively And I'm here to say it's time to do it a different way. Can you do that for me? All right, I think you get the gist of where I'm going I'd like to hear your thoughts on this. Please post a comment below. Let's get a discussion on this What do you think of my shirt? What do you think of my mug? And we're going to wrap up this video as I always do first off give myself a big gigantic jonathan bearic of self love I'm going to reach into the camera and give you a hug of love if that's okay I'm going to ask you to turn to someone a pet a teddy bear a pillow and give it or them a hug of love Here's a teddy bear Because let's face it Hugs are a great source of love and we could all use more love in our lives. Thanks a bunch. Bye. Bye now. Bye. Bye


In the last session, we were talking about the resource dependency theory and we were looking at how we can constitute a better board which would be more diverse, which would be more linked and which would facilitate the progress and the success and the longevity of any organization. Today, we are going to look at another theory and that theory is the transaction cost theory and just like all of these theories have a reflection within their own nomenclature, so over here again, we are going to be looking at cost, transaction, seeing their relationship with a particular organization and then also the role of the board in all of this. So, let us look at it on our slides and then we will further explain it over here. So, looking at the transaction cost theory, we basically see that company is looked at as an efficient hierarchical structure that serves as framework to run contractual relationships. It is interdisciplinary in nature. Now, when we are seeing this and because the nomenclature itself tends to resonate and reflect the implications of cost and transactions, therefore, when we are looking at the organization, then we are talking about the organization having an efficient hierarchy, having a more responsive organogram, having employees which facilitate stakeholders, do not create hurdles, do not create barriers, do not have red tape, do not tend to black roll different transactions, but actually tend to facilitate them in a better way, so actively engage and try to iron out the differences and the different conflicts which tend to arise, which would lead to a framework which runs towards contractual relationships. So, that is extremely important. I mean, look at the relationship between McDonald's and Coca-Cola. This relationship has been based over decades and how it has been nurtured forward and how McDonald's has basically been able to create very progressive, very proactive, very conducive and very win-win relationships with their different contractors through this contractual relationship. Now, the nature of this particular theory is definitely interdisciplinary because the different departments, the different divisions and the different sectoral heads within the organization basically come and play and they work in harmony with each other and they try to facilitate each other, try to create an environment whereby the different stakeholders, both internal and external, feel more comfortable, feel more ownership for the company and are able to give their best to the organization because the organization is also giving its best to those particular stakeholders. So, let us look at it a little bit more and we can see that in that particular context the firm as an organization comprising people with different views and objectives, individuals are self-interested and opportunistic in nature. Now, these two points again tend to categorize this particular theory. On the one hand, we see the firm as an organization which definitely has a rainbow of people with different views and objectives, people who interpret things differently, who understand things differently, who look at the organization differently, who look at the organizational products differently, who look at the organizational values from a different context all together and they all have their different ideas and creating this political metabolism and embolism which exists within that organization which can have a positive impact or can have a negative effect. Now, this transaction court theory tries to channelize all of this towards a more positive context which would then lead to the betterment of the organization because again ladies and gentlemen when we look at individuals or employees from a psychological context then people are self-interested and opportunistic in nature. Now, this is something which should be discouraged definitely we should not be opportunist and we should have self-interest but we should also have the interest of other people around us be empathetic to them, be sympathetic to them, understand their needs and also try to cater to them that is also the role of the organization but unfortunately because of opportunistic basically attitude and designs coupled with self-interest sometimes organized organizations or boards or top management tend to manipulate and exploit the employees to such an extent that it creates animosity conflict bad blood and sometimes can lead to major conflicts also. So, that should be avoided at all costs. Now, let us further look at it from another context and therefore when we are looking at this transaction cost theory there should be emphasis on the need of strong legal mechanisms to deal opportunistic behavior. Now, ladies and gentlemen this is a very very important time this is a very very important point. Now, when we see it we basically have to create legal mechanisms and frameworks rules and regulations we have to create SOPs manuals in such a way that people do not tend to have a opportunistic approach or behavior towards the organization whereby through corruption and bad practices or bad governance they extricate the maximum for the organization for their own self-aggrandizement which would lead definitely to the debacle of the organization. So, for the longevity of the organization it is extremely important that there has to be a strong emphasis on creating legal mechanisms to deal with opportunistic behavior it must be condemned it must be punished and there must be repercussions for doing things in the wrong way because every employee within the organization should be working for the betterment of the organization and for the betterment of the whole and that is the transaction cost theory. Thank you so much.