Guitar and Excel, open chords, C major scale, D minor, two chord, fingering. Get ready because although it's not fun to either fret or B board, it is fun when you put them both together, giving you the fretboard. Because the fretboard gives you something to play with, which eliminates the boredom and distracts you from the stuff that you were fretting about. So let's do it. Here we are in Excel. If you don't have access to this workbook, that's okay because we basically built this from a blank worksheet, but we started in a prior presentation. So if you want to build this from a blank worksheet, you may want to begin back there. However, you don't necessarily need access to this workbook if looking at this from a music theory standpoint, because we'll simply use it as a tool to map out the fretboard, give us the scale and chords that we're focused in on. If you do have access to this workbook though, there's currently like five tabs down below. We've got four of these example tabs, an OG tab and a practice tab. The OG tab and OG orange over here representing the original worksheet we put together in a prior section. It now acting as the starting point going forward, mapping out the entire fretboard, giving us our entire musical alphabet, both in terms of letters, numbers, combining them together as well. We have a key that can be changed with this green cell, which will populate our worksheets on the right, giving us our scales that we're working on and the related chords constructed from them. We then wanted to focus on the key of C in the open position and build the chords that can be constructed in that key starting with the one chord, which is the C chord, and we have that on our first tab. So we then hit a bunch of cells, we then populated on our worksheet in frets one through three, which we are representing as the open position, the C major fingering position and the notes, which we could also see on our worksheet on the right hand side, and we analyzed this chord position. We did a similar thing for the F then, which is the four note. When I'm looking at the C major scale, we did not go to the two, but instead jumped to the four. Why? Because the one, the four and the five are going to have major chord constructions, just the way it works out. So it's useful to think of those things, the one four five together, because you'll see similarities in the construction between them. And we mapped it out on the fretboard in open position and analyzed it. We did a similar type of thing for the five chord, which is a G. And it also is a major chord construction. And now we're moving back to the minor chords. So we're going to go back to the two, which is here. This is our basically kind of completed worksheet, but we're continuing to work on this one. That's why we have the practice tab on the right side of the og tab. And that's where we are at this point in time. So now we've minimized a lot of the fretboard, we're looking at the fretboard in open position, which I'm defining as frets zero through threes. If you have the fretboard, we're talking the net up to three, we want to be able to finger within that open position. Remembering that the top string here that's represented on our worksheet is the heavy one, the string closest to the ceiling. Then we've mapped out the notes of the two chord, which is a D minor on our fretboard using these nice colors, where the one is green, the three is red, and the five is yellow. Now, what does it mean for it to be the one three five of the D minor, which is a two chord of the C major scale? Remember how we constructed these, we basically took our scale. This is the C major scale. And then on the two chord, we just started on that note. It's easy to see with a circle, which is a D over here. And then we skipped every other note from the D to the F to the A. So if I was to think about this in terms of its interval naming, you might say, Well, why don't I call this a two, three, four, five, six, rather than a one, three, five, because we're not naming it in relation to the scale that we constructed it from, we're naming it in relation to its own scale, which this happens to be a minor. How do we know it's a minor? Because the third is only three notes away, six, seven, eight, nine, instead of four, that's going to be the differentiating factor between a major and a minor. And so if I go to the OG tab over here, just to check that out, and I'm going to change my key up top to a six, which gives me the D. And then I have my D worksheet here, I'm going to go below it because this is the major worksheet D major underneath it. I have the related modes, including the minor mode. So here is the minor mode. And you can see if I took the, the one, the three, and the five. Now we've got the DFA. And if I go back over here, we have the DFA. So although we constructed this from the C major scale, and we it's the two note making it the two chord of the C major scale, we still call the positions 135 relative to the one note as if it's in its own scale. So we'll talk more about that later. But just to just to, we need to see that so we can recognize the 135 and what that means on the fretboard. So the one is going to be the root of the chord. And then the three is going to be now the minor third, instead of the major third, and then the five is going to be the fifth, which is the which is the same interval. So if we if we finger this, the most common fingering would look like this. Now this, this is going to be an open. So this is an open D notice in the key of C, that the minor chords are actually sometimes fun or more fun to play because you have these open notes with relation to the minors. So so here we have the open D. And for example, when we get to an E, you'll notice the open E is up top. And when we get to an A, you'll have this kind of open A up top. So it's actually the guitar is actually kind of nice to play in the minor position when you're looking at the C. And most of the time people think about the the mode of the minor mode or Aeolian playing in a minor, right, you play all the same notes in a minor. But you can also think about it as playing it with D being the root, which means you'd be playing a Dorian type of mode, which we'll talk about in a second. But the point is, you've got this open string, which is nice. So that now this is a classic open position. Not only because it's in the open notes here, but also because you're utilizing an open string and that open string is the lowest string that that is in the the fingering that you're that you're fingering. Now, some people would also say, Well, it's not it's not the coolest open position, because if you want this to be your lowest note, you're not really utilizing the top two strings, although you could put them in play, because you'll note that you can use this A and you can use this F. But oftentimes, you're going to want this string to ring out here. And then you're going to be fingering this string with your middle finger, and then this this D with your ring finger, and then this one with your pointer. So usually when you want to practice this, it's a little bit, it's a little bit tricky to get your fingering down for a while. I think it's easier to to practice by starting with your pointer, and then putting your middle and then your ring. So pointer, middle ring, pointer, middle ring, and you could just do that while you're watching TV or something. That's how most people finger it. Now some people like to use their pinky here. It's kind of comfortable to use the pinky here. But and there's pros and cons to it because if you use your pinky here, you have that you have your those fingers open to do something with and it's natural to put your finger right there. And so you have some flexibility to do that. If however you play it this way, then you can play it, you can put your finger down here, your pinky down here. And so it's kind of nice to be able to switch between either position. But this is probably the most used position. And then when you're ringing this out, you want this string to ring out. So that string needs to ring out. And then everything else is going to ring out. Now if you happen to hit this A, it's not a big deal, right? Because I'm because that A is still the fifth. But it will no longer be the lowest note.  You don't have to have the lowest note in order to make it the chord. But if you ring this one out, you're pulling in a fifth. Let's make this one yellow. So oftentimes, you don't want to ring that out. So one way you can not ring it out is you can use your finger over the top, your thumb, and that'll mute here. And you can usually get it down to mute to here as well, depending how how big your hand is, right? So that means if you're strumming like crazy, even if you're hitting both of these strings, you won't be ringing that out. If you use it a finger style, usually not as big of a problem because you have more control on this hand. So you have to kind of determine how you want to be muting strings. I have less control on this hand because I use the pick a lot and I'm going kind of crazy with the pick, which means I spend a lot more time trying to mute with this hand. You can also try to spend time muting with your palm, which is often useful, possibly more so with an electric type of guitar. So that's going to be the normal fingering that for this position. Note, however, you still can break this up. I could pick up just the top bit right here if I wanted to. And when I do it that way, you'll note that so if I did that, that becomes a movable shape. So you can kind of imagine putting your two fingers here and then picking that up, right? And you're going, Okay, and then I can move that up. And it becomes a movable shape. Now you'd have to mute some of these strings below, which you can mute with this finger, or you can use this finger to grab some notes down here if they're going to be fittings. But that's a useful shape to see not so much in open position, but as something that would be movable. Notice that these three notes, of course, are generally movable notes as well. So if you're playing just these three, then when we start to think about moving this shape up, you can move that up. Now it's kind of, you might say, Well, if I, if I move this shape up, what about this string? I can't, I can't move up the open string. That's one of the detriments of having this open string. But I could mute it with the, with the meat of this finger, and then I can mute these two with this finger.  We'll talk more about the movableness of them later. But just if you, just as a, as a general rule, you want to think about those kinds of things as we're learning the shapes. Now, if you were to take the entire shape moving up, notice you'd have to adjust the fingering. I could say, well, it looks like this, but if this open string needs to ring out, then I'd have to change to these three fingers and then pick up the open string like that. Right. And you could do that. And that would be great. If you were to move that shape up, it's a lot harder to play though. So, so don't feel bad or think that it's wrong to just move up this shape, because all you need are those three notes. Now also realize when you, if when you move up the shapes, you're looking at, at the string that has the root note in it usually as your focal point. And so if I'm up here, I'm looking at this string, but if I'm not using that string, here's my D right here. There's my D. So if I'm moving it up, I'm looking at that string to try to determine what I am playing. And then I'm just building the chord around it. I also note that another interesting position here that I don't think people use as much is this shape, which is a nice movable shape as well. Right. So if you had, you know, you've got your A there, the downside with this one as a D minor chord is that the D is on the bottom again, instead of instead of voicing at the at the lowest, but it's still a D. It's just it's just that the D is not the lowest string. So it's an inversion. But it's, it's another very nice, easily movable shape, which is great because now you can easily mute the top string with this finger. You can mute the bottom string either with your palm or this or this so that so it mutes off, you can put your pinky there. And you can mute this string very easily with this right. So that becomes something that you can, you can move up as well. So notice when you're playing this, we've now learned, we've learned the C, the major positions, a C that was on this tab, an F. We learned the G in multiple different ways. And now we've learned a D. So now you can see those as things that are all mapping out basically the C major position, meaning all of these blue notes and the all the colored notes here are basically being mapped out. We're just now picking them apart in those shapes. So whatever you're playing now, notice anything that your finger is touching when you're using any of those chords, the C, the F, the G, the D minor, and all the open strings are all fair game, right? There are all things that you can, that you can play with. We'll talk more about that when we get to the scales later. But, but you'll start to visualize all these open positions because they're all being built from the key of C. And then you'll start to visualize if you put them all together, then you're going to be getting this shape, right? We're just breaking this shape out. And those are all become something that's that's kind of legal for you to basically play so that you're still sounding very much like it's musically correct or in the key of C. It's not going to clash entirely if you're playing in there. Now also note that the other really neat thing about the about about these positions, the minors in particular, is that is that you have that open string. So if I look at this, if I was to just hold down these two, like this string, and and that one string, the A, what do I have here? I've got the root, and I've got the fifth, I've got the root, and I've got the fifth. So it's kind of nice just to do that. That's like an easy thing to do. And I'm muting everything else. I'm muting these two with my thumb and all I'm ringing out is that open D and then the fifth. Now you can think about that as a major or a minor, because we don't have the third involved there, which is the differentiating factor. But you're probably if you're if you're thinking about yourself in the key of C, you're thinking about that as kind of a D minor, right?  So now if I if I put my finger up top, now I'm well, what am I doing? I'm removing from this D. And I'm picking up the F, which is which is basically a major F. And you can see it's a major F, because now you have the F, and you have down one back one. And we saw that that is usually a major third away if you're thinking about the F as the root. So that's a so that is a fun little shuffle pattern to be moving back and forth between the D minor holding down this A, and then the F. It's an easy little thing to to practice with your with different strumming patterns and just rhythm stuff and hammer-ons. It's really nice to have that open position. So for example, I usually think of myself in the key, you can think of yourself starting in the key of F or the key of D. I usually think more in minors, because that's what I first learned. I think a lot of people do on the guitar because of those open strings. But so then you can do something. And you can practice the hammer. And what I'm doing here is I'm also picking up my finger here and taking it back to the G. Why? Because that's a legal position in my mind, because I'm playing notes from the key of C. So it's a kind of a fun little shuffle pattern. And it works on all of these minors, right? You can.  And you'll notice that little shuffle pattern works when you when you move it up to move it up here as well, which we'll talk about later. So where you have the A as the open string, it also works up here where you have the E is going to be the open string. So you're shuffling back and forth between the E. So so just a fun little shuffle type of thing that you can that you can play around with with those open with that open note. So I'm going to go back here and here. And you can also do that with your full position like this. So if I have this finger down here, I've got my finger on there and then here, then put it this way, boom, boom. Okay, I think I got it. Here's your normal position, right? So then you can you can move this finger up and you can replace this one with your pinky. And then you can do the same thing shuffling. It's a little bit more difficult to do though with this open finger now that your finger and this with your pinky. So so when you're just kind of messing around, it's kind of easier to put your finger here and do something like that. Now also just realize that we're in the key of C. So that means that I could work in the two chord as I'm playing something in the key of C, so that the C is the resolution. Or if I'm practicing my D minor and I don't want to switch to a whole D minor scale, I can still stay in the key of C and make the D minor my home base, which is kind of what I'm doing when I'm doing this little shuffle pattern, right? And then I end on the full D minor. Put a C in there, back to a D minor, back to a D minor. So I'm always going back to a D minor and I'm just shuffling in this other stuff, but I'm hovering around the D minor and therefore it's going to sound like that is the focal point and because all the other chords I'm playing are in the key of C, then you're basically playing the Dorian. Now remember if I was to think about that, the Dorian, here's my circle, the Dorian, I'm taking the one to the right, which is my D and I can construct a Dorian from it. So if I go to the right, I can think about it this way. Here's my Dorian construction with the D. I'm going to hide from here on over to, let's see, I want to see the circle too. I'm going to hide from here to here, right click and hide. And then I can go, okay, so let's bring this down a bit. And so now you've got your Dorian, which just starts, it's the same thing, right? So now the Dorian, it's the one, but it's still a minor, which you can see with the lower case Roman number here. And so now you've got the one, the two, and the six are going to be your minors if you think about just converting everything to be in Dorian, but you still have the minors being the D, the E, and I'm sorry, not the six and the five and the A, which is the same here, which is the D is the minor, the E, and then the A. So this is, so we can, and then you come up with the same construction D, F, A, right? D, F, A is the construction that we're playing. But I think a lot of people when you first are kind of starting this out, you're just saying, well, I'm just going to play the two chord as my root from the scale of the key of C. And then I'm just going to jam around with that as my root. C, F. Now we'll talk about like moving these things around in future presentations, but just realize just like for now, just to just to get an intro into it, notice that just like we talked about with the majors, the one, four, five are all major constructions. With the minor constructions, you've got the two, three and the six are going to be the minor construction. So you can start to say, well, what if I wanted to move this shape around, I can move it up to the three, and I can move it up to the six. And that that's where I can move them here, or I can switch my key to be in the key of D minor instead of the C major. So let's see what that would look like. So if I scroll down, let's go down to here, and I'm going to unhide some cells from D to AK, right click and unhide, and then I'm going to hide from 12 on over to our, our chords over here, right click and hide. So, so now if I looked at my, my two in my open position, so I'm looking here first, we have that same kind of construction, right? I've got my construction that looks like this. Now notice when I'm looking at it like this, you have to figure out where's the root that I'm looking at it. If I want to move this up, the root is actually this open note. So if I wanted to move this up, like I say, you'd have to say, well, I'd have to re-finger it like this, and then hold down the root, and then I'm finding where this D converts to an E, which is, is only a whole step up, right?  However, that's kind of a difficult fingering to do. And you don't always need all of the fingers down, right? So, so what I could do is I could say, look, look, I'm just going to move this bit up. I'm just going to move this bit up. And then I'm going to kind of mute these two with my finger here and mute this one. And that this way, I'm no longer thinking of that as the root, you could, but I'm going to think of where's my root, it's this one, it's my lead finger. So I have to find where this one gets up to an E, which in this case is just one whole step up, or two notes up, right? So it goes from a D, I move this whole shape up to where that's an E, and then boom. And now I'm, I'm muting this with this with this thing. So I could be gone. And that's legal within, within the C major scale, because now I'm playing an E minor. So that's your C. Now you could use your other, your other formats of, of that to move it up this way. Remember these three notes, if I played it like this, then here's my D down here. So again, if I played this position, I can move that up to here. And if I saw it as these three, like this, so now I'd be imagining that I'm holding these two down. And then like, and then this F. And then I can move that this is now my position that that's D down here. So if I, if I was to hold those two down, and move that up to an E, it would look like that, right? So I can move that position up. And you could see that right here in the blue. So the blue is my moved up position here. Here's my moved up position, my normal position, which most people would probably think of as moving up. And we have the E on the fifth, right? And then here's that position that if I was to play it this way, that you can move up. And I'm trying to follow this, I'm looking at that as my E now that I moved up. So you can kind of look at, look at the notes that you're moving up to. And you can also look at the relative space. It's going from the two to the three, which is a whole step up from a D to an E. And so so you can start to see where that relative position would be. And then we can go from the three. So if I moved it up from here to here, I can or I can go from here all the way up to on a. So if I'm looking at this position, that D, I'm looking for where's where's the A on this string? I'm going to go, okay, it's up here on the 10th<PHONE_NUMBER>0. So I can move it all the way up here. So if you were strumming around and you wanted to practice moving the positions up, those are the positions that you can basically move them up to and still be strumming around in the key of C or possibly in the D Dorian. And again, you can use the variants of these shapes, like this top shape to move it up or this shape, you can see those shapes here. And then there's your standard shape. Now, now, the other, the other way you might see this and say, well, what if I thought of this as the D minor? So remember, if I'm going from a C, I'm playing a C chord, and then I go to like a D minor, I could think about it as being constructed from the C major stuff, because those three notes are in the C scale, or I could say I want to convert entirely to the scale of the D minor. And so if you if you think about it in terms of the scale of D minor, you'd have to say, okay, the one way I can construct that is I could go to my worksheet over here. And I could say, okay, I'm going to change this to a six, which is a D, right? And I can scroll down and I can say, okay, the minor is down below. So here's my D minor. But I wanted to construct it over here in such a way that I can see the fretboard on top of each other. And therefore I needed to find the relative major. So the relative major of D minor is F. So if this is an F, I'm going to hide some cells to get to the minor or hold on a second. What did I do here? I'm going to unhide all these cells. I'm going to unhide from here to here unhide. Oh, now I hid them again, I'm going to right click and unhide. So then I have the major and next to the major, I hid some cells here. That's why from B. So I'm going to hide unhide from here, unhide. And so now I should have the minor next to it. So here's the minor. All right, so now I'm going to hide all these over to F or the 12th fret and hide all of that. And so so now just to note that if you were looking at this now in the key of D minor, then now the minor chord would be the one similar to the Dorian that we talked about. But now we're not talking Dorian. These are going to be different what's constructed from a different key, right? So different notes are in it. But if you wanted to move this around, thinking of it as the D minor, which is a quite common thing to be playing in, then you'd have a similar kind of process. You can think about the one still fits in here. So here's your your one. Here's your construction right here would still fit the same. And then when I'm moving it up, I'm looking at that D again, I'm looking at this string and I'm going to move it up till I get to the G. So the G happens on fret eight, one, two, three, four, five, six, seven, eight. I'd move that up to I'm pointing to there, right? And then when I when I move it up again, now I'm only going to that half step up. I mean, I'm sorry, one whole step up from a G to an A. And so I'm looking at that that string again, there's the G, there's the A on 10. So eight, nine, 10. And so there we have it. So if you wanted to strum around in the key of D minor, you can look at that position and start moving, moving up and back. We'll talk about the movability of this of the scales and more depth later. But I just want to point that out now just to get just to plant the seed. But I also just want to show that the chords around this and we'll talk more about this later. If I hide if I right click and hide this stuff, notice that this blue area all the stuff here is from the C major. And although this chord fits in it, we have a different construction than we have down here, right? It looks similar. But see, this is different, this top one is the same, but the second one is different, right? Because these are different sets of notes, even though both of them, this is constructed from a C major, this is constructed from a D minor, which is relative to the F major, right? You can think of everything as kind of constructed from the related majors, right? This is the mode, this is a mode of F rather than modes of the C. So so so you just want to kind of so that means that if when you move the shape up and down, you can move the shape up and down, but you want to have an idea of what key you're playing in. And then when you start to add stuff around it in, you have to start thinking, am I playing in the key of C? Or am I playing in the key of D minor to think about what other things that you can kind of embellish your playing with around it? Alright, so I'm gonna we'll talk more about that later, though, so I'm gonna unhide this and see if I can get back to where I was for the next presentation, right click, unhide. You've made an aww, now you hit it again. You've made a mess of things. Unhide that, I'm gonna hold control and scroll down a bit and I don't, I'm gonna hide this down to here, right click and hide that and then I'm gonna hide from here down to here, right click and hide that and then I'm gonna hide from here down to here, right click and hide that and then that's good and then I'm gonna unhide all of this stuff, right click, unhide and I'm gonna go back to the starting point where I'm hiding just from fret, I'm gonna hide from fret four over to our major scale over here, right click, right click and hide so that we have that lined up and I'll scroll in a bit so our worksheet is back to where it should be for next time. So next time we'll talk more about the how this fits on top of the pentatonic scale and the major scale in the key of C and contrast that to its related minor and then we'll talk about the intervals.


I'm reading from Chinese Academy of Social Sciences, thanks a lot for the excellent presentation and the discussions. My question is that for the good law cannot be implemented. Sometimes it's because of a social structure or political system existing there. Sometimes it's because of social norms. Could Mr. Basu make further clarification? Let's see what is the function of a focal point if the law would change social norms. Thank you. Thank you. Thank you very much for an excellent presentation. I have two quick questions. The first one has to do with the fact that you said picking somebody's wallet may not necessarily be due to doing some cost-benefit analysis, but social norms may have a very important role to play. I will beg to differ on that because the whole idea here is that people may be doing cost-benefit analysis, but they will be factoring in the social norm. If we can calculate the psychic cost of guilt, shame, and then add that to the monetary cost of benefit of engaging in crime, we will be able to have better figures for our cost-benefit analysis. The second point is I would like to know your view on discretionary punishment, where judges are given big windows where they can make decisions as to whether to send someone to jail for one day or 25 years. I say this because in Ghana, people believe that judges are legally corrupt. They tend to jail people who are less privileged in society, more severely than those people who are at the upper end of the social ladder. And I took some data and did some analysis and then found out that if you look at the punishment people receive when they steal, as supposing that they are prosecuted, and then you try to look at that relationship with the total amount of money that is stolen, you realize that if you steal, let's say, 1% more, the punishment you receive reduces by 0.8%. So the incentive is there for you to steal more than to steal less. So what is your view on discretionary punishment for this concept? Thank you. Can you introduce yourself when you ask before asking your question? Sure, I'm Douglas Arendt from the National Renewable Energy Laboratory. I would love to hear some comments on your perspective on sustainability and sustainable development relative to both what I would call local public goods, but also the global commons and goods and what the interface is between law, social norms, and sustainability. Samuel Wangwe from Tasaniya, thank you very much for the very excellent exposure on these issues. I wanted to raise just two points. One is have you seen the role of information communication technologies in reducing the contact between the Breiber and the Breibi to see if that has played a role in some countries? Second, any comments on political corruption? Political corruption comes to especially where there's really high level of prettiness. People say we don't want corruption. This is really bad. And there are laws to actually curb corruption. But the same people who passed the law engage in very high level of corruption politically. Now the same people who say this is really bad are the same ones who do it. But if one of them falls out of favor, then they say, ah, corruption. We said corruption is bad. Political corruption, to me it seems, brings a new dimension in the whole discussion of corruption because it's those guys who are themselves passing laws, supervising, are the ones in the forefront. And in Africa in particular, maybe in other developing countries, this seems to be a complicated dimension to deal with, especially when it comes to administering development. I'll ask you to answer this first wave of questions and then we'll take more questions afterwards. Thank you. OK, let me go in order. Sorry, yeah. Yes, I will also actually, as I speak about this, I will go to build in a little bit onto this. I'll just take a call of what you're asking. Can laws be used to change norms? And in fact, that question relates to both what a little bit of what Ernest said and what Haroon said is before you, first of all, use laws to change norms. You have to be once a bit careful that norms have very often come into existence for some reason. And there's actually some analysis which is an evolutionary analysis of norms done by economists, which endorses what Ernest was saying about the case of no fishing on Tuesdays. Some of these norms could have socially desirable effects. So the norms have come into existence because societies that had these norms have replicated and done better. So before I'm answering a pre-question to your question that before you think in terms of changing a norm, you have to think a little bit about the norm's original role. Having said that, I also believe that there are many norms which came into reason, yes, for these functional historical evolutionary reasons, but societies change, but the norm stays on. And they become dysfunctional norms in society doing a lot of damage to society, but they are still there. There you do want to bring in the law to change. Two ways of doing that, one is to directly use the law to just outlaw that kind of norms-based behavior, but the other one actually now relates to what Haroun was saying is that certain laws can begin to change your mindset, but the minimum wage law is an example. Even if it's not being implemented, it begins to change the way you think, and there is a very important contribution, this is from a lawyer, Cass Sunstein. He talks about the expressionist function of law, that law often takes the form of, not actually it's the hard law what it says you'll do and the police coming and catching you if you don't, but it changes your mindset and the way you think about a question and that gets followed through that. So that's the way to approach social norms through law. The second question over there, the cost benefit, I think we are completely on the same page, just that we are using the language a bit differently. So when I said that it's not narrow cost benefit analysis, but social norms matter, what you're saying is that it is cost benefit analysis taking into account the fact that some of the costs are normative costs. I don't want to behave in certain way which will inflict stigma on me, and I completely agree with you. On the language, I can fuss a little bit about whether we should always use the language of cost benefit analysis. I do have some hesitation on that, but when I would do an exercise like this formally, I would I think do it exactly the way your suggesting should be done, that keep it as cost benefit analysis, but enrich the notion of what constitutes cost and what constitutes benefits and the norms and the social stigma could come in, agreed. On discretionary punishment and judges, this is a huge problem that in the end, even if you don't have discretionary punishment, which side has won that verdict the judge has to give? And there's a lot of scope for a judge to be corrupt and do something in favor of the richer client rather than the poorer client. This evidence that you said, I've never seen it, but it's fascinating that if you're stealing, steal a lot, your punishment will go down. It sort of fits in with some priors that that's possible. You become a bigger player and the punishment goes down. What do you do about that? I wish I had an answer, but all I will tell you is that this simply emphasizes once again that these kinds of problems of corruption, once you bring in the police, the judge and everyone, very often it's impossible to close it through pure cost benefit rational argument. The social norms are also very, very important. People having different norms in their head and that I'm going to relate. I'll come back to this just now in a moment and take the sustainability question and I'll return to this. Again, sustainability is such a big topic that for me to jump and immediately be able to relate to what I'm talking about with that I can't do, it will take me time, but I want to stress the last part of my talk which I did not manage to go into that for a lot of sustainability matters, again the human social norms are important and that brings me back to the previous question. To try to cure these problems entirely through taxation and benefits, you typically won't succeed, you can succeed with individuals, but the judge could be corrupt. So the norms are very important. All I can tell you how you change norms, I don't know, so I won't even pretend to say I know, but I do know that norms change and that gives me hope that human norms are malleable. Example, when in the West the norms started that you don't smoke in a public place. Initially you may have actually laws that if you smoke in a public place that you get punished by that. This was soon, there was talk that India would start that law that you don't smoke in a public place. And my initial thought was that it's impossible to correct this.  The smoking norm in India changed over a 10-year period. No one lights up in a crowded room and you don't even need the law anymore. I feel a lot of our environmental behavior has to rely on human thinking changing. Trouble is we have very little understanding of what leads human thought to change. One of the reasons why we chose this year's World Development Report on this topic is precisely because of my own belief that the way we think the mental models we carry in our heads are extremely important and you cannot solve this entire problem from the petty criminal to the judge. You can't solve it all just by changing the punishments and jail terms, you won't do it. In the end, you do need to work on human norms and the first step in that is understanding and that's what we are trying to do. And finally, technology to reduce contact between briber and bribe, certainly, it's extremely important. And these very, very simple things have already began to change the landscape of a lot of corruption. One of the things that is being used in India in quite a sophisticated way is a biomarker system for identifying individuals. It's called the ADHAR program and this is being developed by some of the best software minds. Once this comes into place, again, the expectation is that for a lot of basic benefits, the human contact will be minimal. You will be recognized by your retina and your fingerprints and certain transactions will take place, money will move into your bank account by the recognition when you go and identify yourself. So that's very important. On political corruption, I have one word, one little thing I have to point out. Lot of political corruption, we have to simply understand, takes the form of barter.  A lot of it, actually, money does not even change hand. It's just you're performing barter at the top of the country. And the popular belief that barter takes place amongst the poorest people, I'll give you one fish, you give me a little bit of rice. Yes, that does take place, but barter is much more prevalent at the top, at the political level. And that's another game because it is very often money is not changing hand. So you can't catch it through conventional means. So once again, this brings me back to the first point that I was making, that a lot of this has to depend ultimately on human social norms, no guarantee. I'm not a foolish optimist to think that someday all this will get cured, maybe it won't, but at least we begin to get some handles on how we do better and move inch towards that. Let's take another round of questions. Can you introduce yourself and then we'll do it. Thank you ma'am. My name is Salawadu Mkola from Nigeria. I think it's important to also look at the origin of law. Law in itself is not devoid of corruption. We lawmaker, the multi-objectives. And we've seen situation where some laws are not comfortable to lawmakers and they make the law weaker. Just to buttress the political kind of a problem that we have. Where you've seen a government that is not sharing money, being voted out of power. In other words, there is no way we can move on without this consultation, without excessive current stakeholders along. Again, we are back to the issue of norm and social order. Because when you have predominant people, not actually want to abide by a rule or order, where do we go from there? Because it's important you can combine democracy in some cases, but of course you need democracy to be able to move forward. Thank you. Thank you very much. I'm Peter Quartey from University of Ghana. Laws do not support development. And I think I tend to side with what Provost Aite said. But then I want us to, I want your view on this point that the lawmakers themselves leave a lot of room for interpretation. Again, for their selfish interest. And that does not promote development. I want your views on this point. Thank you. Thank you. I'm Fondi Chazibana from the National Treasury in South Africa. The one interesting thing to me is why do lawmakers often write laws that they can't implement? Which brings us into the area of credibility. Because that does undermine whether a law can be effective or not. If members of the public know that there's not enough resources to implement, we find this in South Africa with regards to municipal bylaws. You have these bylaws. But because things, you're contravening the law in your own house, in your own car, the cops can't find you, and therefore, you can go about sort of your usual day to day. Your usual day to day. The second question I've got is around an acceptable period to amend the law. So acceptable periods to amend laws, to take into account the development needs. When you've got this interest, because every time you make an amendment, it depends on who the strongest interest group is at the time. So you'll always have these moving targets all the time. So you're thinking, I'm achieving the greater good. But it's always the greater good of an interest, of whoever the strongest interest is at a particular period, like reflections. Thanks. Tony? Tony Addison from UNU, Wider in Helsinki. Koshik, we have a lot of young researchers here at the conference, and they're all thirsting to write great papers. So my question to you is, what topics should they be working on that are gonna produce those great papers? Thank you. Thank you very much. I am Patricia D'Amon from Nigeria. From the discussion of Professor Basu, is get towards the masses, the individuals, you know, the citizens trying to change the social norm. What about the lawmakers themselves, the government? You see, there has been cases, for instance, in my country, where somebody will steal a mobile phone, for instance, what, $50? And another person will steal from the government, public fund, what billions of dollars? And nothing is done to that. The one that steals $50 worth of mobile phone is jailed for seven years. And the man who takes six billions of dollars is actually reformed, maybe $3 million, and he goes cost-free. So what do we do? How do we change the norm of the public, I mean, government so that everything will work together well, and then we can now develop, I mean, there will be economic development in our country, thank you. On this farm of questions. Let me actually do the following. I'll take the question, accepting Tony, all the others, let me pull in, because actually you're asking very similar question. I understand where we are coming from. This is indeed very troubling. And you see this, the most blatant cases, very often it is true. There's no getting away from that fact that you see these in poorer countries in emerging economies, the most blatant cases. But this happens, corruption at the top in subtle forms, very often not changing money, subtle forms happen even in rich countries. The lawmaker could have certain kinds of vested interest. Since there were two questions from Nigeria, I suddenly remembered years ago, I had read this very beautiful piece by a writer, I may be getting the name wrong, Adewal Majapiers in London review of books, saying how in one case he got into a trouble with someone on some matter with a local citizen and called the police. And the police made them bid for the higher bribe that between the two of them that they would pay to the police. And the higher bribe person, the other person got a punch or two from the policeman and the policeman took away the bribe and went away. This is actually the same question. In this case it's the bribe, the police who's the enforcer, but you're taking the question one level higher up from your question on democracy to lawmakers to why do people make laws which are not good for society. It is all about the lawmakers. The trouble is I wish I had an easy answer, I don't. I mean this is very painful, I've seen this happen all the time and as I'm sort of warning you, it happens in a very blatant fashion in poorer countries, emerging economies. It happens in subtle ways even in rich countries. There is a bit of a collusion at the top which plagues the world. But in the end, I'm giving you, I know it's a very lame thought that I'm bringing to the table simply because I don't have an easy thought, is we have to make these things clear. Write about these that these things are happening. Ordinary people's realization that something is wrong and should not be the case leads to changed behavior. All I know about human social norms is realizing something is bad by ordinary people helps. And some of the worst injustices in life, and you can take it across countries, discrimination, racial discrimination in the United States, apartheid in South Africa, caste practices in India, you'll get examples galore. The way these things persist over time is you lull people into believing that what's happening is normal and correct. It's when that thought breaks down you realize that this is not normal. I've been lulled into believing that this is normal, that change comes. And I'm taking all the sort of questions that you're bringing on the lawmakers is making people aware that look, don't get lulled, that the lawmakers are the ultimate authority thinking of the social good. They are very often not doing that. And that kind of social activism to me is very, very important. You have to stop people from getting lulled into believing things are right. I can give you examples galore of how most of the biggest injustices in life continue simply because the person who suffers does not realize that it's an unjust suffering. You take it to be dished out from heaven or whatever and that's why you're there. So just the awareness is welcome. And now finally, to Tony's question, topics that students should work on. There's always a bit of a tendency to think of topics which are of interest to you, meaning to me. I didn't mean Tony interests to me and suggest those topics, but I can tell you currently the sorts of things which are of a great interest to me a couple of things I can tell you and I'm going a bit beyond this lecture. And this is of interest I hopefully to wider to the World Bank and all. One mistake I feel the microeconomics, macroeconomics divide has done in the policy making field where we do need a lot of fresh thinking. Very often when you have a program which is a micro intervention to help people. So some nutrition program running in a thousand villages in South Africa or Tanzania or somewhere or an employment guarantee program running in 5,000 villages in India. Where we usually, the way we usually analyze these is you send researchers, if they are sophisticated they'll do randomization, take some places where you have this intervention, other places where you don't, you see the effect of this. If you can't randomize, you just collect data in that village and see what has happened in that village. One huge mistake happens through this and where we need a bit of innovative research. Suppose you're running a program, I don't know some intervention in a thousand or 5,000 or 10,000 villages employment intervention or something else. Let us suppose you find that it's successful in these entire 5,000 villages. People's nutrition level has improved, poverty is less. Usually we end by saying that the program has succeeded. What is forgotten is to run a program like this in an economy has macroeconomic implications. You are, the fiscal deficit could be going up. You could be generating monetary expansion while you do this. And if you keep that in mind, it's entirely possible that in these 10,000 villages, the program succeeded. People have risen out of the poverty line but in another 50,000 villages which had nothing to do with this program where the side effect of this which is in terms of prices rising that reached and nothing else reached where more people have gone into poverty. One reason why poverty eradication is so hard. We have so many programs running. I believe it's because we have this cleavage between the micro and the macro analysis means we very often forget about the side effect which takes place 2,000 miles away in another village where these people are not there but through the macroeconomic channels and effect has gone over there. I've now come away from both my India experience and now that I work in the World Bank and see a lot of these programs. We have to begin to marry better the micro, macro bridge and that is what after all a profession is just going to the village and seeing people are better off anyone can do. You don't need a hard profession for that but the strength channels through which this can transmit and go elsewhere. The profession has given us certain tools of analysis. These tools are not easy. These macroeconomic analysis across sectors is difficult but this is a very important topic in an area where you can get a lot of impact coming out of that. So this is one broad area, the micro, macro divide and I've been trying to push the World Bank to do a little bit more of that. Another area, and this is of course comes a bit from my orientation. Historically economics was, two, three minutes more I can take over this. Historically, I do believe that economics had erred on the side of excessive theory. You just did theory, very little sense of the way the world is spanning out. It's very welcome that this has changed. The amount of data we are now generating around the world is huge. A lot of understanding coming out of this. But at times I'm worried that we should not make the mistake of pushing to the other extreme and doing a data, not data-based analysis but a data-waved analysis. You collect data, wave the data and then you go and implement some policy. Data-based analysis means when from the data you're going to a policy. You actually have to think a lot of what the data says. And that's where you do need some analytical thinking. And so I'm giving, I'm not giving you specific topics that I can give you over coffee after the break. But again, bringing some analytical thought into data-based analysis is extremely important. And I see all the time people will tell you that look, last 20 years this is what happened. You went in for this intervention, this is what happened. Therefore, and very quick jump to tomorrow we should do this. To me that therefore very often is a non sequester. It has no meaning.  That therefore, that basing of the data needs much better analysis. And if the younger people there, well even the older people should try but all of us get usually set in our ways. It's very difficult to change our ways. The younger people could try to marry this as well, the data work and analytics before you jump to conclusions about what the data says in terms of policy. Thank you. Thank you very much Kershi. Thank you for the very challenging thoughts in your presentation. And we look forward to the new WDR certainly. And many thanks for your last thought about the new direction for research. Thank you also to Ernest and to Avon for their comments. And now let me conclude this session and call upon Fin who has a couple of things to tell us. Thank you very much.


NORAD's cutting-edge technology provides real-time updates on Santa's yuletide journey around the world. Our constellation of defense satellites use infrared radar to keep pinpoint accuracy on the heat signature from Rudolf's nose. Ground-based radar tracking sites relay updates to our elite fighter pilots who often escort Santa's sleigh through North American airspace. Our maritime forces in the Navy and Coast Guard make sure the seas are safe and secure beneath the flight path of the man in red. And finally, our special Santa cameras in strategic locations around the world capture images of Santa during his flight. Modern technology also allows people around the world to keep up with Santa's flight path using mobile apps, social media, and the NORAD Track Santa website. At the heart of it all, people can call or email the NORAD Track Santa Operations Center in Colorado Springs on December 24th. Volunteers are standing by to answer that all-important question, when will Santa get to my house?


Hash functions take a variable size input and produce usually a short fixed size output called the hash value. And the hash value should be random. So we saw some of those characteristics last week. Let's continue with how we use hash functions starting for authentication. We went through an example last week. But let's go back to the first example. This is using hash functions combined with symmetric key encryption. And the picture we'll do some analysis is this one. It's the same one as on the slide. The source wants to send a secret message to the destination b and also wants that message to be authenticated. So what they do is first calculate the hash of the message, combine it with the message, that is the hash value, and then encrypt the lot, that is encrypt the message concatenated with the hash. And the destination has two tasks to do. They need to decrypt. And since they have the secret key k, they can decrypt successfully and get the message. But then they need to verify the message and they use the hash to do that. They calculate the hash of the received message and compare it with the received hash value. If they match, it accepts them. Why do we need a hash value here? Why not just encrypt it? Why not just rely on symmetric key encryption to provide the authentication as well? What's the benefit of also using a hash value? More secure, not specific enough. Under what conditions is it more secure? What is more secure? But more generally, why not just use symmetric key encryption? Remember with symmetric key encryption, we said if the message successfully decrypts with the correct key, it implies that the correct person sent and it implies that the message hasn't been modified. So why incorporate a hash? Well, in fact, symmetric key encryption doesn't always work like that. That is, for symmetric key encryption to be used for authentication, remember that the message that we decrypt or the message that we obtain when we decrypt must be recognizable. For example, an English message or some structured message that we know this is the correct plain text. If we can do that, we don't need a hash value here. But in some messages and in general, we cannot always decrypt and get a message that the receiver B will know is correct or not. For example, if the message is a random secret key, when B decrypts and gets that random sequence of bits, how does it know whether it's the correct or incorrect value? And that's why a hash value is of value here. It's of importance. Using the hash inside the encryption allows B to be sure or with very high probability that the message hasn't been modified and it came from A. So let's consider what the attacker can do. So the way to understand these schemes is to consider, what if an attacker changed something? Will the authentication be successful or not? So we can think that what's sent from A to B is the message concatenated with a hash of that message encrypted with the key K. We'll just write that again and see what the malicious user can do to try and change something. That's what A sends to B here. Let's say our malicious user intercepts and makes some changes and then sends the modified message onto B. We're trying to see why this scheme works. What can you do as a malicious user? What would you try to do to try and fool B into thinking the message is correct? Can you see the message? Why can't you see the message? It's encrypted with the key K. And as the malicious user, we don't have the key K, so we have confidentiality in this case. So what can we do as the malicious user? What can we try to do? All right, try to find the key. We know under our assumptions that the key is long enough, we can't find the key, so we can't do that. What if we change the message? So this is a sequence of bits. Let's say the length is 1,000 bits and it looks random because when it's encrypted, the output of the encryption should be a random sequence of bits. Let's say the malicious just sends something else, something other than the message. What they send is they can create a completely different message and encrypt with their own key. They must use a different key in this case because they don't have the key shared between A and B. And let's say they create a different message, hash m' and calculate the hash of that message and send to B. What does B do? They try to decrypt. Does it work? How do you know it doesn't work? But that's the important point. Now let's assume we don't know whether the decryption works or not. Let's say we decrypt. So we perform the decryption of B and it's gonna get a bit long. Decrypt using K of everything that we received. Enough brackets, one more. That's what B does, they decrypt first. What's the output of that decryption? Something was encrypted with K of the malicious user and decrypt with a different key. What do we get as output? Random bits in this case. We don't get m' concatenate with hash of m' because it's using a different key. But we don't know that yet. B doesn't know whether it's the wrong key because it could be that the random bits that we get out are the correct bits. The point is that B may not know in this case. So they decrypt and they get some output. Let's say it returns some value m double prime. We don't know what it is yet. Concatenate it with a hash value, or write as lowercase h. It's called a triple prime. We'll see why I use different notation in a moment because now what we do, what does B do to verify? They decrypt it. They get the output, some sequence of bits which they think may be the message and some sequence of bits at the end which they think may be the hash value, the received hash value. Now they calculate the hash of the received message and compare it with the received hash value. So that's what they get after decryption and now we do the calculation. The hash of the received message, m double prime, does that equal? So we compare with the received hash value. Again, B decrypts, gets some message, some hash value, calculates the hash of the received message, compares the two hash values. Under what conditions are they the same? Or are they the same in this case? Does the hash of m double prime equal the received hash here? Hash triple prime. Well, it comes back to, well, what is this hash value? Hash triple prime. Well, because we decrypted with the wrong key, these bits here, m double prime, hash triple prime are random bits. There's no relationship between them. When we decrypt with the wrong key, even though we don't yet know that, we get a random sequence of bits. So it'd be very, very unlucky if this sequence of bits here in hash triple prime turned out to be the actual hash of m double prime. So they shouldn't be the same. That is, when we compare them, they will not be the same. This will not be the hash value of the message because the message is random and the hash value is random. It wasn't calculated. So they would not be the same and therefore b would detect an error. So the reason we use the hash value here instead of just encryption is that when we decrypted, maybe we weren't sure whether this was correct or not. If the message was an English phrase or sentence or paragraph, then for sure at this step we'd know there's something wrong. But if the message was a secret key, and we decrypt and we get some bits, we don't know if it's correct or not. So that's why we do the comparison of the hash values and that should give us very high probability that it is incorrect in this case. And we'll look at those probabilities later when we look at the analysis of cryptographic hash functions. So we can use hash values with secret key encryption. Can the malicious user pretend to be A? Why can't they? They don't have the key. They wouldn't in the same way here. They would not be able to generate, even if they encrypt something with the wrong keys, they would not be able to generate a value such that when we decrypt, the hash of this part will match this part. Because when we decrypt with the wrong key, these will be random bits. So this scheme is considered secure for confidentiality and source authentication and data authentication, data integrity. Any questions before we move on to scheme two, the next scheme? Right, the malicious user will not be able to generate the hash value because they cannot, well in this case, they can generate a hash value. They don't know the message so they cannot generate the same message because that's encrypted. So all they can try to do is generate some say, say new message and they can calculate the hash of that. But once that's decrypted, we won't get the original input when we decrypt. We'll get some other random values. And because they're random, the hash of the message part will not match the received hash value. So in this case, it's because of the decryption doesn't work and the hash value is just a confirmation that the decryption does not work. This is encrypt the message with the hash code using symmetric key encryption. I think the next one, the next one is a slight variation. Instead of encrypting the entire message, encrypt just the hash value. Let's try that. Here we take the message, calculate the hash of the message, encrypt that with a shared secret key between A and B, send the message plus the encrypted hash to B and B verifies. The message is sent in the plain, in plain text, in the clear meaning this is not providing confidentiality. Someone can see the message, but it should provide authentication. Again, let's consider what the attacker can do. What does A send? They send, we can denote it as M concatenated with encrypt, secret key K, and let's be more specific, KAB of hash of M. Although our picture here doesn't say KAB, we know it's shared between A and B. Militious user intercepts, let's see what they can do and try and send it to B. So the message is in the clear, so the malicious user knows the contents of the message in this case. What can they try and do? The first thing, try and change the message, see what happens. Let's say we change it to M prime, but we keep the encrypted hash value the same, we don't change those bits. Note that we don't, as the malicious user, we don't have to encrypt here, all we do is let's say the message is 1,000 bits and the encrypted hash value is 100 bits. So we have a total of 1,100 bits, all we do is the malicious user change the first 1,000 bits to our message of choice and just keep the last 100 bits the same. So we can do that quite easily, just copy and paste those bits and just change the message. Now B verifies, so look at the steps that B takes to try and check, has anything changed and did this come from A? B decrypts the hash value, that's the second part, they decrypt this part, and I forgot the key, decrypt using key KAB of the second part, what comes out? No primes here, what comes out? We start with the hash of M, it was encrypted with KAB and now decrypted with KAB, so the hash of M should come out. So we'll denote that this is the hash of M, now we compare the hash of M with the hash of the received message, M prime. Do they match? Where I use prime to denote a different message, M prime is different than M. Does the hash of M equal the hash of M prime? Our rules or our conditions of our cryptographic hash function are that the hash of two different messages will produce two different outputs. So the hash of M will not equal the hash of M prime and that's how B knows that there's an error here. Any questions so far on our use of an encrypted hash value as opposed to the entire message being encrypted? Okay, sure. All right, any questions at the back? So the point in this case is our error will be detected by B because of the properties of the hash function, the hash of two different messages gives two different outputs. So when the message was modified by the malicious user but not the encrypted hash value, when we verify at B, we compare the hash of the original message with the hash of the modified message, two different messages, two different hash values, so they're not equal and B recognizes there's an error. What could our malicious user try instead? Can they try something else to try and fool B into thinking that the message received is correct? If you modify the message, you must modify the hash value, okay? Otherwise B is going to easily detect. So there's an important point. If the malicious user changes the message, under most conditions, they must also then change the hash value. I say most conditions because in some special cases, if there may be two messages which when the hash produced the same output, that's called a hash collision. But we're assuming it's not possible at this stage. How can they change the hash value? What do they do if they wanna change the message as well? M' encrypt what? The hash of M' with what key? We can't use KAB, that's the point. So yes, we can change the hash value but we must encrypt that and it should be encrypted with a key shared between A and B. So what we're going to do at B now to verify, we can do it, we'll decrypt with KAB. We think the message comes from A. We decrypt the second part and we get some output. Let's denote it as H decrypted, D. Doesn't matter, just to denote it's some value. The decrypted value and we compare that value with the hash of the received message. Are they the same? If not, why not? Here in the encryption and decryption process, we have the hash of the message, the modified message in this case. It was encrypted with the key of the malicious user but we decrypted that using the key shared between A and B. So we'll get a different output. We will not get hash of M' as output. If we encrypt the hash of M' with one key and decrypt it with another key, the original plain text will not come out. If we encrypt and decrypt with the correct key, the original plain text will come out but if it's the incorrect key, we'll get a different output. So the output, HD in this case, will not be the same as H, the hash of M'. So again, B will detect that. They're not the same. And B knows there's an error. In all of these cases, the B doesn't necessarily know what was the change. They don't know whether the malicious user changed the message or changed both the message and the hash value, used a different key. All they know that something went wrong. But that's sufficient for authentication because B now says don't trust this message. It's not authentic. So I hope you're starting to see some of the same things happening that is for authentication to work, we have a few conditions or assumptions we're relying on. In this case, and it's coming back to symmetric key encryption, decrypting with the wrong key produces a different output than the original plain text. That's what happens here. Plain text is hash of M'. Encrypt with one key, decrypt with a different key, the output will not be the hash of M'. And as a result, HD will not equal to the hash of M'. And in the previous case, it was relying on the fact that the hash of two messages will not be the same. Hashed two different messages, you will not get the same hash value as output. If that's true, then the authentication works. That is, we can check whether the message is authentic or not. Anything else you want to do as a malicious user? You can't modify the message without modifying the hash value, but in this case, if you try to modify the hash value, you don't have the key to encrypt it correctly so that it will be successfully decrypted. Similar, if the malicious user wants to send a fake message saying this is from A, so A doesn't even send a message, the malicious user will not be able to encrypt it with the right key. They will not have KAB to encrypt it, therefore B will detect this message is not from A. Compare these schemes, A and B. They both provide authentication. The first one also provides confidentiality. The message was encrypted. Scheme B does not provide confidentiality of the message. Scheme B can be useful when we don't care about confidentiality of the message. We care just about authentication. Not encrypting the entire message can be much faster than just encrypting the hash value. If your message is one gigabyte, then in the previous scheme, encrypting that one gigabyte takes some time. In this case, we just calculate the hash of that one gigabyte and encrypt that small hash value, say 256 bits, which is much, much faster than encrypting a gigabyte. So avoiding encryption of large inputs where possible saves in performance. This scheme we went through last week. This was the one we covered last week where, again, there's no confidentiality. Everyone can see the message, but it provides authentication in a different way in that A and B have a shared secret S. So it's the same as a key shared between A and B, but it's not used for encryption in this case. It's sent inside or combined with a message and hashed. And the hash value is sent with the message and the verification compares. And we saw last week in this scheme that modifications by the attacker will be detected by B. The fourth scheme combines the third one with encryption. So we do have confidentiality of the message. So it's essentially the same as the previous one. Take a secret S, combine it with a message, hash, but then encrypt all of that with a shared secret key as a different key in this case. So that the entire message is secret. So just different ways to provide both authentication and confidentiality. All of these are using hash functions and optionally three of the four are using encryption. Symmetric key encryption to be precise. So we've said multiple times now, using just symmetric key encryption without hash functions or even without message authentication codes may provide authentication. But there are a number of cases when we want to avoid encryption, especially encrypting large inputs. The reason being is the encryption can be slow. Okay, you encrypt a large file, it takes some time that we may not want to have to wait if that encryption is not necessary. If you want to encrypt in hardware, it's usually much, much faster than software, but you need the hardware to do that. So there's some financial costs involved of using hardware that encrypts. Some hardware that is designed especially to encrypt may work for large amounts of data, but may be quite inefficient and have a large overhead for small amounts of data. Another problem with some encryption algorithms are there may be some licensing costs. The algorithms themselves are patent. There's a patent on multiple different algorithms, which means that in theory, if you want to use it, you may need to pay someone a license to use it. So that's another reason why sometimes if we don't need encryption, we'll try to use other approaches. And the other approaches we're seeing for authentication, we've gone through some approaches using hash functions. In the previous topic, we went through message authentication codes, MACS. I've actually rearranged these slides, so when it says MAC is covered in the next topic, it was actually covered in the previous topic. MACS and hash functions provide a similar capability, provide authentication. And sometimes we refer to message authentication codes as keyed hash functions. They like hash functions, but also take a key as an input. Hash function just takes the message and MAC function takes the message and a key, so a keyed hash function. And in fact, HMAC is simply using existing hash functions and introducing a key. So there's a lot of similarities between hash functions and MACs. The authentication techniques we've seen with hash functions all use symmetric key cryptography so far. Let's look at using public key cryptography. And we'll arrive at what we call digital signatures, which are commonly used nowadays for authentication. What do we mean by a signature? We usually use a signature to be able to prove, so we sign a message with the intent of later being able to prove that that message came and was approved by whoever signed it. So when I sign a document, maybe in a year's time, someone can see that document with my signature and use that to prove that I agreed to that document and it was authorized by me. So that's a handwritten signature, similar concepts with digital signatures, but we want to do it on data, on files, for example. We'd like a message and the person who gets that message would like to be able to prove that it came from a particular entity and it's been approved by that entity. You would only sign a message that you approve of. Importantly, symmetric key cryptography cannot be used for this purpose. We need to use public key cryptography and that was one of the motivations for the development of public key cryptography to provide digital signatures. Why can't symmetric key cryptography be used for this purpose? With symmetric key crypto, two users have the same key. A shared secret key between A and B is known by two people. So if someone receives a message, so if someone gets a message, they can verify that message. So if A sends B a message, B can verify that it came from A, that works fine, but we can't provide the service that someone else, say user C, cannot prove that a particular message came from just one person in the world. Because with a shared secret key, a message encrypted with a key shared between A and B may have came from A or B because both A and B have that key. So a third party, user C, has no way to prove that a particular message came from just one user. With symmetric key cryptography, they can prove that it came from one of two users, A or B. But that's not good enough in some cases. We'd like to better prove that it came from A only. For example, if A encrypts a message with a key shared between itself and B and sends that message to B, B can decrypt and B knows that it came from A. B knows it didn't send it itself. Therefore, the only other person in the world that could have created this message is A. But B cannot prove to someone else, such as user C, that that message came from A because that message could have come from B. B could be faking and saying, ah, A sent me this message, but in fact it was B that created it. So because two people can have the same key, there's no way to prove that the message came from one user. And that's one of the benefits of public key cryptography. For the private key, there's only one person in the world that should have that private key and will use that to encrypt. Let's look at the concept of signing or digital signatures. The concept is that we sign a message at the sender and we can verify at the receiver. And signing involves encrypting the message with your own private key. If I want to sign a message, I'll encrypt it with my private key. And then that signature is usually attached to the message. So in this slide, I say S is the signature and that will be concatenated with the message N. It doesn't have to be encrypted depending upon whether you want confidentiality or not. Verification, if it was encrypted with the private key of A, then verification involves decrypting with the public key of A. We know with public key cryptography, we use the keys in the key pair to encrypt and decrypt. So a user verifies a message by decrypting the signature. We receive the signature. It was encrypted with the private key of A. We decrypt with the public key of A. We should get some message as output and we compare this message with the original message. If they're the same, then everything's accepted. The signature is verified. If they're not, then we don't trust that message. So the concept of digital signatures relies on encrypting with a user's private key, verifying with a user's public key. But very common in practice is to not do it this way but to introduce a hash. Rather than having to encrypt the entire message and sending that signature with the original message, we take a hash of the message and encrypt just the hash value. And when we verify a game, we decrypt with the public key of the sender. We get a hash value as output and compare that hash value with a hash of the received message. So the concept relies on public key cryptography. But in practice, we incorporate also hash functions to make the performance much better. So let's go through some examples of how we can use a digital signature in the practical manner and then see what the attacker can do. We have user A, B. Each user has its own key pair. In addition, we assume users know other users' public keys. So what's known by A also includes the public key of B and B knows the public key of A and other users if we need. And the malicious user, we'll see in a moment, should know the public key of both A and B. They know the public values. So let's say A wants to send a message to B and wants to sign that message. So let's see the steps that they'll do. What they send from A to B is, they take the message that they want to send and they calculate the hash of the message and then they encrypt that hash value with a key. For A to sign a message to send to B, what key do they encrypt with? What key, so some people are saying the correct thing, what key do they encrypt with? It's not P, U, B. There's only four to choose from. P, R, A. If I want to encrypt, if I want to sign a message, I sign up using my private key. The same as I sign a document, I use my handwriting. The only person in the world, the idea is the only person in the world that has my handwriting to write my signature is me. So here, the only person in the world who has the information to sign this is A. We use the private key of A. So that's the signature component. To note that sometimes it's S, but we don't just do that, we also send the message. So we can catenate the message with the signature. Sign the message and then attach the signature to the message, the same as a document. You have the document and then at the bottom, you attach your signature. B receives this, in this case, the normal case with no attacker. They verify. What they do to verify is they take the signature and decrypt that signature using which key? The public key of the person whose claims come from. P-U-A. And what do they get as output? Hash of M. That is, S is obtained by taking the hash of M, encrypting with the private key of A. If we decrypt with the public key of A, if nothing's been modified, then the plain text should come out. Remember, public key cryptography, encrypt with one, decrypt with the other key in the key pair. And we've done that, so the output will be the hash of M. Now we compare that with the hash of the received value of M. M was received, nothing's been modified here. And of course they match. That is, when we decrypt the signature, we get the hash of the original message. And when we take the hash of the received message, if nothing's been modified, those two hash values will be the same because the hash of the two inputs produces the same hash value. And that shows B that this message is okay. Why not avoid the hash function? What happens if we just use the entire message instead of the hash function and signing? Here, if we have message encrypted with the private key of A, we get the same effect, but there's a significant performance degradation here. Let's say the message is one gigabyte. If we encrypt, if we take the hash of that message, that one gigabyte message, we get a small fixed length hash value as output. And for example, a SHA256 hash algorithm produces 256 bits as output. So if we use a hash function that produces a 256-bit hash value, the signature is just the encryption of that 256-bit value.  If we didn't have the hash function, would A need to encrypt the entire message, one gigabyte? That takes a lot more time. And B, we need to send the message plus, well, we don't need to, but in this case we'd send the message plus the entire message encrypted again, a large overhead. We could get away with that case, but encrypting a large value is much, much slower than encrypting a small value, especially with public key cryptography. So using the hash is a significant benefit here. And when we talk about a digital signature, that's just how we'll define it from now on. Let's consider what an attacker can do to try and change things. A is going to, let's sign the message, so we'll do not write here the signature, encrypt using the private key of A, our message, that's the signature, and we're going to send the message concatenated with the signature each time. And the malicious user is going to intercept, and we've got to modify something and send it on to B, with the intent of fooling B into accepting the message. And what's sent by A is the message concatenated with the signature. What can you do? Malicious user receives, intercepts, again, let's try and modify some things. Let's first modify just the message. We'll go through all the cases. The malicious user modifies the message to be M prime. They don't change the signature. Again, let's say the message is one megabyte, the signature is 1,000 bits. All the malicious user does is changes the first one megabyte. The last 1,000 bits are just copied from the original message. So they don't change the signature. Send on to B, what does B do? Decrypt to verify. Decrypt using what key? Okay, so decrypt using, we received a message from A, we use P-U-A of the signature. What do we get as output? What do we get of the output of the decryption? Have I made a mistake? Of course, this is the hash of M. You'll fix yours better than mine. This is the hash of message. The concept is that we only need to include the message, but in practice we always do the hash of the message. So the output, the input was the hash of the message encrypted with the private key of A, decrypt with the public key of A, hash of M. Now we compare that value with the hash of the received message M prime. Do they match? Since M prime is not the same as M, our properties of the hash function mean that the hash of two different messages produces two different outputs. So we get an error here. They're not the same. Okay, so in this case, let's say the hashes weren't the same. How could the malicious user defeat this? How could it go undetected? Well, from here, if we could change M to M prime such that the hash of M does equal the hash of M prime, then it would not be detected by B. So a successful attack involves the malicious user finding some message M prime, which is different than M, but produces the same hash value. A hash collision, correct. So if we can find a hash collision, this scheme fails. We'll note that because that's an important, that leads to that requirement that we should be hard for someone to find hash collisions. So you're right in that, we'll see the requirements stated later, but if they can find some M prime, that's not the same as M, but the hash of M and the hash of M prime are the same, then they are ineffective. That is, if the malicious user could find this M prime, where the hash values are the same, then this digital signature scheme would not work. It would fail and that B would receive a message, think it's okay, think it hasn't been modified and it comes from A, but in fact it's been modified. So yes, that's the problem or the security of this scheme would depend upon how hard it is to find hash collisions. And it turns out for most secure hash algorithms, the difficulty of finding hash collisions depends upon the length of the hash. So you need a hash value long enough such that it would take too much time to find a collision. Hence, char 256, char 512, the hash length are 256 bits, 512 bits, they are considered secure in that it takes too long for an attacker to find the collision in this case. That there's two ways to attack here. Brute force attack is on the hash collision or find a weakness in the algorithm. MD5 is considered weak. Okay, so if you use MD5 here, like we saw in the previous lecture, we saw that you can have collisions. So people have found collisions. But if you've got a strong algorithm, then make the hash value large enough and a brute force will not be possible. Can the malicious user change the signature? They can change it, but will it be detected by B? Yes, because the signature uses the private key of A. So if we try and change the signature, we need the private key of A to make it decrypt successfully when B uses the public key of A. But we as the malicious user don't have the private key of A. So in a similar way as the other schemes, trying to change the signature component won't work either. Let's check that. Let's say we do try and change the signature. S' is calculated as encrypt. Malicious user receives M concatenated with a signature from A. They change M to M' and they try and change the signature to S' where S' is calculated by encrypting a hash of M' with what key? PRA? The point is that we don't have PRA. We'd like to use PRA, but it's private only for A. So it needs to be some other value. B receives and B verifies. Decrypt with the public key of A, S, which is really the same as decrypting with the public key of A. What is S? Sorry, S' S' is what's received. What is S'? It's this. Private running out of space. And I think there's one more bracket there. The point is B to verify takes the received signature, decrypts with the public key of A. What was the received signature? It was the hash of M' encrypted with the private key of the malicious user, or at least some value which is not the private key of A. What's the output of this? Or maybe easier, what is not the output? What is it not equal to? It's not equal to the hash of M' We start with the hash of M' It was encrypted with the private key of the malicious user That was decrypted with the wrong public key therefore we will not get the plaintext as output. So we don't get the hash of M' as output so then when we compare it with the hash of M' they will not match and B's detected the modification. So B will compare this value with the hash of the received message The hash of M' will not equal this value and again an error. Can someone create a message pretending to be A? Sign a message saying you are A. What do you need to do? Well you need the private key of A. So if A doesn't send a message but the malicious user sends a message pretending to be A the same problem arises as here. We don't have the private key of A So when someone tries to verify that message it will be detected as an error. So to defeat digital signatures the malicious user if they can find hash collisions then they can defeat it and that leads to a security requirement for digital signatures and hash algorithms in general it should be computationally hard to find hash collisions and we've stated that in a couple of points along the way which ones so we said here if the malicious user can find some different message such that the hash of the modified message and the original message are the same then they will defeat the security of digital signatures and going back to last week well jump back to what we had last week did you not see that? Maybe we will. I can't find last week's. Right, you'll look it up. Let's go to the slides that'll be easier. So we've gone through digital signatures we'll say a bit about the algorithm shortly but we're leading to some of the requirements on hash functions we just saw it should be hard to find hash collisions last week from memory we saw there was a case where it should be hard to go backwards the one-way property given the hash value it should be hard to find the original message that was used in scheme B of the authentication where we hash the message and the secret so we've seen two requirements on hash functions hard to find collisions and hard to go backwards and that leads to the one-way property and collision-free properties we'll introduce them today and then look at the algorithms and finish so let's define some terminology we'll need to to understand the properties of hash algorithms so we say the hash value H of which is the output of taking the hash of some input message X another way to talk about that is to say X is the pre-image of H so some terminology calls X the pre-image of H H is the hash value X is the message X is a pre-image of H the hash function is a many to one mapping there are many possible inputs which will map to one output because the hash function takes a variable size input and uses a fixed small output we know that there will be some inputs that map to the same output there must be that is there must be with our hash function it must be such that H some hash value H has multiple pre-images another way to think of that multiple messages will map to the same hash value we will have collisions so we say a collision or define a collision as occurring as if two messages X and Y are not the same but the hash values are that is the hash of two different messages produces the same hash value we call that a hash collision or simply a collision our hash functions in theory produce collisions but we're seeing in the requirements for security it should be hard to find collisions so they're undesirable in theory collisions happen in practice that should be hard for someone to find collisions so there's a difference there how many collisions are there maybe we can calculate that as an example for example we have a a message I think we may have done this with a a thousand bit input and a hash value which is twenty bits in length how many collisions on average so we need to think of how many possible messages so let's say the message is fixed in this case every message is a thousand bits long possible message two to the power of one thousand with a thousand bit message seven of one thousand and possible hash values possible outputs, two to the power of twenty note that the hash function should produce random outputs so we talk about on average how many messages map to the same hash values two to the power of one thousand inputs, two to the power of twenty possible outputs, on average There'll be 2 to the power of 1,000 divided by 2 to the power of 20, whatever that number is, that many messages will map to the same hash value. That's many collisions will occur on that hash value. So there will be collisions. And remember, messages are normally variable size inputs, so a message may be a gigabyte. Hash values are usually short, say 256 bits. The security of hash functions will depend upon it being hard for someone to find those collisions. Even though we know they are there, find two messages that make sense that produce collisions is not as easy as it looks, even though there are many possible collisions. So on average, there'll be 2 to the power of b minus n, where b is the number of bits in the hash, in the message, and n is the number of bits in the hash. So the hours would be 2 to the power of 1,000 minus 20 to the power of 980. So in theory, there are collisions. Let's look at the requirements for hash functions for cryptographic users, and we've mentioned them along the way. H should be any size normally. Now hash functions should be designed so it can work on any size input. And the hash value that comes out is fixed and usually small. For the practical purposes, we usually make the hash value small. For performance, it should be easy to compute the hash function. It shouldn't take too long to calculate the hash, even for large messages. Too long may be, even if it's seconds and longer, that's okay. It shouldn't take years to calculate the hash value. The next three requirements will actually jump to the bottom one. We expect that the output of the hash function, it produces random hash values. Two slightly different inputs should produce two completely different outputs, random outputs for the hash function. And these three are security requirements. We'd need these under different cases to make sure that when we use hash functions for security, that they cannot be defeated. Let's just state them today. Any questions before we finish up? Still dreaming of using Windows and IP config? Any questions at the back? Let's look at these three security requirements to finish today, and we'll analyze them on Friday. First, the one-way property. We need it such that if we know the hash value h, it should be computationally infeasible to find the input y. That is, it's easy to calculate the hash of y to find lowercase h, but it's hard to take the hash value and get the original message. That is, the hash function is easy in one way, but hard or basically impossible in the opposite way. This is called the one-way property or sometimes called pre-image-resistant. We'll talk about the meaning of these definitions later, but we've said that so far, we've called it the one-way property. Another property we need for security purposes, if we're given some message x, it should be hard to be able to find some other message y such that the hash of y equals a hash of x. It should be hard to find collisions, but this is referred as the weak collision-resistant property. The hash algorithm should be resistant for collisions, but this is the weak property. The next property, strong collision-resistance, it should be hard to be able to find any two messages x and y where the hash of both of them are the same. Maybe the hardest thing of understanding these three security properties is the difference between weak collision-resistance and strong collision-resistance. They seem the same, but they're slightly different and there's an important difference, especially with respect to measuring the security of hash algorithms. Weak collision-resistance means that here, I give the attacker some message x, and their challenge then is to go and find some other message y, a different message which produces the same hash value as the hash of x. So what the attacker must do then is find a message which produces the same hash value as a given value. The second property of strong collision-resistance says the attacker can go and choose any two messages x and y and try and find any two messages that produce a collision. If you're an attacker, which one's easier for you? Is it easier to be given a message and asked to go find another message that produces the same hash value or you'll have the freedom to go and find any two messages that produce the same hash value? The second one is easier for the attacker. It's easier if you have that freedom. You can find any two messages that produce the same hash value whereas the strong collision-resistance from the attacker's perspective trying to find any two messages that produce the same hash value is easier than the challenge of here. Here's a message, go find some other message that produces the same hash value. And it turns out if we need strong collision-resistance then that is one of the limiting factors on the security of a hash algorithm and we'll compare hash algorithms with respect to that. What have we missed? We skipped over this slide saying that digital signatures, when we encrypt with the private key and then decrypt with the public key what algorithm do we use to encrypt and decrypt? RSA is a common one but there are others. DSA, the digital signature algorithm and some variants, El Gamal and a few others. RSA is very common but the others are also used in some cases. There are different algorithms used for public key encryption for digital signatures. We'll stop there, have a think about those three security requirements, especially the difference between weak and strong collision-resistance and we'll come back to them on Friday and do a little bit of analysis about the security of them.