Before we go through the example of the handshake operation, back to our sort of our practical implementation, we said that in HTTP, your browser sends a GET request to the operating system. And that uses TCP. With HTTBS, your browser sends the request to some SSL software on your computer, which then sends to the operating system. Where is this SSL software? Well, it turns out for many browsers, when you install your browser, either the SSL library is included with the browser, or, so either the SSL software is just packaged with the browser, or the SSL is provided by your operating system, or it comes installed when you install your operating system. With a browser, usually it's specific to the browser. So it depends upon the different operating systems. There are many SSL libraries. So this web page on Wikipedia lists most of the SSL, or here, TLS libraries. And I never remember the names, but some of them that we know about, or some common ones, we know there's open SSL. Most of the browsers you use today, they may not use open SSL. But many web servers use open SSL. So the Apache web server, by default, uses open SSL to implement SSL at the server side. What does your browser use? Well, some of the other ones, which you may see around, GNU TLS is one other implementation. Network security services, NSS, comes with Mozilla, Firefox. So NSS is one that's been used to implement SSL with Firefox. It may have changed some versions of Firefox, but that's one of the common ones. So when you install Firefox, NSS comes with it, and NSS does that SSL component. So it may be hard to see if we can zoom in. Network security services, Firefox, and other applications. Open SSL is a separate project. RSA was one used by many companies at its own one. Microsoft has a library called S-Channel. So when you write an application that runs on Windows, then when you write that application, if you want encryption, you may use S-Channel to implement the secure sockets there. And Apple has secure transport. So if you have an Apple application that wants to use SSL, you don't need to implement the encryption operations. You use the secure transport library provided by Apple. So there are some other ones which are available. And a good thing about having libraries is that you don't have to implement the encryption techniques, the cryptographic techniques. Now, with security, of course, even if the algorithm is secure, but someone then implements that algorithm and makes a mistake, and they have some bugs in the implementation, now maybe the implementation is no longer secure. So having secure implementations is very important. Trying to do it yourself, there's a high chance you'll make a mistake and lead to a security flaw in your application. So that's one of the benefits of using a well-known library. Many people have developed them and spent lots of time testing and trying to show that they are secure. So that was a little bit about the implementation aspect. Just before the detailed example, one last thing. Any application that uses TCP may use SSL, not just HTTP. It's just the example we're using uses web browsing, but other applications also use SSL in a similar manner. So with that, let's look at the example that shows these handshake messages, not all of them, but the main ones used by HTTPS. So what I have done before is I accessed a website, and before was actually a couple of years ago, so I did it before. I accessed a website, but importantly, I told my browser to use HTTPS. How do I tell my browser? The URL contains HTTPS. If you click on a link, that link either uses HTTP or HTTPS. That's how you tell your browser which protocol to use. So I accessed a website using HTTPS, and then I captured all the messages sent between my browser and server, so we're going to look at and draw those messages. You can download this capture, and the other one, I think it's linked to on the course website, and look at yourself in Wireshark. Let's just summarize first. It's different addresses than in the previous example. My browser is <IP_ADDRESS>, and the server is <IP_ADDRESS> in this example. So just remember, those two IP addresses identify my browser computer and the server computer. And be aware, even though with HTTPS we're trying to encrypt and keep the messages sent between browser and server secret, we want confidentiality, we don't keep the server that I'm contacting secret. Someone still knows I'm accessing this website, but they won't know which particular page on that website I'm accessing. So when I say the URL is encrypted, well, the page will be encrypted, but someone can still intercept and see that this computer is accessing this computer, then they can do some investigation and find that this <IP_ADDRESS> corresponds to the ICT web server. And they know I'm accessing the ICT web server, but which page on the ICT web server will see that's encrypted. What do we see in this exchange? We see that there are some TCP messages at the start, and briefly, here's our TCP connection being set up between browser and server, the SIN, the SINAC, and AC. So that's the normal as with HTTP. Before we send any data, set up a TCP connection. Note that the port number used by a web server is different when we use HTTPS than HTTP. The port number used by a web server with HTTPS is 443. And that's what we see in this summary information. We're connecting from our web browser port, some random number, to the server using 443. With a normal HTTP server, it would be 80 here. We set up a TCP connection. Then we start to perform the SSL handshake. In this case, we're using actually TLS. We say SSL and TLS are the same, but there are some small differences in some of the versions. My software here shows me it's listed as TLS version 1.2. But when I say SSL, I also mean TLS here. There's a three-way handshake for TCP, and then we see the SSL messages. There are some TCP acts that come back, but I'm going to hide them so we can focus just on the security messages. So I'm going to filter out and show it only the SSL messages, and it becomes a little bit easier to look at in summary. And the protocol, there's no need to see that. We know it's the same. And this is the exchange of messages for our SSL connection between browser and server. So we'll go through these and see what's happening. Remembering, there are four phases. Negotiate capabilities, say hello, phase one. Phase two, the server authentication is performed using a certificate. And key exchange, server key exchange. Phase three, in phase three, it's optional to allow a client to send a certificate to the server. That's not commonly used in web browsing. So we will not see the certificate sent from client to server, but we will see the client key exchange in phase three. Phase four, they finish up with the change cypher spec and finished. Then there's data that is sent, but encrypted. What's shown in the info column here is the SSL messages, the client hello and server hello. A certificate messages is sent from server to client. Server key exchange, sorry, from server to client. Client key exchange from client to server, and some change cypher spec. We'll see one that's not listed in the slides, new session ticket. We'll return to that later when we see a more complicated example, and a change cypher spec. And then these messages, application data, they are the actual data from our application. But encrypted. So when we look at them in detail, we will see that we cannot see the HTTP get request. We cannot see the web page coming back, because it's all encrypted. We can guess that that's what these messages are. One of these is the browser sending a message to the server saying, I want to get a page. One or multiple are the server sending back to the browser saying, here's the web page. But when we zoom in on the data, we will not see the HTML, because it's all encrypted. So let's go through and we'll draw the exchange. I will not draw the TCP three-way handshake. We know there's a SIN-SIN Act, an Act will focus just on the SSL messages. So the first one is a client, hello, send from my browser to the web server. And we'll keep track of them as we go, and keep track of some of the information that's sent as well. So the first message is a client, hello, message. I'll simply list as hello. It's coming from the client, it's going to the server. What does it contain? That's of interest to us. So let's look inside and see what the client sends to the server in this case. I would double-click to look at the message in detail. It's a SSL message sent using TCP and IP. If we zoom in on the SSL message, I expand that, maybe just to start. First we see this is sent using the record protocol. So every message with the SSL is sent using the record protocol, but it's a special type of message, it's using the handshake protocol. So remember the first start of SSL, we do a handshake. And the type of handshake message is a client, hello. So we'll look inside, there's a structure of this message, some fields to say what type of message, the length. But inside the client, hello message, we'll see the important information. I will not show every field we've got the length and so on. First there's a random number. So commonly we've seen with key exchange and other protocols for security, we often use nonce values and we use random numbers for different purposes in security. So what they, both the client and server will do, the client has generated some random bytes and sends them to the server. They will be used later by the server, okay? So the client and server know both of those values. Note what an attacker can do, an attacker sees this. Anything we see on the screen, the attacker can see because they can intercept as well. So this is not secure, these random bytes. But we'll come back later, the random bytes, we'll see it in use. What else? The cipher suites, let's scroll down. So this is, there are 11 set of options sent by the client. This is the client saying what it supports. And the client supports 11 variations. Let me select say this one because it's a little bit easier, then we'll go back to the others. What does it mean, all this long string here? And there's common in exam question, here's a string, what does it mean? It's not so hard, it's split into different purposes, all right, TLS is the protocol we're using, we're using TLS, SSL. DHE, what do you think DH means? Diffie-Hellman, so the purpose of this string is the client is saying to the server, what do I support, what algorithms? And one of them I support Diffie-Hellman, and the first one is used for key exchange. So we support Diffie-Hellman for key exchange. Now, what does E mean? Is ephemeral, Diffie-Hellman ephemeral, there are slight variations on Diffie-Hellman, this one, which is the most common, means that with Diffie-Hellman, we would generate a public key for this instance, and if we do it again, we'll use a different public key, we'll keep changing the public key. There's a fixed Diffie-Hellman where we use the same public key every time. But that has a problem that if the public key or the private key is compromised, all of our subsequent communications are compromised. So Diffie-Hellman ephemeral, the e, means let's just use a Diffie-Hellman public key, private key pair now. If we do this again, we'll use a different one. I think they all use that, all that use Diffie-Hellman. So the first value is the algorithm for key exchange. RSA, what's that used for? We're going to exchange a secret using Diffie-Hellman, what may we use RSA for then? So not for key exchange, what? Generate a key, what type of key? Why do we need to generate a public-private key? We know RSA is a public key algorithm, so yeah, we can generate key pairs. We're saying Diffie-Hellman will be used to exchange a secret. So why would we need RSA as well? We could use RSA to exchange a secret. In fact, then two down, the key exchange algorithm is RSA. So that's an option as well, use RSA to exchange a secret. But here we're using Diffie-Hellman to exchange a secret. RSA will be used for authentication. Remember with public key crypto, with Diffie-Hellman a man in the middle attack is possible. The server sends its public key to the client, a man in the middle can modify that. So we need to somehow authenticate the public key. We will use RSA to authenticate the public key for Diffie-Hellman. And how do we authenticate? Well, we use digital certificates. So RSA will be the algorithm used for the certificate of the server. Diffie-Hellman will be used to exchange a secret. And to make sure that there's no man in the middle attack on the Diffie-Hellman exchange, the certificate will be used. So key exchange algorithm, authentication algorithm with symmetric key cipher. To encrypt our data, we're going to use AES, 128 bit key, CBC mode of operation. Last one, hash algorithm. So when we perform hashes, we'll use char in any of the operations necessary in here. We'll see when we generate some keys, we'll use a hash algorithm. We'll see that come up. My browser supports different variations. You see the 11 it offers to the server there. What's different? Different key lengths, AES, 128, AES, 256. Which one's better? 256 is better, why? Better for what? Better for security, better for making it harder for the attacker to find the key. Worse for performance, okay? So there's a trade off there. If we think 128 bits is sufficient, maybe we want performance, so we stick with that. This one, RSA is used for both key exchange and authentication. So we don't use Diffie-Hellman for key exchange. We would exchange a secret by encrypting with the public key and sending that encrypted message, and we'd authenticate also using RSA certificates. So we can combine key exchange with authentication if we want. What else do we see that's different? CBC mode of operation, we see that AES has a special mode of operation that we didn't cover called GCM, designed for AES. So there's another mode of operation which is common. Last one that's different here, EC. Elliptic curve cryptography. If you remember Diffie-Hellman, Diffie-Hellman is based upon the challenge of solving discrete logarithms. So the reason Diffie-Hellman is secure is because solving a discrete logarithm is hard. Well there are other mathematical problems which are hard. For RSA it's about factoring primes. For Diffie-Hellman, solving discrete logarithms. There are other math problems. One is finding points on curves. And it's referred to as elliptic curve cryptography, EC. And there's a variation of Diffie-Hellman that uses this elliptic curve cryptography to, can be used for secret key exchange, EC-DH. And similar, DSA is an authentication or signature algorithm, an alternative to RSA. The digital signature algorithm can be used in different modes. Triple desk is also an option down here. So the client says what it supports. What else does it include? What compression algorithms it supports? The client supports which compression algorithm? It doesn't support any. Null is the compression algorithm meaning we're not gonna compress anything. I can't decompress anything. In other cases you may see the client supports specific algorithms like ZIP, GZIP and other algorithms. But here Null means the algorithm is don't compress. Some of these algorithms have some initialization parameters. And the extensions may include some of them. For example, for elliptic curve cryptography you need some other parameters. So there's some extensions that include some parameter values. But we're not gonna go into those, we won't need them. The main purpose of this message is for the client to say what it supports. Let's see the next message. The server says hello, the server hello. Now what was in this hello message? Some things of interest, some random bytes. And the, we'll say the preferred cyphers. The preferred algorithms, I'll say ALG. The preferred algorithms, those 11 sets that we prefer. We send that to the server. The server sends back a hello message. What's inside that response hello? Note that within SSL there are actually two messages here. The server hello is coming back. And also the next message, which is a certificate, is also coming back. The client says hello, the server says hello back, but then the server sends its certificate. So there are actually two separate messages, but when we send them across the network we can put them into one packet to save how much we need to send. So there are two different logical messages, but we see it's, both of them are put into one packet here. So let's look at the first one first, the server hello. Here it is. It includes random bytes as well, some random bytes from the server, and it includes the selected set of algorithms. TLS, Diffie-Hellman, Ephemerial, for Key Exchange, RSA for Authentication for Certificates, AES128CBC and SHA for a hash algorithm. So what the server did, the server knows the set that it supports, it knows what the client prefers, it chooses the highest preference from the client that it also supports. In this case it's got this one. No compression. So what comes back is also some other random bytes, we will use them later, and the selected algorithms. And in our example, what do we select? We have for Key Exchange, Diffie-Hellman, for Authentication, Authentication of the server we'll see RSA, for Encrypt, that is the data Encrypt. It was AES128CBC and for the MAC or the hash, which we also use for the MAC, we'll use SHA. So the MAC function that we're going to use is HMAC with SHA. Remembering that a hash function takes just data as input, a MAC function takes data and a secret, we can turn a hash function into a MAC using a technique defined as HMAC. HMAC turns SHA, a hash function into a MAC function. So we use the MAC for the data integrity. Next message. And this next SSL message is in the same packet. What is it? It's the certificate of the server. And in the last lecture, we looked at certificates and some examples and if we expand and expand, this is a signed certificate. We have the subject, the subject is who's certificate it is and you see that the common name is the domain name of the ICT server. So the website I accessed in this exchange was the ICT server. This is the digital certificate of the ICT server. The subject is ICT and the issuer is the authority that signed it. I think in the time that I did this capture, then it was a self-signed certificate, let's check. We didn't have a real certificate then, right. Here the subject was ICT and the issuer was also ICT. That is it was a self-signed certificate and that's when accessing the ICT web server wasn't secure and if you access the registration website at the same time, you've got that warning message because we didn't have a real certificate there. But since this capture, we've got a real certificate for both ICT and registration which is signed by Komodo which we saw in the last lecture. So this is the digital certificate in the same format as what we've seen in previous examples. So let's draw that and I'll draw it as a second message even though it's sent in the one packet and it's the, what is it? We could think it's the certificate of ICT signed by an authority. What happens next? Browser receives this message, what happens next? Server, before the next message, what does the browser do next? You're the browser, you just receive the certificate from the server, what do you do with that certificate? You verify, you check if it's correct. So your browser, when it receives the certificate, it checks, is this signed by someone I trust? If yes, then it will proceed. If no, that's when your browser will show you this warning. You've just accessed a website that I don't trust. Do you really wanna proceed? Yes, we trust this certificate, so we proceed. Let's close that message. What's next? Another message sent still by the server to the browser, server key exchange. What's inside? The server key exchange. What algorithm are we using for key exchange? Diffie Helman, we negotiated. So this is the part of Diffie Helman now. We now need to exchange a secret between browser and server. So the server is sending a message called server key exchange inside that message, which is 523 bytes, is what? And if we look, unfortunately, Wireshark doesn't show us very clearly, but if we look at this message, here it is, here are the 523 bytes. What are all these values? Think of Diffie Helman. What does the server send to the browser? Remember the Diffie Helman exchange? The server selects its private value X and calculates its public value Y and sends Y to the client, to our browser. So inside here, my Wireshark software doesn't show it clearly, but these bytes include the public value Y of the server. What else is sent in here? What else must the client know for Diffie Helman? You need to remember the Diffie Helman key exchange. There were two public values at the start, alpha and Q. Remember, we have alpha as a base and we have Q as a modulus. So these two public values are also actually sent inside here. This message contains three values, alpha, Q, and Y of the server. It doesn't clearly show in this software the separation, but I know that that's how they are included. So we'll draw that message, say key exchange, and inside that are the Diffie Helman values, the public values, the global public values, alpha and Q, and the Y value of the server, I'll denote as YS. Of course, the server also knows its private value, XS, that's saved at the server. What happens next? What do we expect to see as the next message? What is the client going to send back eventually? You look from the picture, you'll see the next message, but for Diffie Helman, what do you expect next? Public key of the client, the browser. So eventually, there needs to be a message coming back containing Y of the client, where that can then be used to calculate the shared secret. And that will be in the client key exchange message. But there's something else before that, as you noticed. So we've done hello, client and server hello. Server sends the certificate, it also sends the Diffie Helman public values. We're not going to send a certificate request to the client, we're only going to use certificates for the client to authenticate the server, for the client to check it's talking to the right server. For the server to check it's talking to the right client with HTTPS, we don't normally use certificates, we use the form-based logins. So the user provides a username and password via the HTTP form. So there is no certificate request, there is no certificate from client to server, but we have a server hello done message and then the client responds with a client key exchange, including its Diffie Helman public value. So we'll write them down. First, let's see them, the hello done is included in this message, so the server key exchange and the server hello done are in there. Hello done is saying we've finished that stage. There's nothing of interest inside there. And then the client, once it's got the Diffie Helman parameters, note that we can record the XS is not sent, but is known by the server here, it generated its private value and the client does the same, it generates its private value, XC and calculates the public values, YC. The client key exchange and here inside that message we'll see shortly should be the Diffie Helman public key YC, the public key for client C. Let's have a look at that message and then we'll return to our diagram. So here from the client to the server, client key exchange is included, plus some other things, but look at the client key exchange, Diffie Helman client parameters. Public key, so why shark in this case shows me the specific value, there's only one. Here is YC, the public key, the Diffie Helman public key for our client. So that's sent to the server. What happens next with Diffie Helman? When the server gets this next message, what's gonna happen? Generate before RSA, how do we finish Diffie Helman? Calculate the secret key, that's the purpose of Diffie Helman to exchange a secret K in this case. So when this public key is received by the server, the server can calculate the secret key. We'll denote here as KCS, a key shared between client and server. And similar, the client also finds the same value. That's the idea of Diffie Helman. They can both get the same value. It's gonna be a long diagram, but that will take us to the finish of this topic. So send the certificate to the server, from the server to the client. The client verifies it's talking with the correct server. It verifies the certificate and when it verifies the certificate, it learns the public key of the server. So now the client has the public key of the server. Coming back to the key exchange. How do we know a man in the middle attack didn't take place? Server sends alpha Q and its public value to the client. Maybe a man in the middle modifies that public value from YS to Y of their malicious user. How does the client know that didn't take place? What else is needed here, which we haven't shown? It's not shown, we haven't drawn it yet. How would we make sure that when we receive the public Y value, that it hasn't been modified? How do we make sure something's not modified? Add a Mac, but we can't use a Mac yet because we don't have a secret exchanged. So what do we do to authenticate? So basically two ways to authenticate, add a Mac, but we don't have a secret to use a Mac. So what's the other way to authenticate? Not random bytes. Time stamp. Not timestamp. How do I authenticate messages? The server can sign the message. The server signs the message using its private key, private RSA key. Note that the certificate contains the public key, the public RSA key of the server. When we receive the certificate, we learn the public key of the server. So let's write that down. The certificate contains the public key of the server. So when I say PU here, I mean the public RSA key. We're using two public key algorithms, RSA and also Diffie-Hulman. PU is for that public RSA key. So in fact, this key exchange message, it is not just alpha, Q and YS, but it's signed using the private key of the server. So that server key exchange message, which contains the Diffie-Hulman public value, is signed with the private RSA key of the server. When the browser receives this key exchange message, it uses the public key of the server to verify the signed key exchange message. How does it know it's got the right public key of the server? It verified the certificate. Using the authorities public key. So we've got the combination of two public key algorithms here. The RSA certificate makes us, the client knows, talking with the right server and has the correct public key of the server, correct RSA public key. Then we use that to verify that the correct Diffie-Hulman public key is received. So now we know that YS is the correct value and we're sure that the KS values we generate have not been intercepted by a man in the middle attack. Questions so far. Our aim in the last 20 minutes is to finish this example, that's it. But it's a very important one because it captures, brings everything together. You can answer an exam question, explain what these steps do. You may not have to remember all the steps, but if I show you the steps, explain what some of those steps do. What's the purpose? Okay now, any questions? Good. In summary so far, we receive the public key, the RSA public key of the server in the certificate. We verify a certificate using the authorities public key, which we already have. Then the Diffie-Hulman public key, YS, is received and we verify it's the correct one using the RSA public key of the server. And that's how we prevent men in the middle attacks. Maybe just note that. We verify the certificate with the public key of the authority, the CA. And we verify this message with the public key of the server. These are both the RSA public keys. We know we have the right public key of the server because of the previous message was verified. Of course it all assumes my browser has the public key of the authority, which was preloaded into my browser when it came installed, the certificate authority. We're almost done with the key exchange. I think the last message now is what client hello done are not quite. Client key exchange and now the client says, let's change the cipher. Let's go back to the summary. We've done the key exchange. We both have a master key, KCS. So now we can stop using Diffie-Hulman and start encrypting our data. So the idea is that the client tells the server, let's change to use AES. And similarly in the next message, the server will tell the client, let's change to use AES. They actually do it in both directions because in theory you can have different algorithms in both directions, one using AES, one using a different one. So that's the purpose of the change cipher specs to say let's move to now encrypting our data. But there's this other message in here which we'll draw and then we'll explain news session ticket later with a slightly different example. So let me just draw those two messages and that almost finishes this one. And you see that the server also sends that. The purpose of these change cipher specs to say we're no longer sending plain text messages for the key exchange, we're now about to encrypt our messages using AES. It's like we're changing the cipher from no cipher to AES. And I think there's one last message. We'll see that, we'll guess that in a moment. Before we see the next messages, what keys do we have? Currently we know KCS, both sides. What do we use to encrypt? With AES. We're going to have a key to encrypt and another key to do a MAC. And we're going to have separate ones for both directions. Just going back to our slides. We need a key to calculate the MAC and we need a key to do encrypt and we use two different keys. And we actually have a key for sending from client to server and also a key for sending from server back to client. We have four keys there, four secrets. Two MACs, two encrypt keys. But currently we only have one. We have one secret, KCS. We need four secrets. How can I get four secrets from one? Split it into four parts? That's possible except we need the length to be long enough such that we can split into there. So we have KCS. If we wanted to split it into four parts then we'd need KCS to be four times as long as the individual parts. So that's a bit of a problem because we need a large key exchange to occur. So we can use an algorithm to generate a random number from this key. And a hash algorithm is the algorithm that we use here. What both the client and server do, they take a hash of the original key combined with some other characters which are known and we know a hash algorithm should produce random output. So we take the key as input to the hash algorithm plus another string, we get a random value as output. And then we do it again but with a slightly different input. It's hard to write down but I'll summarize the idea. What do we do? The concept is we take a hash of KCS combined with our random bytes, combined with some fixed string, let's say call it A. And that produces as an output a secret key running out of space K to encrypt from client to server. And then we do it again. We take a hash of the same KCS combined with our random bytes. Which random bytes? The ones which were exchanged between client and server. So we have two values of random bytes, one from the client, one from the server. We use them as input. And another known string, let's say B, and we get as an output another key. I'll call KESC. What we're trying to do is use this one shared secret to generate four secrets. We've got two so far. What we do is we take a hash of that original secret, some random bytes, random dot bytes are known by both client and server. They both know those values. And some fixed string, I denote A, but it's defined in the protocol, what it will be, known by both client and server. And we get some random output. A hash function produces a fixed length random output. We'll use as the encrypt key from client to server. We do it again, but with a different fixed string, I denote as B. Note the hash functions, two different inputs. We'll get two different outputs. Two different random values as outputs. When the server does this, it does exactly the same. The server will use KCS. It will use the random bytes, both the same at both sides. And it must also know the value of A. The value of A is defined in the protocol. It's known in the algorithm, so everyone knows it. So the server will generate K encrypt CS, K encrypt SC, and we'll do it again with two more times and we'll get the MAC keys. There will also be K, a key from MAC, from client to server, and also a key from MAC from server to client. The server generates those same keys. Okay? And I get all them right? What are the four keys for? E means for encrypt the data. Remember when we used the record protocol, we both calculate a MAC which takes a key and we encrypt which takes a key. So we'll say there's a MAC key and an encrypt key. K-E-C-S I'm going to use when I want to encrypt data going from client to server. K-E-S-C I'm going to use when I want to decrypt data from server to client if I'm the client. We'll have different keys for each direction. K-MAC-CS, when I calculate the MAC to send data from client to server, I'll use K-MAC-CS. And when the server sends me data, and it also has a MAC calculated, to verify that MAC, I'll use K-MAC-SC. So CS-SC is just for different directions of data communications. The values of A, B, there'll also be a C and D are defined and known up front. The server, sorry, an attacker may know A, they may know the random bytes, but they don't know K-C-S. So the attacker cannot generate the specific keys. Questions before we finish the exchange? So K-C-S is like a master key and the other four are like session keys. We can generate them again later if we want to. Or generate new ones if we want to as well. Where do we get to? We've done client key exchange, change cypher spec, finished, and change cypher spec finished. Have we seen the finished messages? Let me try and find them. Where are the finished messages? And I ran out of space. No one told me I missed one. In this message from client to server, client key exchange, change cypher spec, and this third one says encrypted, an encrypted handshake message. Let's look in what it is. Encrypted is just some random bytes. It's encrypted. I cannot see the contents because after we do the change cypher spec, we shift to using AES. So everything we send is encrypted. What do you think it is? What handshake message do you think this one is? Even though you can't see the contents, can you guess based upon the slide? It's the finished message. It's this one. We know that the client sends a finished message. It's just that it's encrypted. We can't see it in the capture. Similar, there's a finished message from server to client. So I'll draw them. But I forgot to include one in the client. This is the finished message. But it's encrypted. And there's also one in this direction. Finished. But it's encrypted. We don't actually see the contents. But we can guess. It's just a message saying, let's move on to the data now. What happens next? Here's the next message from browser to client. Let's look at the contents. Encrypted application data. My Wireshark software doesn't know what's inside. It can't decrypt it. Because it doesn't know KCS. And it cannot generate the subkeys and therefore cannot decrypt. So I just know that it's some application data. What do we think it is? You can guess. It's the HTTP get response from browser to server. What URL did I request? What page on the ICT server? It was the ICT server. We saw that. But what page? What file did I request? You don't know. You can't see. It's encrypted. So there's one aspect of confidentiality. So this is the request. We guess. And then you see in the other direction from server to browser some more encrypted data. What's in here? It's encrypted data. We can guess. It's the web page coming back. What is the contents of that web page? We don't know. It's encrypted. So this is the purpose of our SSL set up so we can securely communicate the HTTP messages. And that keeps going. Let's draw that to finish. This is the data. But it's encrypted. So anyone who intercepts this data cannot see the contents. And that was the purpose of the whole Handshake protocol at the start. So I think we got through that entire exchange. There are some other steps at the end. You can close the connection. But we're not looking at them. But we want to get how do we send the data. Any questions on this exchange? Random bytes? The random bytes were different on both sides. The client sent random bytes to the server. The server sent its own random bytes back. Both of them are used in the key generation. So we can use as many random bytes as we've got. That's okay. There's a specific algorithm designed here. I think it's not as simple as concatenate just the random bytes. What is the value of B? It's almost that simple. That is, you hash the key, the random bytes, some fixed string, and you get some key as output. But what is the fixed string? I don't have it on the slides, I think. Yup. The random bytes used in the hash function, this random bytes and this random bytes, they are the same.  Because they were sent in the clear across the network. So the attacker knows the algorithm used here. It knows how they combine this. They know the random bytes. They know the fixed string. But since they don't know the master key, they cannot work out what the generator key was. So it's about securing the master key and keeping it secret. It's actually called the pre-master key because we go through other steps by combining with the random bytes, we get a master key. Any other questions on this exchange? The KECS on both sides is the same. KECS calculated at the client must be the same as KECS here. Because when the client sends data to the server, it encrypts with KECS. And when the server receives data from the client, direction, client to server, it decrypts with KECS. The random bytes were sent across the network. Let's go back to the top. The value of the random bytes was sent from the client to the server. So the client knows that value and the server knows the value. And same with the other direction. So they are known, even though they're random, the same value is known by both sides. Is change cypher spec encrypted? No. There's just a short message saying, let's change now. So no, the next one after that was encrypted. The finish was encrypted. So the question, why do we have four keys? Why not just use the same KCS? Because everything's generated from KCS. It's the same reason for master keys and session keys. Later, we can use the same master key, KCS, but if we exchange some different random bytes, we can generate different session keys. And the concept, the security concept is change keys as often as possible because someone intercepts this data. If one of the sub keys is compromised, not the master key, but one of the sub keys is compromised, then other messages will not be compromised because we've got a different one. So that's the common principle, change keys as often as possible. And this allows that. We have five minutes left. We're going to go for another five minutes. Because there's one message, and I'll not draw anything new, there's one message we skipped over, new session ticket. Let's see what its purpose is. And I'll show you, because it's not in the slides, I'll show you a slightly different capture. And it'll be clear. This is a different capture. Very similar, but I accessed multiple pages. So I clicked on some links. So very quickly we see that we do the normal key exchange at the start. Client, hello, certificate, the key exchange, change cypher spec, encrypt the application data, request and response. And then later I accessed the web page on the same server. And although we do a hello, there's no key exchange here. In this second access to the same server, we don't need to exchange a key again. We don't need to exchange the certificate because we used from the previous exchange. So we have a cut-down handshake. How do we know to use the keys from the previous exchange? That new session ticket is the thing that is used so that when the client contacts the same server again later, in one of these messages, the client includes the session ID. So the server knows, ah, you're the client that contacted me before. Let's keep using the same keys that we used before. Let's not go through the key exchange steps again. Let's not go through the certificate verification again. Let's keep using the old ones. So that was the purpose of the new session ticket so that in subsequent accesses we can minimize the steps for doing the handshake. We can omit the key exchange steps. So it saves on performance. We access again and there's a client hello. There's no key exchange. So that's the point there. It allows them to reuse old keys from previous handshakes. The client hello message in this second access includes a session ID. And with that, the server knows, ah, you're the one who contacted me before. Let's keep using the previous values that we've agreed upon. So that's the role of the session. We've gone through the handshake operation. We've seen examples of the record protocol. We've used HTTPS as an example of SSL, but other applications can use SSL. For client authentication, we normally use passwords for websites.


Welcome to Toffy TV, it is the final word. We continue with the shows from our COVID bunkers following the COVID protocols this week. Yeah, yeah, it's good, it's good. We're here to talk about another victory and another three points. And just a classic Italian performance, Bas last night against Wolves. It was very good. I thought it was an excellent performance. I've seen a little bit of criticism in certain quarters from Sun Blues, but I thought it was a good performance. I thought it was our best footballing performance for a while, not necessarily our best attacking performance, but in terms of actually knocking up all about against the good side, I thought we did really well. We are also joined by Andy the Pave, and happy with that performance last night, mate. Yeah, overall it was a pretty good performance in general, I think. I think it wasn't perfect by any means, but you have to adapt to win things, to get further on in football, to adapt in trying situations. I think without a striker on paper it looked like a difficult game, but I think we played really well. I got no complaints. I think it was a good performance. I think we kept the ball at times a lot better than we have in recent games, so yeah, pleased with it. Of course, there was a typical pre-match meltdowns from a lot of Blues when the team came out. No striker, obviously Dominic Alvinllum wasn't involved, and Richard Alisson and Towson, obviously. The manager said they were both out, he said for different reasons, but obviously he must have meant injuries, or fatigue or whatever, and seeing Sigarton and Hamas Rodriguez playing as the two strikers. Not a lot of movement there, not a lot of guile there, and the whole team was a little bit strange to figure out, wasn't it, Baz? When you just looked at it on paper, Llywodin in there, Ben Godfrey in there, Holgate as well. It was a bit of a head scratch at first. I think we all knew Guilfee was going to play as the nine, or the false nine. I remember him playing at Leon in that role years ago, when you'd gone and you weren't happy about Mr Snidlin. In that famous game, he played up there and he'd done alright. I think I said to Andy, I mean Andy would talk him before the game, and I was like, I'm actually not that bothered that he's up there, because he's got less to do up there, which means that if you can get him in the penalty area with the ball he's quite a good finisher. Unfortunately, he didn't get into the game as much as I'd like them to, but I had no real issue with him starting there, because obviously we watched Towson at the weekend, and he was destroyed by the end of the game. He hasn't played for a while, he played two hours, and he's not very mobile anyway. It's quite clear the manager's trust Guilfee more than he trusts Towson, so I was okay. Hamers was actually excellent in the time he got on the ball, he isn't going to be in the game all the time. It's his quality when he gets on the ball, he hates teams, and Wolves in the opening half an hour, they had a real problem picking him up where he was, because he was just drifting all over the pitch, and we started the game fabulously well, and it was because of him dropping into them pockets. Hamers was all over the place, wasn't he Andy? He wasn't really playing up front, he was playing literally that position loud and somewhere like anywhere he wanted to. I mean the times he was going and taking the ball off our defenders to start the attacks, so it really helped him, it was noticeable though, obviously the lack of sigurting in the game, but certainly Hamers Rodriguez did have that licence to roll. I think that's what caused Wolves the most problems, I think, because you're not playing like a striker and we weren't doing the usual things that you'd expect the teams to do when they have a striker. It means it was harder for him to pick up, as you say, Hamers was drifting all over into the left back position to pick up the ball, the right back position, he was dropping off and a centre back's not going to really run out and chase him into them areas, then it comes out of the fact that in the field he's going to have to pick him up in them areas, which then frees up other players, so I think it helped us in times pick up, you'd be able to move the ball through the lines, and I think obviously as Bas says, we're not expecting Hamers to be like full throttle for 90 minutes, he has to pick his spots, but he's just got such quality in match winning ability when he does pick up the ball. You take that trade off of him sometimes, you have to seek him with one ball, change the game, obviously the first goal was part of that again. Yeah, yeah, but it didn't take us that long, did it? Great ball from Hamers or Degas, something we've been used to. Obviously Luca Dean playing higher up the pitch as well, a pitch that much left me a feel wasn't it, because it turned out to be basically a 4-4-2, didn't it? That could fluctuate of course, but Luca Dean playing really high up, and obviously the one of those balls that we were used to quite early on in the season, great crossfield ball, lovely knockback by Luca Dean, hitting the space in between the midfielders and the defenders, and a Wobby had made a really, really good run. Some day, I think earlier on the season we were a little bit critical of him, certainly there was a couple of times where there was opportunities for that ball early on, where a Wobby just wasn't quite on it, but luckily in this one he did really make up the ground really well, really put a sprint on it, and to get, and actually to finish that well after making that run as well was testament to him, because it was just a brilliant all round goal. It wasn't it restarted by a Wobby as well, I mean they come from Pickford, we worked the ball out meaner out, and it comes out to Alex a Wobby inside the hammers and follows his pass, which is something he doesn't always do, and I think more of our players need to follow your pass, and he's into hammers, and he's off, hammers will be sprint pass them into the space, great vision by Luca Dean, it's a brilliant finish, and because he goes back across Patricio, he can't get there. And it's 1-0 and it was a great start, and they really for the opening kind of 12-15 minutes, it was a little bit like Saturday, they couldn't get near us, and you know you're hoping that we can maybe grab a second as well, but we did look very inventive in that open quarter for an hour and then they obviously got themselves level didn't they, and that kind of swung it a little bit back in their favour, but it was a brilliant start and a brilliant goal. Yeah, as you mentioned there, after the goal, they looked like they hadn't come to terms with anything we were doing before that, like they didn't quite know where we were playing, who was playing where, who needed to pick anyone up, but after that I thought that they just kept the ball a little bit better didn't they, for the straight after the goal, they kept on working it round that box, and started moving our players round there. They knew what walls were really good, they got really technical players and no one wanted to touch them, no one wanted to make that foul because they know that they've got good enough players to put it in the back of the net from set pieces as well. So they have good movements and I think that then started causing us a few problems and there was just a little bit of pressure and unfortunately you know it comes from a corn and Tom Davis should do better. Yeah, it just couldn't quite sort his feet out, goes out for a corn and obviously we can't get it clear, the lad does the corn too easily for me really and again they've got in the box and they've got all the time and space, but even that though, even when they're with all that time and space, the fact that they had two men unmarked, we've got like if you look at it in slow motion there's like three centre backs all diving towards the ball and no one picking up any of those plays at the back post. I mean it was a good finish from their point of view, it's a good goal for me as it's a poor goal and it's just annoying when you've scored a good goal and you're away from home and you know you've been defending well that you give up a goal like that and you expect a little bit better don't you? This is what happened with Tom's back, he put it off the corner, he probably should have done better. But then the corner comes in, I think with Takori and this is something that really winds me up about modern players is just playing them ascentages. We know Outnory's left-footed, he wants to go outside and get on to his left foot, just cut that off and make him come inside. You're going to give him too much space and Outnory is really going to be really quick as well. You just put a good, as you say, there was that slow move, I think he throws me six threads and then yes, I mean it as well. It just really put it in the back of the net. It was a bit of a soft goal really because I think as you say with the first 15 minutes we were under control and then I think like you say Wolves, I think the difference between us and Wolves is when we have to change a lot we're still not back because obviously we've changed margins so much. Wolves, when new players come in, they've played the same way for the last three, four years, it's much easier to get them to play that way so they looked a bit more, a bit less disjointed at times than we did. Yeah, David, it was a poor goal because like you say Nuri, he's got that space as in the end. If Takori cuts off where he's come from, he's got to come back onto his right foot and then if he does something with his right foot, fair enough. It was a soft goal and then when it comes in, Michael Keane and Ben Goffrey should do better than neither of them do and Neves finishes it nicely to be fair but because of Neves, he was the one picking the ball up deep in the mutinio just dropping off the centre backs and get it and they do have that range of passing don't they be switching. Samido started getting up the line and Neato thought it was Wolves' best player and Neves, he was causing problems but the reality was he didn't really do anything with it, both teams were very comfortable until the last third. Wolves had a few more shots but some of the shots were 50 yards over the back. They had a chance not far a lot longer after didn't they where they picked for that to get down smartly to it but apart from that they didn't really have anything and as you've just said they became a game of stalemate didn't it really, both teams until they got to the final third were just knocking it round and then one of the teams would try and play that killer ball that would get cut out and then it was the other teams go at it really wasn't it. It was just a nice game to watch, technically it was a nice game wasn't it. I think we had a decent chance didn't we I think after their goal to put it to the speed and he passed it and he crashed it into the goal. That's the story of him shooting, I'd say we expect better but as you say that final didn't there. I think that lack of a focal point is someone to push and defend his back you know whether people like Towson or not he knows how to play the role but it worked so it doesn't matter you had to buy the buy at the end of the day. I won't be the biggest Towson fan but sometimes you just need to know a player who knows the position but it worked and don't give if he didn't have a good game he occupied players that's all you need to be able to do sometimes. I think what I just said is we hit Llewcordine a few times with some fantastic but Michael Keane played too well these to Dean and he put two brilliant crosses in in the first half. Six yard box where Don would have been or even Ritio like you say even Towson one of those three would have got a cross someone and because there won't be coming a couple of times but because the first player hadn't gone to the ball it was beyond them there's not much he could do with it whereas sometimes you've got to take that run. I think it was Llewcordine again put a great ball in and Norrie sliced it over his own back and you've got a striker in there potentially at the goal so we did cause them issues down the side there's no doubt about it but Llewcordine looked at his stats before and six crosses and he didn't connect with any of them but it wasn't because his crosses weren't good enough it was because we didn't have the focal point in the middle to finish it off. Yeah it was always going to be different wasn't it so when you're playing without a striker it's always going to be different but I think what was interesting was I think loads of people would probably think well that would mean that would be a really easy night for the wall centre backs but like Andy said before if you've got intelligent players hammer's or diggers for a start no one knows you to pick up who's going to go and follow them you're passing them on but when you pass them on that means someone's got to do two jobs then. And it was the same with Guilfee Sigarton, like Guilfee Sigarton just wasn't in the game last night but it doesn't mean that he didn't have an influence on the game and don't get me wrong I'm not trying to make a thing here of saying Guilfee Sigarton was great he wasn't great because he wasn't in the game but it still confuses the opposition when nobody knows if he's doing a job where he's dropping in then the defender has to drop in and then it's up to us to utilise that space we didn't always utilise that space really well but I did think there was just little times when a Wobie could fill in those little points. And that Sigarton just again I'm not saying he did anything amazing last night but it wasn't like sometimes you have performances where players don't do anything so especially centre forward if you've got a centre forward it stays up and all he does is stay next to the centre back that's the centre backs job done for them. You're my man, you don't go anywhere where there's Guilfee Sigarton and Hamasodegers and it is more Hamasodegers I'm talking about here. They judge like 95% of his Hamasodegers but it didn't mean that someone like Connor Cody could put his slippers on and you know ringers uncle John and see if he was happy which he was at the end of the game. But so it was up to us to utilise and I just thought when we had the ball what was good was we did look like we had an element of control which isn't always the case and when you've got a team I've got four centre backs again I left back playing left midfield and no centre forwards it doesn't always work out like that but as I said a lot of people before the game there was a lot of doom and gloom bug this game but the more we went through it the more saying we had to do it. We had to get into off time and coming back from our time. The more there was the confidence that we could get that result. I was alright with the team, I was going to lie. No this was before the team but this was before the team there's been a lot of people were really fretting about this game like we were going to get battered. No no it is what it is but I'm just looking at Sigarton there he touched the ball 17 times at an 83% pass completion but the problem was only three of his touches sorry five of his touches were in the attack. That was what the problem was he completed 10 out of 11 in the middle third of the pitch no take-ons one interception that was where the issue was but he was still someone who died at a mark and because Hamers had double the amount of touches as him so Hamers was the one who was able to wrestle. People will know I'm not Sigarton's biggest fan but I think he's a decent squad player. I think he should be in the team but he'd done it last night and you know like he said that wow he was a beneficiary of that and so was Hamers Rodriguez but it enabled, it almost enabled us to play in some respects better football because we had more technical players playing in their positions if that makes sense Andy. Yeah with the centre backs I think he couldn't settle Cody. I think centre backs won't be proactive in the gun I'm going to pick up in early and when obviously because there's no one actually playing centre forwards all reactive and they have to react in and I think that's why it worked it sounds that's what the first goal was they didn't expect it would be to run that sort of diagonal run into the box. They didn't expect it. No I thought he was just going to get a nose date in this but you know now I was joking I checked in the day he finished his chance he needs to do that more he needs to get five six goals a year minimum at the end of the day if he wants to make himself a fixture in the effort and team but I think the day he grew up with a marker down I think he was alright. Yeah I'll tell you one thing that obviously is looking more and more is Carlo Ancelotti clearly has got, we've said this for a while he's got a group of players that he likes now and he doesn't really, not likes as in he does, you know that's his team forever what I mean is within the squad there's a group of players within the squad that are very much the players he wants he will only go outside that when he really needs to so the likes of you feel like the likes of Bernard and the likes of say Anthony. Gordon and the likes of Hong Kong who they outside that group. Towsons outside that group and what it's meaning is is that players like a while we now are playing more football. Guilffy Sigarton whether you like it or not. Tom Davis whether you like it or not. They're playing more football and therefore you're starting to see a more consistent performance from them week in and week out because they are playing more instead of that thing of like. Well Benadol coming or someone else will come in or someone else will come in. I think he's now he's set up his little he's got his like he's put a ring round most of the players that he wants playing. He will go outside that when he needs to but it's leading to more games or will be. I don't know what you tell me and but he's probably playing the most games consistently now than he's played at any time in his ever in Korea. It seems anyway. Yeah he started on the bounce those games he started and I think he's now I think I think Carlos started to work with him last I think last summer but the right wing thing I he's never really played there before in Korea and I think it seems to suit him all for whatever reason. I think he doesn't have to overthink things and have to come inside all the time. I think coming on we've been buzzed to discuss a lot of time the crossing most important. But as I said to bars last night he's attempting to double the amount across straight into the last one. So he has to work on it obviously that's up to him to improve. But now it is. It's the same with Tom Davis. I think people are really overreacting. A couple of moments last night. The manager hauled them off for one of them when he ran into a grad of three players with the ball. But that's good man management. You're saying basically I don't trust in you to start the game. But if you make too many mistakes you will come off and that's obviously where a click was on me. But I think I think Tom has been fine this season sound. I think people saying that he should be playing for Stockport County. I think that's a bit silly. I think I think you need to look at him. I will be as you say you said this before. When you watched him in under 23 he had slippers on and was walking around with a bike. He was that much ahead of those players. He won't boss the championship because of his physical size. But he certainly had the most players at that level. People need some slack. Don't be wrong. He probably won't start for that and go for it. No, of course he won't. He's just a quad player. But if he's your fifth in the field is that really the way his position is? I've seen. I've seen whether you take any credence from this whatsoever. But I've seen other players. No players he plays with in like the 21s. Like people like Madison and other people like that. Call them the general, they're the dictates. I've seen it last night. They're the players you play with them. Do you know what I mean? You might go out well in mate if he's had a good performance, if he's just your mate. But if the players are really good then you know they're really good. Listen I thought he was all right last night. No we're not bigging them up here by the way. I liked Tom Davis but he does still take too many chances for me. He does for that position. But people do jump on him. But just back to a woby. Alex a woby is being definitely without a shadow of a doubt in his best form by a shadow of a doubt. I just think he's done this season. He's realised I think he has to work hard or he won't be in our squad in our team. And he's really put in the grafting. Last night 88% pass completion, 40 touches of the ball completed. 60% of his take-horns, 7 ball recoveries, 17 out of 19 attack and third passes he completed. 65% inside the barrier. 100% of his tackles, 4 tackles. One of the most on the pitch by the way. Completed his clearance and committed one foul. His cross is not out of three. We've just said he needs to get better. But his chances he had the most shots from an evident player. In fact he had the most shots on the pitch and he had three, two on target and one off target. So for me excellent performance from him last night. Can he do better? Of course he can but there was one in about the, I don't know, the 18 ninth minute or something. He picked the ball up and ran the length of the pitch and he tried to get a corner where he really probably should have done. He was just held it in the corner and maybe played it off someone but he relieved the pressure when we were under a bit of pressure. It's things like that. Carrying the ball I didn't realise he was that quick with the ball because he's only now showing it. And if he does more of that, there won't be any question about whether Alex Orobi should be in Everton's team. You're already seeing a slight change on social media towards him of how good he is and he's this and he's that. So it's good that he's been able to do it. Now if we can get Tom Davis up to that level as well where he simplifies his game then people will have less of an issue with him playing as well. I will just say about Tom and I will go over quickly on Tom. Tom this season I think his decision making is slightly better as you say it's still not there. Less passes forward I think he's trying to force it less which is beneficial to Tom.  I think there's a bit of the fair start for him to put it down the byline and ram round. Yeah they started to take him out. Yeah just that's what he needs to see because I think we don't have many players like that obviously we've talked to us how much we need peace inside. We need to put the pitch in and that's where he does obviously better crossing. You want to see other things from him but yeah as long as he needs to build on this and go forward he can. You need as they maintain a build monitor. Yeah I think as I said I think I don't like saying anyone's been a man. I'm not saying Tom Davis has been amazing. I just think that the manager is now working with it. He's now sort of getting across what he wants from certain individuals. He's got a full group. Even with Andre Gomez another nice cameo last night 20 minutes reminding me of the Sheffield United game. And it's about finding where players work and who they work better with. And that was like last night against second half they come out. They didn't really. A couple of I think a good long shot that just went over. They had a couple of little... That's shot. Let's talk about that. The ability to take a crossfiel ball and flick it up and volley it in once. Absolutely fantastic. I mean pick for that to cover. I've watched it about 35 times. But to just flick it up and volley it from that ability with no much back lift. You've got to applaud that absolutely fantastic. And applaud it with a cosy. His passing down is exceptional. But that's what we do. Robert, we looked as if they did in the second half and playing on the counter attack. But with much more control and your right pad when Gomez come on. He settled us down. Davis was getting a bit where I call it dangerous territory with Tom where he starts. Have his wacky 10 minutes. He starts trying things that aren't all. Don't mean things. He's got players around him. But that's where the manager. I think the manager. Again like the Sheffields United game when you know last 20 minutes there is that chance to win a game. You've got Tom on there and you're right cos both of what you say is accurate. Tom doesn't. He's not attempting many forward passes cos that's the only thing with Tom. I think he takes up really nice positions on the pitch to receive the ball. His angles are really good. His passing range isn't really good enough. He doesn't really have a long ball. He does his sure passes and he's set a tide if you feel like it's fourth. And he's a lot more comfortable getting it and giving it back to somebody. And just keeping his ticking over in that manner. But when you've got a step up and this was exactly reminiscent to the Sheffields United game. When you Guilfee Siggins instead of the Sheffields United he took up that position. And therefore you're pushing on a little bit. You've got someone who's finding the space to go forward.  And I think that's what Andre Gomes did. He came on and rather than just sitting in front of the back four. He started taking up positions to drive us forward a little bit more. And listen it wasn't like we put loads of pressure on them. But that allowed us just to step it up just a little bit to start taking the game a little bit more to them.  And that is second assist at a time of evidence. Second assist and it's a greig ball in. And Michael Keane just puts it back where it comes from. And it's 2-1 and everyone's happy. Well we did. Just up to the corner we did a greig ball involved. And I think it's in. Yes it's taking it in. And they can't have got it in each other's way then they went out for the corner. But the ball by Gomes was absolutely fantastic. I mean he finished with 93% pass completion rate. Completed 50% of his take on two ball recoveries. And they also won two out of three tackles. 56% of his tackles as well. So he did come on and put a calm performance in. But the cross was brilliant and Michael Keane was having an absolutely brilliant season as well. A slight dip in around early December. But it's come back fantastically well with it. A brilliant header. And yet he means his face the minute it leaves Keane's head. It's fantastic because he knows it's in. His face is great but it was a great ball wasn't it Randy? Well Ron is wrong foot as well. I thought it was great. And I think Gomes, I'm not his biggest fan. I think Chris Gloverham. He seems to be able to find a little bit maybe because the game slows down. Little displays that we've talked about with Guilfee before. I think maybe when he starts he seems to go through the motions a lot. When he's the guy that's coming to drive us on. That's fine everyone has to find the role. I think I just wanted to come back to something quickly before we do anything on this. I think we're talking with Tom. I think we're talking about players trying to maintain level. We've seen it with the manager. I think until you earn the trust you're on the short leash. I'll use the woobies example. How many times did a woobie get brought off for half time by Carl when he started? He wasn't doing it. He's not coming off any more. I think that's what Tom Davies has got to get to. He's got to get the manager's trust until he stops making mistakes. But don't you think though? I know what you're saying but don't you think though in a game like that last night? That's just good management anyway. The lad's played 70 minutes. He's done his job. No one's saying Tom's going to pick up the ball and start. At times he thinks he should be running through the team and dribble and pass them. But no one's...  Baz is absolutely right what he said before at times. He can't see the excitement getting to his head when he wants to do a little bit more. And it's when he calms himself down and just does the basic stuff like he didn't get Sheffields United. And I don't see that him coming off last night as he's had a bad game. I just see that as he's done his job and it's now someone else's chance to come on and complete it by just being a little bit more proactive. Given the team something that Tom can't give it. But Tom hasn't... Tom's job wasn't to give it if you know what I mean for the first 70 minutes. Seventy minutes. Exactly. See this is what I patted Moise on the back for this against us against Westam. Cos that's what he did against us when they beat us. In the last half an hour he made those three changes and they were all very deliberate.  Can you cope with this change? That's what all good managers do. It's a bit ritualising and all that. Ritialising didn't really touch the ball last night until the last seconds. He was a different threat immediately. You could see that. I mean Andy laughingly text me with Ritialising took me down to take the ball off the ball cos he brought him on at the corner didn't he? He brought him on for the Sheffields and immediately he was in there so it's like oh we've got a different thing now and it was the ritualising threat. But it was then going oh I'm going it's a different threat. The same way we did against Westam like you said. They brought Tony on and he didn't really do anything. They had one-one where he'd done the greatest air kick I've ever seen and claimed the penalty. But it's that always another threat. I think whenever we move forward and we get better players we'll be able to do this regularly. Cos this is just due to us how many times others haven't gone against City. Oh great, we've kept the great air out quite for an hour and there's Gabriel because he's so bite-based. He's never scorned against us yet. Exactly, we've been united the other week. We've kept our greatest rash for the martial marbles. Where it's evident at the moment no-one's terrified when spray-on warms up Addy. Let's be honest no-one's looking going oh my, you know air comes souring or air comes some gilfy sigids and maybe so. It was that, but I think, I mean you know the Wolvesman is here. He loves a small squad and this is what's undone them this season. The fact that listen he's lost his two main goal getters last season in Jotet and Jiminez. They've gone. Cos Jiminez obviously injured and Jotet has left the club. But he's having to use more players there. He only likes 14 players, 15 players and clops the same at Liverpool. He only likes. He got lads he'll use like Shaquari will come in every now and again. But he's got a trust of a certain amount of players. You know that's why Liverpool aren't fluid this season. He's got to use a few more players. The kind of problems we get every year. So it is a case of establishing you 14 who you trust. The better your squad becomes you can extend that then. But that's where we're up to now. We've got a big squad but he's only really got probably 14 players he really trusts. Cos the more quality as well the less you have to. The less you have to do what he's sort of done with a wobby and what he might be with Tom Davis and other players. Because you get the hammer so he gets effect way. Good players just come on and come in and know the job straight away. And you don't need to worry about them D-Ways. Say like what Andy's saying with a wobby. I'm not saying a wobby is not a good player. It's almost like he's had to coax it. Carlos had to almost be a little bit nastier times taking him off at half time. And he's doing the same with Anthony Gordon as well. Where to take listen. I know what you want to do but if you don't listen to me. You're never going to get where if you listen to me. And it's sometimes that can be a really tough education for players and some players. You sink or swim don't you with that education. Anthony Gordon let's say O Bernard or whatever. I haven't could continue. I'm not saying Bernard doesn't do that because I think a lot that just comes down to physicality. But if Anthony Gordon listens to Carlos until he's got a good career out of him. If he doesn't listen to him he'll end up a championship player. It's as simple as that. And I think that's for everyone you look at. You look at Ben Godfrey. Ben Godfrey is absolutely talking on board. Mason Hallgate at right back is taking it on board. It's sticking. You can see it's sticking. All the players you're playing well are clearly listening to what the manager wants from them. Probably say the same about Jordan Pickford as well. I spoke to Jack at Torch nor at Spen. And I said to him oh Godfrey could play centre mid because I know he's played defensive midfield. And he's won all that.  The back he doesn't want to play anywhere else. And now you're listening to him. He's like I'll play anywhere this fella tells me to as long as I play forever and I don't care because he's great. It's the trust. You're looking and going dang you'll find no disrespect. Or Carlo Antelos. Do you know what I mean? You're right. You're absolutely right. Andy will back me up with this. He's played a totally different style of Arsenal. You're having six runners from everywhere. And you're getting any game time. And it's the play you take it on board. As you want to go out. I want to do well in this team because this team actually looks like it might go somewhere. And for me to be able to evolve. And if it doesn't, you've seen it with Moise Keane. One to the work is soft off and get better and better. The other one Moise Keane isn't a good player at all. Is that attitude or is the main is a little bit different than what Dominic Calvalundas. Andy. I'm just back with Keane. Probably suit playing for a big side in that sense because he came for your vent system. You don't have to put the hard way. I agree with everything you said there. I think it is. If you want to play in this side, you have to meet the managers. As people mentioned before. Technical. Work. He raised the level. If you said everyone wants to try and compete with him. The body fath down to be the fastest. Table tennis. Beans and all. You've got it. I think you can see that the players all really get on with each other. And a good group. I think that those levels. I think Carlo's done. Once you have more players, then players laugh. If you want to stay in the squad or move on. That's just what it outwegs. Pets has made a brilliant point there.  He came back and that was a different thing. He came to the Premier League last night and he had 20 minutes against West Ham. But he looked at him last night. He got a very good shot. He's just got that ability as he's got it. He looked a little bit sharper again last night. And he's got the ability to just pick a ball up and thread a ball through or switch the play and take the game out. How many times have you changed the play module last night to come through? And it was the other side of the pitch. When it wasn't even on sometimes. And that pass you look and go, where's that going? Perfect to someone's foot. I think when you've got that quality, you can just drop in to a team. It's why really, it's why Bruno Fernandez has been fantastic for you tonight. He was able to just drop in to that team and carry on. He does everything because he's your beddie ball player. Shall we just go on to the 7th with Richard Charleston? I think I've seen a couple of people said Richard Charleston was the best. No, he was never fit, was he? If he'd started, he would have gone by. What he was was exactly what you just said, Baz. He was that player for them to look over and go, oh, they've got him on the bench. So if we get through 80 minutes, we've still got Richard Charleston. He's on the bench. And then he did come on and you're exactly right. He didn't do much. He bought us a couple of files.  He'd probably been fit with the cat that offered me the 3-1. But here's that thing of, oh, look, he's on the bench. And it is sometimes you've got to have those little, you know, devious little tactics as well, haven't you? You know what I mean? We've seen ourselves when we've gone into like Mesa and Barbies and seen people on the bench that was... Van Dyche will be on the bench for them. He'll have one leg, but he'll just have three. He'll just have three, if that's what you're talking about. All of the likes to say when people are not fit. Like Hermes was, you know, over Christmas, he was missing a nap. Suddenly he was ready to play for the game and no one expected him. Two weeks, two weeks, two weeks, two weeks. Yeah, he told me. But you know, it's just one of those things. If people have a little information disinformation. Exactly. Why tell anybody when someone's fit? All it does is an advantage to the opposition. Well, yeah, that's the example. In American football, Bill Belichick is the coach of the New England Patriots. List of top Barbies. Ears. It's just disinformation. It's just to put people off guilt. No. No, listen, it was a good professional performance. It wasn't amazing. It wasn't a fluid, you know. This is the real effort. That's what we saw in the first month of the season. It's definitely not the real effort. That's the one, that's the effort and we have to try and get back to being. But I said, this is like the real effort. Wakeman, go on. Let me just say, hang on. Yeah, I'm listening. No, Alan. I'm as young as Oliver Lewis. Charlotte, listen. You know, James, whether we think he shall play on listening to that team at the start of the season is just more attacking. I'm not making it.  Attack on the... Don't get me wrong. I'm not going to kid anyone. The way we attacked, we didn't overplay. We didn't take risks. But up until the final third, I thought it was our best performance. Just before we go on to anything else. Whose heart was in them all? Andy, you know by the group, I was like... No, because it's seen it before. It's seen it two years ago. Yeah, in the 2-2. So, it never has. He scores one free kick in everyone's history. It's a bat. But everyone says that, but it's always against us. I know he did, but it's a free kick. That's because you're what you have, and we don't score them. Hold on. A million pound for some. That's by the by anyway, move them on. Well, what, Nickly Andy? I don't know. I don't play through the third quite well, as you see. The second, it won't be in the hammers. I think they're... in Guilford-Pitts-Stanford's OK as well. At the end of the day, I don't keep the mask off the athletic didn't he wear? I don't wear number of charts. You can see that at times. I wear it because... Don't be wrong, good. Don't be wrong. I wear it every time I was in a musical way, but he went... You could play... A movement. So, it wasn't... I think he just... Ffais everywhere. I was going to say that, that was the only disappointing part of the game. He got the yellow card. What was annoying about that was, a dyma ni'n fawr ifanc beth oedd y shais yn un pwysig fel yw'r ffordd a hynny o'r llyfr yn ymgyrch. Dwi'n cael sgwr ffordd y rhai. Mae'r diolch yn cwrdd i'n ddechrau. A ydych chi'n meddwl'i adŵr ynddo a wneud bod sgwrdd yn bŵr y pethau yng Nghymru â roi. A hefyd, ydych chi'n meddwl yn gweithio'n modd, a nad yna yw'n meddwl. Ydwch chi'n meddwl i'r rhai gan Defnydol, ac mae'n arwinydd wedi fwy o'u gwalech, So, mwy i ddoch ran, hynny, 50 i'r ardd, a hynny, nid neto, yn rhan o gweld y Rest. Ie, rydw i'n stwyp o un o'r ddweud yna, i ddim yn y troch yn fanant i un o'r ddweud. Ffant i un o'n eistedd o'r ddweud i gyrddol, i ddim yn y troch yn dweud i ddweud i ddweud i ddweud i ddweud. Ond mae cwc, ond, yn rhan o'r ddweud, but yw'r gwerth, a'r dweud i'n dweud i'n dweud i ddweud i'n dweud eu ddweud. Mae'n dda wedi cael bod ar arwai yn y casfod y ballo, a mae'n ddifไม dwy pan rydprosion. Mae'n ddif i'r dda i ni, wrth gwrs, sydd yn ddif yn y casfod arwain. Mae'n ddif i'n ddif i ni. Wrth gwrs, mae dda wedi dweud bod iawn i'n ddif yn y casfod. Wrth gwrs, ar dwi'n ddu, mae'n ddif yn y casfod ar draws. Let's be honest, yeah he mean it. Clears him out. He elbowed him in the face. And I honestly thought that one. Oh he didn't. He took him out, I thought that was a penalty. I honestly thought that was a penalty. What's the look on the player? That's right. I'll be honest, the first time I looked at it it was, what's that? I didn't want to check this but when I watched it again he jumped for the ball and he didn't see the player. Have we talked on it? Yeah he catches him, he definitely catches him. I love it. I thought it was half. Knock it off for us. The ball will be given. He's running, does everything right. If he runs it with his right foot, he can bang it. Nobody wanted to come inside. Nobody wanted to come inside. He didn't have that. He usually has. It was a great win. It was a great win. Against the side, these three fixtures, if they all happen, these are three teams that you would think would be in and around us four going for let's say sixth place. Again, really important to get the three points, build that space between them. It will be exactly the same against Lester even though we're looking up and trying to catch them. Obviously it would be even more important if we could get three points against Lester because we're trying to catch them. That could be the difference in closing the gap to them. To take us to half, but to get over halfway, to play less than half the games and to get more than 30 points is huge. But also to get to this stage of the season and have 19 points from away games. When at this stage of the season last year we only had 18 points from the entire get all the games. That tells you the difference from experience away from home, I think. I think Carl understands how moving away you have to adapt slightly. You're a bit smarter about things, don't you? I think that's obviously a bit more quality on the pitch. Doesn't it either, does it? No. You've got to have the ability to go listen. We're going to go and close it down here. We're going to go here and do the dirty work. We're going to defend and try and nick it. We all said at times that insight to the next you know how many times of me and you said Andy, if you get organ, pay as well to three of us. If you get organised in this division, day 10 immediately you add a little bit of quality. That's six. Day six. Organised, that's six. And we've done it. But you decided that is which is how many times before this season do we get to the last 10 minutes of a game we're winning 2-1 or 1-0 and the panic just sets in and yet all these games recently that we've won by 1-0 some have been a bit more than others but last night no panic, no making stupid decisions no just hooping it down the pitch because there's a few times when you'd like to have done a little bit better you mentioned the charlison there he's only got one thing if you do that then run to the corner while we're the same making slightly better decisions but apart from that one corner which only really come from lewcadine just blocking a cross or whoever it was, shaming's calling sorry we're not in any real danger set pieces we're dealing with pretty well we're calming ourselves the players look calm they're not making as many rash decisions they still make the odd rash decision of course do but they're not making you feel a lot calmer I know when the board went off for 5 minutes last night I shamed he wasn't panicking at all for number one I knew where the 5 minutes had come from I knew where the 5 minutes had come from therefore it should have actually been 10 minutes by the Lord of Everton but we were calming that's another factor of getting these wins there's no panic at the moment which is really really important I just want to mention it's nice not to be doing my wrong but what he's doing and this is what we need to be is just be a league average goalkeeper I know he's still taking a couple of little not cost us any more and I think if he does that we're going to win more we're not going to lose goals and then the day we know he's got his limited applause but as long as he can hide it's a tiny plus no no it's a plus and that comes from the manager again bringing in a back up goalkeeper to push him and dropping him in for the odd game to say oh you better be on your toes son because this is a dislike to come in at any moment and take your place because he hasn't done anything wrong it's very new castle game it comes in real new castle game that'll be the... another day it's cut out in players no players comfortable sorry no players to be comfortable in a team and to improve you should always look and go I could be on this team if I don't do the business the very least that makes you do is eye focus and if you start thinking I'm the only keeper we've got or I'm the only striker we've got it's why I think we need one not that I think Dominic Halver-Lewin but I don't think anybody can guarantee the game in any because I think that's the way to continue your position you'll obviously love yeah you'll get that but I don't think it's hell then you know a player draws and goes it's one of the reasons why I always thought Lukaku could have been even but he knew listen it's not he had me ass when he talked about it Tony another Lukaku what I mean is if you've got someone who can job take you out at any time get the better and I think that applies to any player we've got if you go we'll leave him for me to take him out because I don't think it does sometimes they always go back to the start a while ago what was the 99-99 team that played the most the usual manurais team actually they only played together three times teams are always in that let's just look at the stats 13 shots for Wolves 4 shots on target big chances 1 each completed passes 509-44 possession 53% 47% pretty even game but we won so that's sad that's all that matters in this one also Michael Keane let's have a little look at his numbers touches 90 pass accuracy 96% interceptions 2 tackles 1 out of 1 blocks 2 clearances 8 out of 8 passes 4 out of 4 and he just was goals as well he was man of the match clearly wasn't he easily man of the match yeah I think I you know I've been still got me we still use it about defending I think getting my pass that best partnership goes with them doing the same just with continue that obviously eventually like Godfrey or even Holguys in there boom Michael Keane's that's yeah I think meanest numbers are very good you know and I thought to be honest I thought all of that was excellent I thought Godfrey was fantastic but those two as a partnership considering what people have shed fair of them and when you look at your goal it could be better with leg I mean I mean a finish with a 97% pass completion 79% of the ball and one ball 6 out of 6 clearances 4 out of 1 bolt of his area very good again you know he meanest numbers defenders in terms of area and defenders and that's all we can ask yeah I was going to say you know the real obviously had a lot more but actually this was no 0.06% who was taking a lot of chance for miles out which made the trouble of the keeper so you take that that was a good defensive effort the answers there you go no a fine victory that has moved us into the top 4 for the time being obviously before we record Man City and talking to my plane tonight they could both go above us but so what we've got the points it doesn't really matter does it a little work out in the end 80 the season it's about adding points that's it it's nice it's great to look at the joint further or whatever but just about racking the points up you know with the fact is you know we've got 32 points on 17 games just below two points again and now if everything kept going we're in the league or you know be there or there about so you know it's been a great FA Cup 4th round in the top 4 got knocked out in the quarter final of the Caravoc Cup and it feels like it hasn't been a great season but realistically it's been a get through better than any of your thoughts progress that's all we can ask for progress so make sure to comment on anything we spoke about everything we spoke about things that we haven't spoken about whatever you want just you will anyway and there will also be people who spam us telling us they love us which is also very strange only on certain minutes though I know that minutes only 34 seconds I love you I love you only in that bit why can't you love us all the time and if you do love us all the time you want more time to love us in join patron it's amazing see the way I did that water segue join us on patron there will be a link up below here that you can click on right now to join us on patron it's amazing daily live shows me and Baz will be doing one in an hour where we will just be having great times there you go give this video a like subscribe if you haven't as well thanks for watching see you later bye


Sea buckthorn pomas powder has been shown to have beneficial effects when added to bread. This powder can be used to increase the nutrition value, antioxidants, and polyphenols of the bread, while also improving its texture and taste. This article was authored by Ioana Stanzio, Elena Lore Dona Ungurianu, Elisa Beta Elena Popa, and others.