Hi, my name is Andy Cathrill. Today I want to talk to you about Red Hat OpenShift Service on AWS, also known as Rosa. Before I get started, a little bit about me. So I'm the Senior Director of Product Management looking after managed services for OpenShift. On the right, you see a little Texas flag. So as you can tell from my accent, I'm from San Antonio. And the two Red Hat Fodoras there is because I'm a boomerang. This is my second time at Red Hat after a five-year gap. So glad to be back in the community. And the all-important technical stack. So Fedora on my laptop, Bash, Python, unashamedly Vim, and slightly ashamed of Chrome. So my content details are here. Any questions about the slides afterwards, please reach out to me on email or Twitter. So Red Hat Open Services, that's not something you expect. So we've got to dig into that. So why is Red Hat doing managed services? We'll talk about Red Hat OpenShift dedicated. And then the new Red Hat OpenShift service on AWS. And then we'll go into a demo. So we'll be light on slides, light on marketing, I promise, and we'll go heavy on the demo. So as I said, when we talk about Red Hat and managed services, often people can't look at me funny. I thought you guys did software. Well, yes, we do, but we'll be doing managed services now since back in the 2015. In fact, Red Hat, along with Google, are the only companies being operating Kubernetes as a public service since back in 2015. So we have a lot of history with our own managed service, with our partner services, with Microsoft Azure, with ARO, and with IBM with their rocks offering, or now the OpenShift and IBM Cloud. And we'll talk later about our recent announcements with AWS for the Red Hat OpenShift service on AWS. So why managed services? We're known for our upstream contributions. We're known for development. Why would we work on a managed service? There are only two reasons. The first one, it allows us to deliver better software to the community and our customers. Now, my marketing colleagues will say, don't talk about dog fooding. Don't talk about drinking your own champagne. And honestly, depending on the day, it could be either, but that's the whole point. So we can see in the software as a service, as you would, before we deliver it to customers. If we can't operate at scale and reliably, then how can we expect our customers to? So our SOEs work closely with support and engineering. It's one big team. So we get to give that feedback back into engineering to improve the product. When we operate a managed service, it's not a different OpenShift. It's the same OpenShift banner that you're gonna be running if you deploy it yourself. But this virtuous cycle means that you get the benefit of our operational expertise, our experience, and together we build a better product. So I mentioned two reasons. So the first, again, is to let us deliver better software to our customers. But the second is to let our customers deliver better software to their customers. So if you can spend more time working on innovation development and less time working on operations, that means it's gonna improve your products. You don't wanna spend time at two o'clock in the morning on a Saturday to do an upgrade, or to respond to alert at 11 p.m. on a Thursday night. Let us do 24 by seven operations and you can do development nine by five or maybe 10 to 10, you know how developers are. But the goal here is to take the burden away from you and we carry that operational load so you can develop better software for your customers. So one of the great things to me about OpenShift is, it's OpenShift no matter where you choose to run it. Whether you choose to run on-prem, on IBM's cloud, on Azure, Google, AWS, it's the same version of Kubernetes. It's the same stack on top with Prometheus, Grafano, et cetera. So the same stack with the same lifecycle, the same developer tools, the same operation procedures no matter where you run OpenShift. Sure Kubernetes is Kubernetes, right? And every cloud vendor has their own native service with upstream Kubernetes, but it's a different version, different patch version, a different lifecycle. And that's just Kubernetes. You've got to put everything on top to build your application platform. You need more than just the orchestration layer. But with OpenShift, everything comes in the box. Sure you can take out components, not use our logging, use your own, different monitoring, but you have everything in the box, pre-integrated, supported together, lifecycle and managed together. So you choose where you want to deploy. And nowadays everyone's hybrid, whether that's some on-prem, some on a public cloud, maybe you have multiple clouds that you're running on. You're gonna have more than one environment. And if we can give you consistency with OpenShift, it's gonna improve your developer on operational efficiencies. So with OpenShift, you can pick to deploy and manage yourself, or you can ask us or one of our many partners to manage that for you. So if you're running on Azure, for example, there's the ARO, Azure Red Hat OpenShift offering that's currently managed and supported by Microsoft and Red Hat. IBM runs what was known as ROX, Red Hat OpenShift Kubernetes Service, now Red Hat OpenShift and IBM Cloud. On Google on AWS, we've had Red Hat OpenShift dedicated. I'm gonna talk in a few minutes about the new Red Hat OpenShift service offering. So dedicated, I wanna talk a bit about this because our new Red Hat OpenShift service on AWS is really built on top of dedicated. That's a great foundation. So dedicated offers a OpenShift for, previously we had three, environment that's fully managed for you. You pick your platform, is that Google or AWS? Is it gonna be your account we deploy to or an account that we create and then we manage and build you for infrastructure? Which reason do you want multi AZ, single AZ, managed to OpenShift plus to manage OCM and we do all the management for you? It's not a managed control plane, it's managed everything. So whether it's the work nodes, the upgrades, if something goes bump in the night, at two o'clock in the morning, something breaks and alert is fired, we've configured a alert team, we'll respond to that alert for you or do the mitigation. So by the time you get up, the issue is resolved. In terms of upgrades, so we have a very frequent upgrade schedule, probably more so, you can configure this, you just define the upgrade schedule, probably more so than if you were doing them, because you don't have to worry about, is it gonna work? Who's gonna fix it if it doesn't, right? So our entire fleet is typically not more than six or so weeks behind what OCP has. Sometimes less is available, typically the same week as an OCP release, but we keep our customers in a window, we've got an N and M minus one release philosophy to give you time to test, but you'll have an always patched, always updated, fully managed stack. Now to build ownership dedicated, and of course everything we build is on top of open source, we develop something called Hive. So Hive is an open source project that delivers an API driven cluster provisioning and management system. So Hive is the foundation of this platform along with OCM, OpenShift cluster manager. So it has three resources that it manages, it has cluster deployment, so in the Kubernetes principle or declaratively described cluster that we would deploy, machine pools where we have a notion of managed worker pools or managed on each cluster, and sync sets which allow us to deploy managed resources to the clusters. Think about having a master set of Kubernetes objects, maybe it's operating configurations, maybe it's config maps that are deployed on each of the clusters. So we're managing that centrally from Hive. So it handles the installation and it handles the all important day too. So what happens after you're installed? Everybody can install Kubernetes. It's easy, it's point and click in most platforms, but what really matters is day two, the ongoing care and feeding of that platform, and that's where we use a combination of operators and the infrastructure provided by Hive and OCM. So as I mentioned earlier, we have an offering on AWS. It's really a traditional software service.  If you want to deploy a new cluster, you wanna onboard new customers in the region, if you haven't got subscriptions already, there's gonna be a lack. It's 2020, but actually it should be a bathroom. It's pretend it's 2020 more. What you want is on-demand software. You want a cluster, you wanna build a cluster. What we're used to today is not the legacy world of invoice as purchase orders, you want on-demand. You want consumption-based billing. So what we built with the Red Hat OpenShift service on AWS or Rosa is just that. So it's a native service. It's gonna be procured through AWS. So you're gonna go into the console, it's in a second and procured the service and build through AWS with just consumption-based pricing.  I wanna be some destructive testing.  You'll be billed only for the worker and those that you're deploying. I wish a subscription point of view for as long as you run them. So if it's just for an hour, it's just for an hour. So flexible billing. That will be billed on your AWS bill. So just as if any other service and integrated into AWS. Support called ours called AWS or we'll work together. In terms of user experience, so you're finding today this is in a preview. So you won't find it in the console but we have a preview program we'll talk more about later. You'll see the Red Hat OpenShift service. You'll click on that link from there. You get a landing page and this is one of the early designs before SGA. You'll download our command line tool that we'll demo in a second. You'll be able to deploy clusters and manage your clusters through the command line or through OCM. And here we've got a screenshot where I'll see this live in a couple more minutes. And then coming next year, there'll be the cluster creation workflow within the AWS console. So today, you're gonna be in OCM or our CLI or working with our partners at AWS on creation through the AWS console. We're adding better integration for IAM. You'll already see in 4.6, pod-based identity that's been integrated. We're working on the ability to sign on to this managed cluster using your IAM credentials. So let me go into a demo. So we're gonna start off on my terminal window. So I'm running Fedora and I have a command line tool called Moa CTL. Moa CTL is our tool for managing the clusters. Now that's gonna be renamed in the future but we've recently changed the name from a managed OpenShift service to Red Hat OpenShift service on AWS. So by the time you get your hands on this, you'll be typing in Rosa, not Moa CTL. So Moa CTL is our tool for provisioning. In the background, you'll also see OCM and we'll look at that again in a second. So I've already configured on my workstation my AWS credentials. So my machine already knows about my Amazon ID as well as my Red Hat ID. Let's have a look. So I've logged in, I've got my default region which is a east one and there's a logging command that could use and log out to log in and out of OCM. But from here, everything I do on this service and the command line is gonna be communicating back to OCM to do the work. So we'll quit like at OCM. So the commands I've got running here. So I'm gonna look at create. So I'm gonna create a cluster. Let's decide where I'm gonna deploy that and let's look at what version I'm gonna deploy. So I'm gonna look at what regions are available and this will show the combination of what regions I have access to with my AWS account. So if I've got a region where I don't have permissions or credit to deploy, the one to appear, I'm ever running the service. In terms of what versions we deploy, we have a curated list. Our goal is to have as much as open as possible, but we will have a slight lag in between an OCP release as we do the extra validation before it goes live. Aim for that to be about a week. We support N and then minus one. So at this point, four, five and four, four until four, six comes out. So let's do a deployment. So I'm gonna say I want to create a cluster. Minus I is gonna pump me in the interactive mode. So I'm gonna give it a name, I'm just gonna call it. Close that. Do I want to be in multiple AZs, yes or no? I'm just gonna stick with no just so I don't burn down any more resources. Which region? So I'm gonna stick to my home region here with ease one. Which version? Pick the size of compute nodes for my worker nodes. How many worker nodes do I want? We have a base of two. And if I want to configure the deciders for the machine, service and part, I can do that. And I'm just gonna leave those as default. And if it's a private cluster, that means the API endpoint will not be accessible on the internet. I'm gonna say no for that just so I don't have to then get into an instance that's connected to a VPC to be able to get to the OpenShift API. So the cluster will now start being created. So it's telling me now that the cluster identifier here with that name is being creative. And I can do Moa, cut all this clusters to look at the clusters being created. You'll see here now there's a few details of the blank, the external ID, the API URL. We're not gonna see that until the cluster is created. Let's have a quick look. So if I do a describe cluster, give it a name or the ID. I'll see those details once it's been provisioned or see the status. So right now it's preparing the account. So it's creating the appropriate users and roles that we're gonna use for the provisioning and that's gonna run in the background. Now an OpenShift install takes 20 or 30 minutes and I'm doing this live. So here's one I created earlier. So I'm gonna say Moa CTL list clusters. And it's gonna show me which clusters are already deployed in my account. So here we have got one that's in the ready state has already been deployed this morning and one that's pending, that's running. So I'm gonna leave that one that's running to go in the background. I should actually let me just pop over here and let's see in OCM. I should see that as well. So I now see I've got one cluster now installed on one that's in the installing state. If I clicked into that, once it starts to install off I'd be able to see the logs as the installer kicks off. Right now it's still creating the DNS entries, the accounts, et cetera. So let me go back into the command line we'll look around there then we'll come back into OCM. So if I describe that cluster, so you'll see it will have filled in some blanks. So we've now got the external ID and we've got the API URL and the console URL. So I should be able to hit that link and be able to log in. So how do I log in? I'm gonna have to create an IDP or touch an IDP or just create a user. So if I look at my command line options, I have a create IDP. I'll pass it the name of the cluster for the ID and put into interactive mode. That will now allow me to attach an IDP. So whether it's gonna get her Google, cloud app, open ID, et cetera, I can go through those flows to create one. Now I already have one, so let's have a look. So let me do MoaCTL and again, my cluster ID. And I'll see that I've already created an IDP connected to this cluster, which I'm using GitHub for auth. I also have the ability to create an admin user which will create an admin user outside of this IDP which will allow you to log into the console if you don't have an IDP you can configure. So the way that would look, I would say I would create admin and pass the name of the cluster and then it would create a cluster admin user and a auto-generated secure password. So let's have a look at back into OCM. Let's look at the cluster. There is my demo cluster. So if you've seen dedicated before very similar view, I get to see the resource utilization, any monitoring, any alerts to the firing, the configurations for the IDP. Again, I can go in the command line or I could go into OCM through the configuration. From a networking point of view, if I wanted to take this public service, make it private. So move to a private Kubernetes API, likewise with my application routers, single click to do that, I can add more application routers. On support, it allows me to set the contact. So there's no opt-in for management. The moment you create a cluster here, it's gonna be managed by us. So our SREs will have seen this cluster come up, they're now been monitoring it. Any communication that we need, we can go through support and we have notification emails that we can send you as well. Maybe it's not just me who wants to get the email but you've got different users, groups, admin teams who want access. You can then add notification contacts here so they can get the appropriate alerts, maybe something, questions that we have about the cluster, maybe notifications about issues, upgrades, et cetera. We've got one more tab that you'll see early in December where we have the upgrade schedule. It's a user interface to allow you to schedule when you have your upgrades for your cluster. So you could pick, I want to upgrade every week or I want to upgrade to four, five, 13 a week on Saturday at two o'clock in the morning. So rather than going through tickets that we do today, we're adding a UI with full automation so you can point, click, and schedule your upgrades to the status of your upgrade that's been scheduled. So what does this look like when it's running? This is probably the most disappointing part of the demo because once it's installed, it's just an open shift. There's nothing different here. There's no special features for on this managed service other than the fact that two o'clock in the morning we're the one who's get the call. We're the ones who are doing the upgrades, the patching, the monitoring. We're the ones who are handling the SRE work. It's still the open shift that you know. There may be some extra guard rails we put in place. For example, we have some emission controllers in place to block some sensitive operations so we don't want you destroying the control plane nodes since we have an SLA and we're managing those. We want to make sure that those stay up. Other than that, it's going to be the open shift that you're used to. In terms of how we do this, and we've got some links in the slides, but the tooling that I showed now is right at the course is open source. So there's a link on the slides that we'll see in a couple of minutes for Moa CTL to be able to look at that to download it. To get access to run the service, your Red Hat account has to be authorized because we're still in a private beta. So if you want access, there's a couple of links from there for you at the end of the presentation. Also, my email is there, spam me. We'd love to get more people on board. All that we would ask that you bring is an Amazon account that you could use because we're not going to pay for your infrastructure. I'm to be able to give feedback on the service. So we'd love to have more people getting hands on and trying this. Again, very quick and easy just to spin up a cluster. I mean, spin up a cluster is the cost of a latte, right, to cluster up a relic. If you want it for longer, it's obviously wrong, but very quick, cheap and easy to be able to do this hourly based open shift. So we can pop back into command line, see where we are. Okay, so second class is installing. So let's have a quick look. So I can ask for the logs, the install log for the cluster, and I'd be able to see that log. It's the same log you could also see in OCM. So if you really want to watch the install going through, you can. Other commands that we have. So you're going to need to have the OC command. Otherwise, how do you access a cluster short of the GUI? So we have an option to download the open shift clients. So whether I'm running this, whether it should be on Fedora or on another Linux or on Windows or a Mac, we've got the same features in the CLI. So it's going to download the clients for you. We can edit cluster resources. One of the interesting commands we have, which maybe isn't interesting to you, but from an SRE to be with certainly is to us, is verify. So if you're going to deploy open shift, there's lots of permissions that are required, obviously. So one of the things that we can do is we can verify whether it's the permissions or the quota. So open shift client, do we have the client installed? Permissions, before we kick off the install, we actually validate you have enough rights to do everything you need to deploy and for us to manage our mission for you. And for quota, in a similar fashion, we're going to make sure that you have enough quota to deploy. What we don't want to happen is halfway through an install, we find out that you run out of, what to CPUs that you can use for instances. So our goal is to make this as stable and reliable as it can. We don't start anything unless we know we're going to be able to finish it. Other commands we have that obviously, we can delete clusters. I'm going to leave this by that, because they're doing a demo, describe, we saw, edit, so edit cluster resources, I want the scale of the number of nodes that we have, logging in, logging out, et cetera. I want to pop over to this. Now we have a link on the last slide. So if you want to learn more, so we announced this one, where we think the relationship with AWS earlier this year, there's a sign up to learn more link. If you click here, we'll contact you and you can request to join the private beta program. Again, you can email me. The other link that we're going to have in the last part of the slides is to Moa CTL to the GitHub repo. So everything's in there. Again, we develop in the open as Red Hat. And you'll see 10 hours ago, we renamed it to Red Hat Open Chief Service on AWS Rosa. It's the brand new name getting ready for launch. So let me stop the screen share and go back to the slides. And again, we have two important links there, the GitHub link and the link for the FAQ we can sign up. Or on the third slide, I've bravely put my email address, so we're handed with care, put on the internet, whatever, email me if you have questions. We'd love to get you on board. So thank you for your time. Thank you for your work in the community. And we look forward to hearing from you in the future.


I had no interest in that till I saw that. I've been tempted. There we go. Oh, this music! How does it keep getting better? That's what I don't understand about Final Fantasy XIV. I haven't swore it. How does the music keep getting better? Only La La Spin? Yeah, I know it's Mox Nation, I want it now. I haven't won it before, but only the La La Spin?  This game is so confusing to you, is it? I'll try my best to explain it if you get confused about something.  We're in a dungeon, so... This is an instance area that only we can access. And the tank is pulling all these dudes together. And we're basically just trying to go to every mini boss... Until we finish the dungeon. If you look on the right side... This is actually called a duty. Which means we have a duty to fulfill. And if you look at this there's like... 7 or 8 objectives on the right side. Most of those have to do with gathering an item or... That much we just didn't go up there.  And once you do all that, the dungeon is complete. And you get loot throughout the dungeon. So it's like 88, 89 minutes in this dungeon. I don't know if you're talking about what we're doing, but... I'm just answering it anyway. Maybe somebody out there will get something from this. Why'd they come to me? Okay. I wasn't even attacking. They just popped on me. Yeah, people in the chat can definitely answer questions if you have them. Catgirl, play dead. This is like you're taking a nap more like a doze emote. I gotta look on YouTube. Okay, lagged on that one. I gotta look at the YouTube for the Makote. Play dead.  If it sucks, familiar. This doesn't have the awesome music though. Magitek predator. Oh, can we get that as a mount? Please? You may want to skip the next few cutscenes that there's some important story exposition. You may not want to skip. Yeah, yeah, I'm not going to skip them. I mean, that was just build up to this dungeon. What's that, Rick? Okay. Well, if you fantasize, I've already been a lala, so... I don't really have an desire to go back to them just yet. If anything, I want to be the dragon people. I don't know what to do. What do I do? What do I do besides not dying? Do I stand on top of them? I would just know what to do there. Okay. That's just, that's evil, man. Mommy! Okay. That was a little bit tougher than I thought it would be. Yeah, aura for life? I should have did that, man. I just completely forgot you could do that. If I would have known... If I would have remembered, I should have said that you could be aura. I would have picked that over the Makote. I may even do it sooner if I can get a Fantasia pot. Okay. That's the thing. What do I do here? What about a PvP bar still on? I don't know.  I wait too long.  Oh, hi, Mark. All right. These are new moves. Do not take too long. Please stop killing on my team. That would be nice. Would be very nice. Oh, we get to... Wait, no... Hey, it's Mr. Krabs. Oh, I can feel it. Level 60 armored weapon. So they say. Motion tracking, huh? Okay. I assume I still still... And it worked. I guess I don't even know what happened. What's my name? What's all this then? Oh, they're babies. I got all the words. God dang it. Why am I... He put a circle on me, man. When I couldn't move, I had to choose. Whether I died by the circle or whether I died by the freaking... Motion tracking. Choose wisely. You chose poorly. Some old Tron nonsense here. Chill with that. Beyond old, sir. Don't you... Okay. That was trollish. Oh. That's like an upgrade. Thanks. It's a 245 item. I'll gladly take it. Now I'm a true Hokage. Not quite. I just got a tanky. I'm expecting to go down... Hook it in that. This music... I thought we were stopping. I was just wasting the jitsu. I'll drop it anyway. Somebody will enjoy it back there. Oh, this is the best pull you're talking about. Are you just going to pull everything in the game? Have all the TPs. Nidalekeen. Are you the fake? Because we got one after you. Or we got to fight like the eyes. Didn't see that coming. I actually didn't see that coming. I actually did see that coming. I'll be honest. I'm not going to lie to you guys. That one, I didn't see that coming. I was wondering where he was, but I could quite put him to the... Yeah. That's the thing. That's apparently a thing. Oh, okay. And then he pushes me over here. What else heroes did? Really? You're not going to give me that? You're not going to give me that? I'm using it right now. Okay. That. Get... Meanie. Oh, no. Not like this. You got the collar, sir. This is my pop limit break and he went away. Okay. That's a slide ball. Blood for blood, height. Blood for blood. My life for our... Thanks, guys. Philip Buster's trousers are fending. That doesn't sound very nice.


A very tough but very important theory that you heard.  So for this purpose, I chose this image here, which was done in my group. I will tell you in a moment what it is. But even if you don't understand what it is, I think you can enjoy the beauty. So the message of the talk is theoretical spectroscopy, electronic structure calculations in general is fun, it's colorful, and it's also useful, I hope to show you. So I slightly changed the title, which was excitons in low dimension. I generalized a little bit to theoretical spectroscopy, which of course involves excitons. And I mostly talk about two-dimensional materials. Well, a little bit of history on two-dimensional materials. You know, in 2004, there was a discovery of graphene. And few people know what happened in 2003. Well, that was the foundation of the University of Luxembourg. And that's a place where I'm working. And so the university is only 17 years old. And when I arrived, it kind of looked like this. So the reason of the university is that there was a steel industry in Luxembourg. And steel industry went down the drain as almost everywhere in Europe. So you see this huge abandoned site that belonged to Achsador-Mittal. Here you still see the high furnaces. So the first thing that Luxembourg built was a bank. That's this red building here. Second thing, you don't see it yet, it was a commercial center. And the third thing is the university, which now looks like this. So a few years later, the university is there. And it's very active and growing. And there are also opportunities to do physics in Luxembourg. Okay, so just a few words about the university. Now back to the topic. Two-dimensional materials. I also will not talk long about, I mean, many things can be said about two-dimensional materials. After the discovery of graphene, many other materials were exfoliated because since the materials are layered, you can kind of peel them off quite easily with a scotch tape method. And then a whole zoo of two-dimensional, different classes of two-dimensional materials have been synthesized up to now. And I like to cite this recent review from Castellanos Gomez, who ordered the different classes according to their band gap. And of course, that's important for optical applications. So my group is mostly working on these three materials, graphene with zero band gap, boronitride with an extremely large band gap. We heard already from Mauricio that, okay, it's important to talk about GW convergence to decide what exactly the band gap is. Anyway, it's much in the far ultraviolet. And then you have the transition metal like calcogenides somewhere in the middle. So I give another overview here. So graphene, you remember the famous linear crossing of the bands, which makes it very exciting for physics, but kind of not so exciting for semiconductor applications because there is no gap. Boronitride does have a gap. Well, for a long time it was called the wide band gap semiconductor. Well, it's rather an insulator. So 6.5 EV is rather difficult for transistor applications. It's possible, but not very efficient. And then some years ago, people started to talk intensively about molybdenum, disulfide, because that one has a gap of 1.9 EV. And so it's suitable for transistors and solar cell applications, et cetera. So I will discuss a little bit the properties of hexagonal boronitride and molybdenum sulfide. And in the afternoon, you will spend your own time calculating the properties. So I hope that this lecture will motivate and tell you why it's fun to work with this material, which, by the way, is rather easy. It has a boron with three valence electrons, nitrogen with five. So on average, this makes four valence electrons. So it's not a mystery why you can build the same hexagonal lattice as you do with carbon atoms. And also you can make boronitride nanotubes as you make carbon nanotubes. Now, before I really give the lecture and present some of the work that is being done in our group, I would like to show this slide because if I put it at the end, everybody is tired and doesn't pay attention. But really, as almost everywhere in the world, research in Luxembourg is being driven by very good PhD students and postdocs and some of the people here are in the audience. So Enric Miranda is not here. He is now, he joins the WASP team in Vienna. Fulgo, well, you know, Sven Reichardt finished his PhD two years ago and Thomas Galveny will finish this year. He's also in the audience and Alejandro as a co-organizer was a postdoc for five years in Luxembourg and now he's in Spain. Of course, I have this long-term collaboration with Andrea. It started when we were both postdocs in San Sebastian. So some 16 years, 17 years ago and also Davide with all the wonderful implementations that he has done has been a very important collaborator. Well, we are not only doing ab initio, many body perturbation theory but also what some people nowadays call second principles. Calculations meaning semi-empirical, tight binding calculations and this is in collaboration with the team of Honorar in Paris, François Ducastel and Akin Amara. Okay, but actually I would like to start with something very simple and you may wonder, well, why is this guy now talking about the hydrogen atom? Well, you will understand in a moment but I do like the hydrogen atom because I have to teach it every year when I teach quantum mechanics. We are not going to do the full derivation. Let me just remind you that we are solving the Schrodinger equation for the spherically symmetric Coulomb potential and we do this by separation of variables in polar coordinates. So we get a radial wave function that depends on R and then an angular wave function and that turns out to be the spherical harmonics. If we insert this ansatz and the solution for the spherical harmonics into the Schrodinger equation, we then obtain the radial Schrodinger equation which now only depends on R and due to the slightly complicated form of the Laplacian operator in spherical coordinates we have this one over R squared over the R squared term. Remember we also have the centrifugal potential L times L plus 1, it's kind of a repulsive potential that grows with the value of the angular momentum L and then we have the attractive Coulomb potential. And, well, we do solve then the... We can then solve the radial Schrodinger equation, we get this functional form, exponential suppression at long distance, the Laguerre polynomials and factor R to the L. Doesn't matter exactly what the solution is, what is important in the context of this lecture are the energy levels and you get the famous minus one half times the Rittberg constant and I write it out explicitly here, times one over N squared. So that is minus 13.6 electron volt times one over N squared. If N equal one, you are in the ground state and then if N equal two, you are traveling already a large distance and the higher you go, the closer the energy levels and then you are approaching the continuum. So if you go to positive energies, we switch from bound states to scattering states and we have a continuum of states. And of course, knowing the Laguerre polynomials and the spherical harmonics, we can visualize the different orbitals, one as two S and so on, as we are used to doing from chemistry and atomic physics and quantum mechanics. Okay, so that's a hydrogen atom, an electron and a proton. That's already quite complicated, but at the end, when you know how to do the math, it's quite easy. At least it's easy compared to solving the beta-salpeta equation as you will do this afternoon. So we can go to a similar problem in solid state physics to the hydrogenic problem in semiconductors. So assume we have an excited electron in the conduction band and a hole remaining in the valence band. There are charged particles. They will interact through a screened Coulomb potential and then basically you have the situation here. The electron is somewhere, the hole is somewhere else. The electron is attracted to the hole so it will kind of orbit around the hole and the screening now is no longer the vacuum screening epsilon zero, but it's epsilon zero times epsilon r, the relative dielectric function or dielectric constant. So at the end, you see it's the same problem as the hydrogen atom. Just we have a reduction in screening and we have a kind of different effective mass. So first of all, we have the effective mass of the electron and of the hole. So we have to calculate the reduced mass through the inverse, through the sum of the inverse masses. Remember, sometimes it's good to look back what does this mean, effective mass. Remember, when we calculate the band structure, valence band maximum, conduction band minimum, usually around the maximum and minimum, we can approximate the band structure by a parabolic dispersion. It's very good close to the maximum but not very good far away. Anyway, usually when we do semiconductor physics, we are in a region close to the extrema so we can just do a parabolic approximation, Taylor expansion to second order. The first order is zero because we are in the extremum and from that expansion, you get the expression for the effective electron and the effective hole mass. So now we take an electron from here, put it there, so then we have two almost freely traveling particles, an electron and a hole, but they are bound together by the Coulomb potential. So now we can just solve again the Schrödinger equation and we did it already for the hydrogen atom and now we just need to replace in the Rittberg constant the free electron mass by the reduced effective mass M star and in the denominator, we replace epsilon zero by epsilon zero times epsilon R and then we immediately obtain the result that we scale the hydrogen energies by one over epsilon R squared times the ratio of the effective reduced mass and the free electron mass. We can also look at the Bohr radius which is given by this formula here. So the Bohr radius will scale linearly with the epsilon R and inversely proportional to the effective reduced mass. So we have basically solved the problem. We just need an estimation for epsilon R and for the effective mass and if we look at some semiconductors, if the band cap is not too large, you have fairly large dielectric constants around 10 and usually the effective mass is smaller than the free electron mass, so let's assume it's 0.1 of the free electron mass and then you see here you obtain a factor one over 100 squared times 0.1 so you get a factor 1000, so instead of 30.6 electron volt binding energy, you get some tens of millielectron volt binding energy for typical excitons in bound excitons in semiconductors. At the same time, the Bohr radius becomes 100 times the Bohr radius of the hydrogen atom, so around 50 angstrom, assuming that the typical intratomic distance is two to three angstrom, then this is at least a factor of 10 larger than the lattice constant, so this means that the approximation of a freely traveling electron is a rather good one. So physics is consistent and this gives you already an intuitive understanding of excitons in many materials. And well, Mauricio already mentioned solid argon, well I never understood why people are excited about solid argon, it's not so common, but of course at low temperature you can produce it and make it solid and you can measure it and well the excitement comes of course from the effect that in the epsilon two, in the optical absorption spectra, experimentally you measure the sequence of peaks and also in theoretical calculations you get this kind of hydrogen-like, Rittberg-like series of bound states and of course that's at the end the reason why theorists are excited about solid argon because you get a beautiful result and it's rather simple to calculate. So the kind of ab initio picture, so this one is ab initio calculation with BSE, it's consistent not only with experiment, it's also consistent with this kind of intuitive understanding of electron hole pairs being bound to each other by the screened Coulomb potential. There is a slightly more formal way to do this connection because you can, I will not show it, but you can simplify the beta-sylpeta equation. First of all you throw away the exchange interaction which is usually not so strong, at least not at gamma and then you obtain what is called the vanier equation, it boils then down to one particle equation and R is the relative electron, the distance between the electron and the hole and then you see it really looks like the Schrodinger equation, V of R is the screened Coulomb potential and on the left side you have the energy of the exciton with respect to the energy of the gap. So this vanier equation then describes bound excitons and it's rather consistent with what we have seen on the results are consistent with what we have seen here and also with what is calculated in beta-sylpeta. Now this holds not for all materials, it holds first of all for three dimensional bulk materials and it holds under the condition that the binding energy of the excitons is not too strong so the electron and the hole must be separated by some lattice constant otherwise the effective mass approximation for example is breaking down. Anyway I chose this introduction to kind of remind you that when we talk about excitons we are following a fairly complicated many body formalism but at the end the physics that we are doing is rather simple and has been known for quite some decades. So my lecture is mainly about two dimensional materials so let's then go to the hydrogen atom in two dimensions as a first step towards an understanding. So again I try to do a full solution, actually Thomas Galvani might remember that we put it as an exercise for the students in quantum mechanics. I don't know if they, how they performed but I think our instructions were quite good. So anyway you start with the separation of variables in r and and phi. The eigenfunctions of phi are quite obvious e to the i l phi, l being the z component of the angular momentum but there is just one component because we are in 2D. And then when we put this into the Schrodinger equation we obtain the radial Schrodinger equation which kind of looks similar to what we had before for comparison. Let me just show you what we had in the 3D case. So one thing that changes is the centrifugal potential it's just an l squared and not an l times l plus one. And then due to the different shape of the Laplacian in 2D we just have one over r d dr, r times d over dr instead of the same thing with r squared. So looks very similar but due to the two dimension due to the choice of two dimensional spherical coordinates there are some subtle differences and those subtle differences give a different radial Schrodinger equation with different solutions. But as we do for the 3D hydrogen atom we can write down the spectrum analytically and you get the same Rittberg constant you get the same factor minus one half but here you get one over n minus one half in parenthesis squared. And if you now calculate the ground state n equal one then you see that for the ground state in 2D it's sorry it should be a factor four. So doing math at night is okay, difficult. So the two dimensional binding energy of the two dimensional hydrogen is four times the binding energy of three dimensional hydrogen. So instead of 13.6 electron volt you would be at more than 50 electron volts binding energy. So it's increased by a factor of four and of course in the real world two dimensional atoms do not exist but now when we go to two dimensional materials we are in the situation and this figure I took from Furbius lecture. So here you have the electron and the hole that can only move in a plane. So this means that in principle when we do the Schrodinger or the one year equation we have to do it for the two dimensional problem. Well, it's not exactly true because the material has a certain thickness even if it's just one atomic layer let's say graphene or boronite white there is a certain extension of the wave functions into the z direction. So when we talk about two dimensional materials they are not exactly two dimensional but let's say almost two dimensional. But anyway, we can already expect that excitonic effects will be much stronger due to the factor of four in the solution of the idealized two dimensional hydrogen atom. Furthermore, we have to talk about screening and now you see in the simple figure that between the electron and the hole you can now draw field lines and the direct field line goes through the material so that one might say is strongly screened but then many field lines and I didn't even show all of them are going out of the material so they go through the vacuum. So this means that we have a strongly reduced screening or almost unscreened interaction between the electron and the hole and remember that the screening goes like one over epsilon squared in the Rittberg constant so if we now reduce the screening again we will increase the binding energy between the electron and the hole so the excitonic binding energy. So for those two reasons two dimensional quasi two dimensionality and reduced screening we are experiencing much stronger excitonic effects in two dimensional materials than in three dimensional materials and that's why two dimensional materials are such a wonderful playground for the Yambo code. Well, to be precise and that's because we are also doing many semi empirical calculations in the group when we have now the potential in 2D it's no longer just a screened Coulomb potential it is what is called a Keldish potential. Okay, this is the Strover function and the modified Bessel function of first or second kind and it depends now on the ratio of the dielectric constant in the outer and in the inner region. If it's in the outer region, if it's vacuum it's one and it depends on the effective thickness of the material and just to show you if this is the unscreened Coulomb potential then the Keldish potential at smaller distances is strongly screened, so strongly reduced so you kind of narrow down the Coulomb potential to something that is more squeezed for small radii and that goes to the bare Coulomb potential at large distances. So we deviate from the ideal Coulomb potential so when we then solve the hydrogen hydrogenic problem for this situation we will no longer expect a pure Rittberg series that only holds for the one over R potential so the states will change with respect to the Rittberg series. Yeah, a small excursion to the one dimensional world so you know there are also one dimensional materials linear chains of carbon atoms of boronite white atoms, sulphur chains, a lot of different chains have been produced. So we could solve Schrodinger equation in one dimension. We don't even have to do a separation of variables. It's right, it just depends on one variable so in principle this should be easy so I tried to get you the solution and looked at the internet and then I stumbled on this article of 2016 by Rodney Loudon and it starts with the theory of the one dimensional hydrogen atom was initiated in a 1952 paper but after more than 60 years it remains a topic of debate and controversy so then I decided, okay, if it's so complicated I will not present you the solution. Well, the point is you can usually people then do a cut-off to kind of lift the singularity. If you do that, then you get a finite energy solution. If you don't do it, you get in principle an infinitely strongly bound solution so that's kind of an ill-defined problem but in condensed matter we don't have to deal with it because if we have a one dimensional chain then there is a certain extension of the wave function in the perpendicular directions so we will never deal with the purely one dimensional hydrogen problem but nevertheless, remember if you deal with one dimensional problem the binding energy might be even much stronger than in two dimensional problems. Might be because it really depends on the extension of the wave functions into the perpendicular direction to the axis. So that was just for completeness. I will come back to one day problems when I talk briefly about nanotubes but mostly I will remain with two dimensional problems. So then of course we want to use YAMBO and not just do some semi-empirical one-year hydrogen problem stuff so we really want to solve the exact problem so we do solve the Schrodinger, sorry, the beta-sile-better equation in its full beauty as it has been explained by Fulvio and Maurizier so I will not repeat this just saying, reminding you that we are solving for the optical excitation energies which can then be seen as a superposition of many different electron-hole pair transitions and they are mixed by the excitonic eigenvectors A, V, C, K and labeled with the exciton index S. So the first observation of quasi-two-dimensional excitons was in this paper by Brice-Arnault in 2006. I say quasi-two-dimensional excitons because it was done for bulk hexagonal boronitrite but layer-to-hexagonal boronitrite so and they found out that at the end if you look at the ground state exciton and if you look at the excitonic wave function from the side it looks pretty much localized on one layer. So the electron that you excite remains mostly on the same layer than the hole that was left behind in the valence band. So this is then a case where even though you are dealing with the bulk material you are seeing quasi-two-dimensional excitons. And that explains the rather strong binding energy of 0.72 EV, so 720 milli-electron volt which is rather huge for excitons in bulk materials. And again, the explanation was because excitons are confined to layers. So they looked at the different excitonic eigenstates with a very small broadening here and you see the optical intensity. Now, this was the first calculation for this at that time complicated material and it was a huge step forward but there were some problems. So, you know that we always have to look at symmetry and boron nitrite has a three-fold symmetry axis. So if you put an electron, a hole at the position of a nitrogen atom then the excitonic wave function should be symmetric around it, right? Or at least it's wave function squared. And that's what we are plotting. The probability density to find the electron should be symmetric. So that was not the case in their calculation. And the reason was they were using a k-point grid that was not centered at gamma. They did it for a good reason. They said, okay, if we have a gamma-centered k-point grid then we have many degenerate because they would be equivalent k-points and then we are wasting time because they have all the same eigenenergy. So it's better to shift the grid to get more different eigenvalues and eigenfunctions. But the problem was, and that's why you should never do that, that you break the symmetry because if you shift a little bit by a small epsilon in one direction, your k-point grid, then your k-point grid is no longer coherent with the symmetry of the material and then Yambo might give you results that are almost right but not exactly right. So at the time, it really made us think a long time about what is happening and we were fighting with this cake-relating wave functions. And at the end, the solution was that you get doubly degenerate excitonic states due to the symmetry of the, due to the high symmetry of the material. And then, if you have degenerate states like this one and this one, they both look as if they were violating the symmetry of the material. But if you sum up the two densities, then you obtain panel C and the sum of the intensities, it's perfectly coherent with the symmetry of the crystal. So that's an important message that you should follow when you calculate excitonic wave function that actually nowadays, Yambo is doing this automatically for you. So if the energetic difference between two eigenvalues is smaller than a certain tolerance value, then the two excitons are supposed are interpreted to be degenerate and then Yambo or the post-processing tool of Yambo automatically gives you the sum of the two excitons. And now if you compare our calculation to there, or by the way, we did two calculations at the time, one with Yambo and one with Wasp in collaboration with Georg Kressel and except for a small difference in the GW shift, the two codes at that time really gave the same result. And that's also important every now and then to check concerning implementation of different codes are still giving the same results. So let's look at the black dashed line. So now instead of getting in this region of 5.8 electron volt, instead of getting four different excitons, we only get two different excitons. They are both doubly degenerate and one is dark and the other one is bright. So you see, it's very important to look at symmetry and to get accurate results. But this arrow that they did, I mean, we wrote a comment and they replied, but at the end it pushed really the community forward because it really caught the attention to symmetry problems in the beta-salpeta equation, where symmetry is much more complicated because we are dealing with a two-body problem instead of a one-body problem. Okay, having settled this issue, we then in the recent years did additional calculations on hexagonal boron nitride monolayers, few layers and multi-layers, and one example is this one involving Thomas and Fulvio. So you see that we obtain kind of a Rittberg-like series of peaks with decreasing intensity. We will see in a moment why the intensity is decreasing and why the first peak is so utterly intense. So here you see the wave function for the monolayer looks like in bulk. We also did, but I will not talk much about the details, that's the work of Thomas, and there is a poster outside. We also did a tight binding approach to the beta-salpeta equation. Here you see the tight binding fit, which doesn't look very brilliant for the pi and pi star band, but since at the end we only need to fit the region close to the parabolic maximum and minimum of valence and conduction band, respectively, tight binding at the end does a good job. And you see that tight binding helps us not only to print the density squared, but also the wave function by itself. And you can also analyze symmetry and anti-symmetry of the wave function with the positive and negative lobes in the picture. So that's the wave function of the ground state. Now if we go to higher excited state, we get more fancy looking wave functions, and then we are back to the analogy with the hydrogen atom in 2D, or we are back to the analogy with atomic physics, because you know, or you should remember from atomic physics if you calculate radial wave functions, the higher you go in energy, the more delocalized your state becomes, because you are going from that region in the Coulomb potential closer to the threshold for ionization. So naturally, already classically, your electron will explore larger regions of the space around the nucleus. And you see, if you do it carefully, that beta-cylpeta gives you something that is very similar to atomic physics, meaning you get more and more extended wave functions. At the same time, this explains why the optical oscillator strength goes down, because then when you calculate the dipole matrix element, it turns out if the distance, average distance is small, it's very large, and then it goes down rapidly. One can say a lot about bright and dark excitons. You can really do now group theory on the excitons and understand which excitons are bright and which ones are dark. And you see here, E is always standing for doubly degenerate state in group theory, A1 and A2 are non-degenerate states. So now you can understand the figure that was on the title slide, because I don't know if you did it in atomic physics at the time, but you can solve the Schrodinger equation not only in real space, you can also solve it in Fourier space in momentum space. So then you get the wave function as a function of the momentum, and then there is an inverse relationship. The more extended your real space wave function is, the more confined your momentum space wave function is. It's like with wave packets, the more extended a wave packet is, the less Fourier components you have, because for localization, you need many Fourier components. And now you see that as we go up in energy, our momentum space wave function gets more and more confined around the hexagon, the corners, the K and K prime points of the first Fourier zone. You can also do some kind of symmetry analysis, but I invite you to see the poster of Thomas to learn more about this. Well, last but not least, we started some time ago with Eric and Exiton website. It's kind of not developing, but eventually we'll pick it up. We are in the age of high throughput computing, so one could put all the calculations that have been done. You put the spectrum, we did it for boronite right, you click on the different peaks, then you get the Exiton wave function, and you can take your mouse and turn it, zoom in, change the ISO levels, et cetera, et cetera. So it's under this address, it's still functional, and eventually it will evolve. It would be nice to be able to shift the whole position with the mouse, but okay, we all know that this means the recalculation with the jumbo post-processing tool, so that's not feasible for the time being. I think I can skip, well, I will just briefly go through it, but Mauricia told you already the importance. When we do two-dimensional materials, we are always, well, not always, but when we use plane waves, we are using a periodic supercell. So even if your vacuum is large, the vacuum distance, you may, you might put it here, but still it means that when you go far away, you are dealing with the bulk material. So the distance D between neighboring layers in your calculation is and remains an important issue. So at that time, we calculated the dependence of the binding energy on the distance, because we know that in bulk boron nitride, the binding energy is 0.7 EV, and if we go to a distance of 80 atomic units, so roughly 50, 45 angstrom, then the binding energy goes up considerably. This is because we are going more and more from a 3D situation to a pure 2D situation, and at the same time, we are reducing the screening. But you have to do the same calculation for the GW correction. So you see that in the same figure, the GW shift goes up, and that's not a big mystery, because at the end, we have the same terms for screening and electron-electron and electron-hole interaction that enter the equations. So then, if you add up the two effects, you get a rather stable position of the exciton, even if you change the vacuum distance between the layers. However, this is only valid for the ground state. If you really would like to calculate the whole Rittberg series, of course then, it does critically depend on the position of your GW gap, and then, nowadays, you should use the Coulomb cutoff, meaning there is a certain distance above which the Coulomb interaction between electron-hole and electron-electron is no longer taken into account in the perpendicular direction, and that allows you a much more rapid convergence as a function of the distance. Yet, pay attention, k-point convergence becomes then a very important issue. Okay, I will maybe just briefly, Maurizio already showed you. We did results on boron-nitride nanotubes, and we saw some shift of the excitonic peak, but mainly for very small nanotubes. If you go to this index, gives you the radius of the nanotube. If you go to larger indices, then the spectrum looks remarkably stable, and it looks remarkably like the spectrum of the single sheet of boron-nitride that you see in Penelbee. And the reason for that also became quickly clear, because here, in a paper by Stephen Louis that came out at the same moment as ours, they calculated the excitonic wave function for a very small radius tube, to say, here's the position of the hole. You see the probability of the electron. And now imagine if you go to larger tubes, then the exciton will be in a locally flat area. It will not even travel around the whole circumference of the nanotube. So for larger nanotubes, you will just have a quasi-two-dimensional exciton because the electron hole pair lives in a very slightly curved, but locally two-dimensional world. That is valid for boron-nitride nanotubes. It's different for carbon nanotubes, where the exciton is really localized around the whole circumference of the tube. So there you are maybe closer to the 1D situation, but even then it's not purely 1D because the exciton is really traveling around the circumference, and thus it's really not comparable to the 1D Coulomb problem that diverges. Yeah, another interesting material is MOS-2, or all the transition metal diacalcogenites. I don't know why this is cut off. Also Mauricia already presented this result more or less important is that we have the spin orbit splitting, and that why it was very important at the time that David Sangali just happened to implement the beta-cylpeta equation for full spinorial wave functions, and that enabled us to do this calculation and separating the A and the B excitonic peak, which is typically the split exciton is typical for transition metal diacalcogenites. But this did not prevent other people at the same time from doing the calculations without spin orbit splitting. So here you see just a doubly degenerate valence band maximum. And they also got some peaks, and they are great. There is the A and the B peak in the experiment. In my beta-cylpeta equation, I see more peaks, but I say two peaks, so great. I reproduce the experiment. This publication here. Well, the common is of course the splitting of excitonic peak is merely due to a very low k-point sampling. So if you have a low k-point sampling, then your excitons may not be converged. You artificially split peaks into several sub-peaks, because in the beta-cylpeta equation, there are not enough states to be merged into one state. So then you may get artificial coincidence with the experiment. And this also happens in so-called high prestige publications like in nature photonics. Again, no spin orbit coupling, 18 by 18 k-points. You kind of see an A and a B exciton. Here they discuss the dependence on strain. Okay, the effect that they see is probably true. The scaling with strain, but of course, such a calculation is underconverged and it's damaging our community if too many calculations of this kind are appearing in so-called high impact or high reputation publications. So we did, sorry, it's not really easy to see, but we did a calculation for different k-point samplings. The different colors are the different k-point samplings from six by six up to 30 by 30. And you see that only starting at 24 by 24, you are converged in the binding energy. If you go to lower values of sampling, you really strongly vary the k-point sampling. And only then you really merge into one peak. So this is with outspin orbit coupling and with the 12 by 12 sampling, you see that you get a splitting of the peaks even though there is just one valence band and one conduction band. Principle, it should be one peak. So only to go to appropriate k-point sets you really converge. And the reason is why you need so many k-points is if you look at the excitonic wave function in reciprocal space and then you see that it's really confined to a rather small region around the corner of the hexagonal Briemann zone. So you really have to have some different k-points in this region. If you just use a six by six k-point sampling, you have one point here, the next point is here, and so on. So then you have only one point that really falls into that region where the wave function is localized. So that's a pictorial way to understand why k-point convergence is so important. Okay, in the last five minutes or so, I will take it easy and give you just some ideas where calculating excitons in the 2D world is going. So the modern way is to do high throughput and that's what Christian Thyssen did in his group and they came out with this paper and a computational 2D materials database which I think has something like 500 different materials with fully or hopefully fully converged GW band gaps, beta-cyl-peta calculations and so on. So for example, I looked for tungsten diselenite and you find the GW band gaps, the GW band structure and also the beta-cyl-peta equation comparison with the RPA, both for X polarization and Z polarization. So that's actually a very useful tool. If you want to check your calculation, you have a database that you can compare with. It also makes it more difficult to publish papers nowadays because when at my time it was maybe enough for a PhD thesis, let's say for a paper to present a converged calculation of let's say MOS2, then okay, you could maybe publish a PRL as Stephen Louie did or a PRB as we did with the same results. But then, I mean nowadays, you can no longer publish a PRB just about the absorption spectrum of W82 because it's already in the database. So we have to do more smart things and here are some ideas, some activities that we are doing in the group. So what can we still do with the beta-cyl-peta equation even though there are already high throughput archives? But there are still many things to be done. Exit on dispersion, few layer systems, hetero bilayers, and then spectroscopy involving phonons, electron-phonon coupling. I guess this will become a topic tomorrow when you will talk about time-dependent spectroscopy. So there are many, many things still to be done with the beta-cyl-peta equation. We are really just at the beginning mastering the static beta-cyl-peta equation, reproducing calculations that have been done. It's an important first step for you. Going beyond is then something that you can do in your PhD and I will just show, for example here, it's a full dispersion of the excitonic dispersion in the monolayer of hexagonal boronitride, again comparison of Appinicio and tight binding calculations. Another example is now we look at the bilayer of boronitride. We see the splitting of the bands, we see the splitting into bright and dark excitons because the wave functions are different, even versus odd, and then we are back to the selection of atomic physics. You need to change the parity in order to have a dipole allowed transitions.  We did excitons in hetero bilayers, MOS2, WS2. You see you have a staggered gap, which means in principle that in semiconductor physics, you say, okay, holes will go to the higher gap to the higher valence band, electrons will go to the lower valence band on the left, so you get an electron hole separation and that is great for photovoltaics, et cetera. The problem is you also get an excitonic binding of electrons and holes between the different layers and that really changes the picture and needs to be understood in order to use hetero bilayers as a solar cell. We also did excitons in tri-layers with an electric field, so you kind of artificially induce a staggered gap by changing the position of the valence band maximum in the three layers and also there you see interesting effects as a function of the electric field. And then we started to, well, we did some work, but I will really stop here to look at lattice vibrations and then when you switch on phonons and more information on that will come in the next days, I guess, then you can do all kinds of theoretical spectroscopy in elastic light scattering, Fulvio has been doing this and Claudio in the audience, sorry, indirect phonon absorption and emission, that's what they did. We are doing Raman scattering in Luxembourg and the works that Alejandro did and that you will probably see tomorrow is the relaxation of excited carriers via electron phonon scattering. Anyway, I will just conclude here and come back to this kind of overview, motivating you to dig further into thinking how we can use the beta-cylpeta approach to do new things and exciting things in theoretical spectroscopy. And with that, I thank you for your attention. Thank you.


I think we can start the AES and Byte book session. We have three papers. The first one is Zimpera V2, the family of efficient permutations using the AES round function. The paper is written by Shai Boron, who is in University of Haifa, and Niki Moha, who is now in NIST, and Niki is giving the talk. We're in a very small, cozy room. Also, I won't take up too much of your time. I think I can give the presentation 20 minutes. So that will be either enough time for questions afterwards, or give me a brief interruption if there's something unclear, and I'll give a bit more details about particular sites. I guess something that may have caught the attention of some of you here already is that it says version 2 here in the title. Version 1 was never published, but it was broken. It is a very early version of the work that was presented at Dachstuhl earlier this year. And we got a huge amount of feedback from many people that are actually here in the room today, some of which also have found some attacks against the early version. And I think this led to a subsequent design that is much better than it would have been if we didn't involve the community already from a very early stage. I already want to thank all of you present here for giving all the feedback that we received on Simpira. Let me first give a bit of context about who I am, what I'm involved in here. I've decided during just about all of my PhD studies, I've come to the conclusion that there's no need for any new design in symmetric key cryptography because all of the things that we need already exist, more or less. But that changed since I graduated four and a half years ago. Now I've been involved in three designs. So there is APE, which is part of Primates, that is an authenticated encryption algorithm that was submitted to the CSER competition in advance to the second round. Then you have Chosky, published at SAC 2014, that is a MAC algorithm for microcontrollers that is now undergoing ISO standardization, that is also performing quite well when you look at benchmarks. Like, for example, the benchmarking framework of the University of Luxembourg has Chosky at number one, according to their figure of merit. And then now, I hope you're in the right room, this is Asia Crypt 2016. I'm presenting Simpira, the latest design. So this will be a family of permutations based on the AES round function. Let me talk a bit more about the backgrounds of AES or why you want to use AES. So AES instructions are available on the Intel processor initially and then later on AMD and also ARM. Actually, if you look at any recent 64-bit processor, you will have instructions available to accelerate the advanced encryption standard AES. And AES has on the latest Intel Skylake processor that we were working on during this research, has an AES instruction that can compute one round of AES. And it's an instruction that has a latency of four cycles and a throughput of one cycle. So it takes a while to get the output. It takes four cycles to get the output of one round of AES. But already after one cycle, you can start the computation of AES, one round of AES on another input. So what is important here is that if you want to use AES, you need to use, if you want to have an efficient solution, a parallelizable mode of operation or you need to be processing independent messages. Otherwise, you will need to wait for cycles for every output that you need to use again. So this will lead to very inefficient use of the processor. Now we will take this into account and even embrace it and say that for the solutions that we are going to look at, we only focus on throughput. We don't focus on latency. So this will mean that the latency may not be so good, but it's a problem that is inherent already to AES. So you should really understand this presentation in the context of you need to use a parallelizable mode or you need to use independent data. And this seems to be the main thing that confuses people about this talk. But once you get an agreement on this, if people say, OK, so the latency is going to be bad, then what you will see will hopefully make sense in the rest of the presentation. Let me give a small example to motivate why you want to use things based on AES or one round of AES in the first place. I think it can be interesting instead of looking down at all the details, all the algorithms, to seeing what all possibilities are, I think it can be interesting to just look at a higher level what, for example, Google Chrome is doing. They have a privileged position where if you go to the Google website, they control both the site of the client and the site of the server. They can use whatever algorithm they like and they apparently don't even want to restrict themselves to standardized algorithms. So the field is pulled wide open. Well, for Google Chrome is the case that only if you do not have AES instructions supported on the client side, you will use Chacha 20 with a Poly 1305 authenticator. In other cases, if you use it on any recent processor that has support for AES, you will use AES 128 GCM. And also the fact that you use AES instructions, at least that's what Chacha has informed me, who's working not just at the University of Haifa, but also at Intel, so he should know, I guess, is that if you want to look at designs that are not just going to be efficient on today's processors, but also on processors in the future, then using AES or AES instructions is the way to go because those will only become faster and will only become better on future processors. And this will allow you to get the most out of your cryptographic algorithm for future applications. OK, so I mean, this slide just shows use AES. So we can stop here. But actually, AES cannot do everything. So let me discuss a bit the limitations of AES. And then it will become clear what we will develop in this presentation. For AES, one big problem is that you need a key schedule. And the key schedule of AES is quite complex. So this means that you have two choices. Either you compute the round keys of AES on the fly, but that means that you need to store them in RAM and that it becomes heavier to, I mean, always becomes heavier to change the key to another key because you need to redo this computation. You also need to store those round keys securely.  And looking at the key schedule as well and some of the modes of operation or some of the uses of a block site, you may want a tweak. But this is not natively supported by AES. It can be another limitation. The block size of AES is always 128 bits. Different key sizes are supported but only one block size. So this means that in most commonly used modes of operation, you become, I mean, security, the source will become insecure after about two to the power 64 blocks of data. And also means that there's no secure hashing support if that's something you want to do with AES block cipher. You can think of what alternatives can we use to AES? There are many different options there. I mean, originally, Rheindal, which is the algorithm that was submitted to the NIST competition for AES as a submission, also supported different block sizes and even different key sizes than the one that is now standardized. So you could think of maybe using Rheindal with 256 bit blocks. You can think of maybe Chateau. For Chateau, there are also instructions available in the Intel processor or base yourself on some other types of primitives. And we do an analysis in the paper of all the alternatives that you can look at, at least the most obvious ones, and see that they are not so, I mean, not inefficient, but not as efficient as they could be. And in this paper, we will propose Simpira, which is a much faster solution if you want to tackle the problems in this paper. Simpira is a family of permutations, cryptographic permutations, that support any multiple integer of 128 bits. Now, we're not saying that you're supposed to use the very biggest variants in this family, but also as a designer, we don't want to restrict ourselves to the type, the size of the permutation that we want to recommend. The design is scalable. And if you find the use to use a permutation of a very particular size, if it's a multiple of 128, then we are offering it. And that's the one that you can implement in your protocol or in your mode of operation, in your system to use as a building block. For B larger than two, we will look at FISTO and generalized FISTO constructions. The way that they are designed, I mean, here you see a FISTO on the right side, is that we will use two rounds of AES inside. We also look in the paper of what happens if you use one round of AES and then the security results are not as good. Two rounds of AES. And also a constant is needed. Basically, if you use AESank, which is the instruction to do one round of AES, then as one of the operands of this instruction, you can give a constant, or I mean, typically it's used if you use it for AES, the round key that you want to use for this round. What we'll do in this case, or we'll use for the first operation of AES, we'll use a constant that we need to add in to destroy the symmetry. If you don't do this, then if all of the bytes are equal at the input, then they will remain equal because the AES round function has no way of breaking the structure. And then use the second XOR that we get as part of AESank to do a combination of the branches in the FISTO. So the design goal here is then to have security up to two to the power of 128 queries that you will do. So this is security in the sense of structural distinguisher, the same that is done for SHA-3. They have a very easy analysis to guarantee this. Just from the fact that we say two to the power of 128, we're not considering any of the modes of operation using AES that typically only have security that breaks down around two to the power of 64. And if we can use the trick that I explained higher, it should be in the ideal case that the amount of cycles that the processor is executing is roughly equal on the best case equal to the number of rounds of AES because it means that you can launch a new AES round every clock cycle, which would be the ideal case of having your implementation, have the properties that you're looking for during the design. So now we need some basic requirements to analyze the security and we follow quite closely what is done for AES. So we look at counting the number of active S boxes and we require that the number of active S boxes should be, I mean, you calculate the number of active, the number of rounds for which you have at least 25 active S boxes. You also calculate the number of rounds for which you have full bits diffusion, meaning every output bit affects every input bit. For the first criterion, of course, both linear and differential cryptanalysis and you multiply this number of rounds by three and then we argue in the paper that this is going to give us a very good, not just security, but also security margin against all of the common attacks that would apply to AES-like constructions. And then of all the constructions that we look at, we want to use the one with the fewest number of F functions and as every F function contains two AES instructions, two rounds of AES, sorry, that means that you have the fewest number of AES-ank instructions, fewest number of rounds of AES. When we have multiple designs that would satisfy those criteria, the goal is to choose the simplest design and of course also these design criteria only supposed to guide the selection of the algorithms. Still, once you get the algorithm, you're supposed to do cryptanalysis to see if they are secure or not. So here I present you a simpere with B equal to one, so like the smallest member of the family processing 128 bit blocks and this is AES with a fixed round key. So you have 12 rounds of AES if you want to satisfy the criteria of the previous slide. You may see that this is a design that has a very bad latency because you need to wait quite a lot of cycles to get the output, in this case 12 times four is 48, but actually already in the next cycle you can launch another instruction, so this is an hand-prone for everything I will present here. We have a normal FISTO for B equal to two, where we have 15 rounds corresponding them because every F function has two AES ends, and the AES ends is 30 AES ends to satisfy those criteria. And then for B equal to three, it's also a really simple design. This is supposed to be the advantage when you see the designs are simple, it means that they're probably secure, there's not a lot of doubt you can have once you see the design of this case with 20 background. And when we look at B, so here's C for 21, C larger than or equal to four, except for two values of B which I will discuss later, we found that the construction by Yanagihara and Iwata is the one that minimizes the number of F functions, all the constructions that we looked at with an identical, all the constructions of generalized FISTOs, all the brands that we find in literature. This is the one that minimizes the number of, for B equal to six, and also the next slide for B equal to eight. There are two designs in literature that we found that are better, but in the current sense of having fewer AES rounds to be executed, so that means that if you want to be fair, well, those are the ones who really should use the standard constructions that we've analyzed quite a while already. They just do the shuffling of the blocks, in this case, for 15 rounds, and then here you have the varian B equal to eight using AES, but this is not what we used because that was the early design that turned out to be broken. The first attack by Tobronich at all, as in the room, was published at the back of this, and it shows collision on a Tintera-based hash function where the full round Tintera is attacked. With the complexity of Tutorpower 83, so we said security you should have up to Tutorpower 128, so this version is clearly broken. Then there's another attack as well that was published just about in the same week by Ronium, where he shows an invariant sub-space attack for the same varian, and there his attack has interesting properties that it is not just independent of the number of rounds, increasing the number of rounds will not set restore security, but also that you can break it with only two queries. That means the design is completely broken. If you want to look into these two attacks and see what actually has been going wrong here, it turns out that the problem is only with the Simpira varians that use this Yanagihara Iwata generalized spysal construction that we analyzed in detail and we explained in the paper. Basically, you need to be careful with independences. When you have a cryptographic permutation, there is no secret T, so it becomes difficult to assume that in every round, probabilities that you're going to calculate the behavior of the ciphers independent of the previous round, and that's an assumption that, classically, was never a problem because we classically use very heavy key schedules to have this Markov cipher with independent sub-key assumptions all, but in the modern world, especially since a lot of research has moved into hash functions, that doesn't hold anymore and we can have, for example, things like invariant sub-space attacks that are often overlooked that make it so that you have an interesting situation where you can have security against just about every attack in the book, in your cryptanalysis, differential cryptanalysis, meet in the middle attacks, but you can be completely insecure against this type of attack. It's something that, of course, not a defense. I mean, this time was broken, so this is something we should have avoided, but when you look at recent literature, also including a paper we'll present here at Asia Prep, a lot of research is going into invariant sub-space attacks and it's something many designers have gotten burned by. How does it need to be fixed? Well, basically this type one GFS by Yanagihara and Iwata is problematic and needs to be replaced. Also, the round constants are not the problem, but could have prevented the problem and strengthening the round constants is something that will not make the site for weaker. So what we do is we strengthen the round constants. We basically do exactly the same change that was done for the Rustle-Hash function when it moved into the final round of the chat reconpetition. We do exactly the same change in how the round constants are being computed and we add, I mean, I'm a cryptanalysis guy myself. We add for fairness as part of the paper that we still think that with the old round constants, the design should be secure. So the problem should not be as part of the, I mean, a result of choosing the round constants badly. So this is more to make a logical change to strengthen the Cypher and to remove any suspicion of insecurity, but we also want to attack it even with the old round constants as soon as the type one GFS is replaced, the design should be secure. So as you can see here, this is the updated variant for B equal to four, because this is the simplest design. And for B equal to five and bigger, it's, this is an animation I will show, because we have only four inputs. It's a construction that is recursive. Here you see what it's like for four inputs. But this thing, as you can see here, I'm also mentioning at the bottom, this thing is on the whole construction. You need to iterate it three rounds. So this thing needs to be repeated three times. Then you can turn this into five. This is the construction we use by adding two F functions to the right and two to the right, right top and right bottom. You get the results by having five, 120 bytes. Increasingly when it becomes bigger, it becomes less readable.  So we lost the simplicity in this sense that we don't have identical round functions anymore. But we hope that this construction is still simple enough to allow an easy analogy. The number of calls to the F function is the same as in Yanigihara Iwata's construction. So we don't lose anything in efficiency between the scheme and the problem that was in the solution. And to round up, if you look at benchmarks, we basically show that we can reach what we claimed in the beginning, which is that every round, we secure that dispatch is a new AES instruction. But there's a small remark that you need to make yourself clear yet. And that is that you can look at interleaved or non-interleaved implementation, where interleaved means that you would have laid out in memory the first block of the first message, the first block of the second message, the first block of the third message, or like the second input. So interleaving them instead of having the whole message block right after each other. When you interleave messages, you can have the optimal performance even for very large calls of the permutation. And otherwise, you will start to see that the overhead becomes quite significant after around permutation inputs of larger than 120 pages. So the main goal of this presentation is not to go into applications, but I will, I want to move here to my conclusion to allow a bit of time for questions. So Timpira is a family of permutations based on the AES function that supports any multiple of 128 bits. As a building block of two rounds of AES, and it's an easy security analysis, it's also security up to two to our 128 query. And when you look at the implementation figures, then we show that we are very close to the theoretical optimum, which would be to dispatch a new AES bounding block. Thank you very much. Thank you. Any questions? Picture with the X, big X. I'm afraid. The big one. And the big one, the big one, okay, this one. Yes, so I'm a bit worried about the highly restricted influence that the left side can have on the right side due to the fact that you have a very narrow bottleneck. It's only in the middle where data is moved from influences the other side. So if you're thinking about collision attacks, for example, you can show that such a design cannot be secure up to the square root bound. Exactly, yeah. So did you consider schemes in which you don't have such bottlenecks, which limit very strongly how one part can influence the other part in your permutation? Actually, I mean, so it's a very valid remark and the simple answer could be just to say, we repeat this three times and this is where the security should come from. But actually, we're playing to your question. This is a problem that not just this design has, all of the designs, all of the piecel designs that you can consider. So you need a certain number of rounds so that every input can start affecting every output. Otherwise, you have these bottlenecks as you can see that more rounds are needed before you can see it. No, the problem is actually deeper because in this design, every input bit can influence every output bit, but if you are going to have a collision of the information which is passed from one side to the other, you just don't have sufficient variety of information theoretically, how much information about the left side is going to influence the right side. So it's not the single bits which do not influence, but it is that many combinations are going to have exactly the same influence from one side to the other. Let's not forget that we're only targeting security up to two to the power of 28. That's what will save you. Yeah. Any other question? That number down there, it says number of AES calls 24B. So it means that for every message, what you're doing 24 AES rounds, is that correct? So you need to say what B is, right? So when you fix the value of B and B is the number of 128 blocks of input of your permutation, then 24 times B minus 36, that's the number of AES rounds that you're executing for the whole permutation. Let's forget about minus 36. So 24B only means in general that you're using 24 AES rounds for 128 bit message, no? No, of course, okay, I see where you want to go. I mean, the input is B times 128. The input is B times, B is the number of blocks. So the input is B times 128 bits. Look, you have 24B, you forget about the 36, right? You have 24B. For processing B times. Of course, 16B data. So this means, and I have this here on the last slide, this means that when your input become large, your performance is, when you can ignore the 36, 1.5 cycles per byte. That's bad, right? That's what you want to say. You can do better, but we want something that is secure up to two to 128, right? Exactly, yeah, yeah, yeah. For 128 times B bits, exactly, yeah, yeah. I think into the details, we should leave it for the coffee break. Okay, we can discuss further, yeah. I have a short question about, I mean, we don't have much time, but I would like to know about, Well, you're in the session. Efficiency, yeah, yeah. About efficiency of the input. Can you go again to the large figure, large? No, no, the large one, the construction that you have. Yeah, this one. You designed this to, let's say, use all the steps, pipeline steps of the AES implementation in the Intel microcontroller. And then two of them, let's say the left one and the right one can go to the pipeline after each other, but at least, because in each of these F functions, you have two AES rounds, then with these two, you feel completely the pipeline, right? And the next one, when one of them comes out, then you can start one of the other ones. The order of the operation is important for you. You reach the highest efficiency, or doesn't matter which of them you give birth to the pipeline. If you want to execute just one permutation call, you cannot fill the pipeline. No, but F and F, two F you have at the top, one at the left, one at the right. But you have latency of four. Yeah, but... You need to be executing four independently if you want to fill the pipeline. No, you give one of them left one to the F, which is the one AES round. Next clock cycle, you give the next one up there. That one you cannot keep, but that one you can keep, right? To the left. The right one. Yeah, and then you're stuck. But then you are not using the whole pipeline again. And this is why, and that's, like, I mean, if people can agree with the very, very first fight, which says, already you have the problem with AES inherently of the fact that you're using AES, you need to have a parallelizable mode, or you need to be processing independent data. So putting it into shy words, the way you explain this to me is, you've been advocating for such a long time at Intel that we need to use parallelizable modes because that's important to make AES work efficiently. So if you're willing to accept it, that the mode needs to be parallelizable, then that's not a problem because you just have your different input block where you will be able to process the pipeline. Sorry, but your construction is not using the whole pipeline of the AES. Available in the market. To use the whole pipeline, you need to have a parallelizable mode, or you need to have independent data. Otherwise, you don't fill the pipeline. Okay, thank you. Okay, let's thank Niki again. Thank you.