The first paper will talk on short pairing free blind signatures with exponential security. Hello. Yeah, so hello everyone, good afternoon. I'm a PhD student from University of Washington and this is a joint work with my advisor Stefano to sorrow. So in a context of blind signatures, we have a signer with secret key and the user with public key and the user want to sign the message and by running an interactive protocol with a signer. And at the end, the user will learn a valid signature form and which can be verified using the public key. And on the other side will require a signer to be blind, which means the signer does not know the message during the interaction. And moreover, even given the message and signature later a signer cannot think them back to which session that issues them. My signatures have a number of well known applications. For example, it can be used in anonymous ecosystems, always in anonymous credentials. And more recently they have gained popularity is due to their ability to implement anonymous tokens in web applications, for example for privacy preserving at click management. Practically efficient schemes for into the following three classes. RSA based scheme snore style schemes and the parent base schemes, a snore style games requires three wrong for each signing, where the RSA based and parent base schemes require only two rounds. However, both RSA and parent base schemes have some drawbacks. So the main drawbacks of the parent base schemes that they require pairing friendly elliptic curves, which make them undesirable for many applications due to the lack of high assurance implementation for example in the internet browser. On the other side, the RSA blind signatures inherit all undesirable properties of RSA is like the large key size. Therefore, many applications might prefer using the snore style schemes to despite their higher round complexity, in particular because they are simple to implement, allowed efficient verification and also can be based on any standard elliptic curves. However, very recently, for her mother at for her mother at all shows a polynomial time attack against the most efficient snore style scheme by solving the so called RS problem efficiently. So therefore a big problem we address in this paper is that can we have a secure snore style scheme, which is also very efficient. First, we are not a first off this question. So let me tell you a little more about related works and however results are substantial improvement over the state of the art. So the original blind snore was proposed by Charm and Patterson 1993. It's the most efficient signature size is just two scalar and communication complexity is one group elements plus two scalar. However, as I mentioned, the scheme is actually broken. The alternative is a scheme proposed by our bed in 2001. However, the scheme is less efficient, and it's original security provost founds to be have a tree incorrect. But a recent result by Casper shows in its security in the algebraic model and the random oracle model. At this point, I'd like to point out that all the result that showed in this page. A more efficient scheme was proposed by a push power in 90 sorry in 2020, which is so called cloud spline snore. The signature size is exactly the same as a blight snore with a double communication. However, its security relies on a new assumption, namely the so called MRS problem is hard. Where MRS is a variant of RS proposed in their paper. The important point here is that there exists a substantial attack against MRS, which requires to choose large curve to achieve desirable security level. So as you can see, the existing schemes are either less efficient or do not have the best possible security guarantees. Therefore, the major contribution of this paper is we propose two schemes that are both efficient and have exponential security. So our first scheme, the signature size is just three scalar and the communication complexity is true group elements plus three scalar. And then we prove it security in the in a generic model. And for the second scheme, we can prove it security in the algebraic model, assuming all needed this great logarithm as hard in addition to a random oracle. However, we need to add an additional scalar to both signature size and communication. Very appealing feature of these second scheme is that it emits a partially blind version where partially blind means it allows a part of message to be known by a designer. You can see our scheme was a most efficient program free scheme so far with national security. And before we move on, I would like to mention a few more related works to give you a full picture of the area. So, first of all, they were security analysis for snort style schemes in some restricted setting. For example, some of them can be proved secure when the number of sessions is small or when these sessions are sequential. And this work, however, we targeted the more realistic setting where these sessions are concurrent and their number is unbounded. Interestingly, some of the work I listed here do not rely on the AGM or GGM. Another interesting line of work explores boosting techniques, which the goal is to transform a scheme that is secure only for a small number of signings into a scheme that is secure for an unbounded number of signings. However, one drawback of the resulting schemes is that their communication and communication complexities grow with a number of sessions. So now come to a technical part of the talk. So, or security definition, I will not define a blindness formally. We rely on an intuitive understanding. So in this talk, I will mostly discuss how to achieve unforgeability. However, unlike the vulnerability for the normal signature scheme, which is defined as the adversary cannot forge a signature that is not been issued by a signer. Here, as you can see for blind signature, it is unclear which signature actually is been issued during the signing process. Therefore, we need to use another notion called one more unforgeability. So in a security game, the adversary can interact with a signer for L sessions. And the goal, so the adversary wins if they can output L plus one valid method and signature pairs. So here, all the sessions can be arbitrarily concurrent. So one more forgability means the adversary cannot forge a number of signatures, which is more than the number of signing sessions. So the overview of the resume talk is as follows. So to give you some intuition about our constructions, I will first recall what's the what blind snore signatures are and show the relation with the RS problem. In particular, I will show how one can break the one more forgability of blind snore by solving the corresponding RS problem. And since the RS problem is solvable in polynomial time, this gives a polynomial time attack against a blind snore. And next, I will show our idea to avoid the RS attack that underlies our schemes. Under some assumptions, we can show the security of our scheme is equivalent to solving the WFRS problem, which is a problem we define in other paper. And in contrast to our problem, we can actually show WFRS is exponentially hard, which is implies the exponential security of our scheme. In particular, I will define what is WFRS and provide some intuition behind its harness. So to start with, I will first describe the non-blind version of a blind snore signatures. So the public parameter consists of group G with size P and generate the little g and it has function H. The secret key is a scalar randomly sampled from GP and the corresponding public key is G to the X. And during assigning, the signer first sample a random nouns A uniformly from GP and send the G rise to A to the user. And then the user can view the challenge C as the hash of A and M.  And then the final signature is just C and S. And to verify signature, one can recover the A from C and S, and then check whether the C is consistent with a hash value. And then we get a perfect blind version of it by adding two random masks as highlighted. Therefore, we're now looking to the one more flexibility of the scheme. So where the user becomes the adversary, so we only need to consider the signer's protocol here. So I will now describe how one can break the one more flexibility of blind snore by solving the corresponding RS problem. So this is an anniversary that starts to concurrent signing sessions. So here I use subscript one to know the first signing sessions and the subscript two to know the second. So firstly, I will show how we can generate a signature, which is a linear combination of two sessions. So how we can extend it to an attack where the adversary can output three distinct and valid messenger signature pairs. And then we will see where the RS problems appears. The first of all to combine two sessions. The adversary can pick two arbitrary coefficient R for one R for two, together with the message M. The adversary said a should be a one to offer one times a two to the offer to and that is C to be the hash of a and the message. And then you will see we can pick C one and C two such that the value C is a linear combination of C one and C two with coefficient alpha. And after the adversary received the C S one and S two from the signer the adversary now sad as to also be a linear combination of S one and S two with coefficient alpha. And I will show that then the CS is a valid signature for for the message to see why this is a case you can see from the signing pro signing protocol, we can get these two equations. And then we can linearly combine this equation with coefficient alpha. And now let's rise G to the value on both side of the equation. So from the left hand side we get G to the S and from the first two term of the, of the right hand side we get basically give give you a, and from the last term it will give you the X to the C. So this is exactly what we need to show the signature is valid. And now to extend it to an attack. The idea is that instead of picking just one triple of one of two and message, we now pick three of them. And then we pick C one and C two such that the highlighted equation a hold for all of them. And then the adversary can output a signature for each triple. So as you can see, the main, like the main problem here to make this attack work is how to pick this alpha and how to pick the C one and C two. And this is exactly the RS problem for parameter two. However, the RS problems do hard for for two, but we can extend this attack to our sessions easily. And that's what we at all shows that when L is larger than log P, the RS problem is efficiently solvable. So therefore it means the blind score is insecure when L is larger than log P. There will now come to our schemes. So remember that the key step of doing the RS attack against blind score is that we can generate a signature, which is a linear combination of two sessions. So therefore our idea to avoid it, just simply add a Y to this equation. So suppose the Y one and Y two are chosen randomly and hidden to the adversary before picking C one and C two. It's not possible anymore to combine two sessions to get a signature. So basically, we don't know how to pick the Ys here to make the equation hold. So I will now describe how we construct our first scheme with this idea. Basically, I will only give a non-blind version here. We can get a perfect live version of it easily following some common tricks. So for our scheme, the parameters, public parameter settings and the key generation are exactly the same as blind score. And for doing the signing, the signing will additionally samples a Y, which is a non-zero uniformly from ZP and send the X, the public key, right to the Y to the user. And now to compute the challenge, the hash function will also take the Y as input. And then the sign will set S to be A plus C times Y times X. And then the final signature now is CS and Y. And to verify it, we just reject if Y is equal to zero and otherwise we can recover the A and Y from the CS and little Y and then check whether the hash is consistent with the C value. So one thing to notice here is that we do not allow Y to be zero because it is easy to follow the signature for Y to be zero. For our second scheme, the only difference is that we change the big Y to be a partisan commitment of little Y where the Z is a part of the public key. So because the commitment Y now is perfectly high as the value of little Y, we can relax the assumption from GGM to AGM plus this log assumption. And also to get a partially blind version, we just need to change the Z to be a hash of info for each signing where the info represents the part of the message that is known to the signer. And due to the time limit, I will only show the mean theorem we get for scheme one. So formally for any GGM anniversary, the probability to break one more for the ability of scheme one is bounded by the probability of solving the corresponding WFRS problem, but an actual term. Well, here, the HUH represents a number of queries to the hash function H and L represents a number of signing sessions and Q5 represents a number of group operations performed by the anniversary. So for the number of time anniversary, we can see the extra term was actually negligible. So therefore, our scheme one is secure as long as the WFRS problem is hard. So for the harness of WFRS, we can show that for any anniversary, the probability of solving WFRS is bounded by QH times QH plus 12 over P minus one. Okay, so we'll note that P is the original group order. Therefore, for an anniversary to break to solve WFRS, either the QH or L have to be roughly the scale of square root of P, which implies the exponential security of our scheme. Finally, I would like to convey some ideas behind how we define WFRS and why it is hard. So record that the main intuition was that in other construction, it's not possible to combine two sessions linearly to get a signature. However, actually, there are other ways that one can combine two sessions. For example, a trivial way is that we can set both C1 and C2 to just be the C. And then we can find we can linearly combine these three equations to get a signature. But however, this does not help at all to break the security, because if you're thinking about it, what you're doing is just getting one signature from two signing sessions, and then both sessions cannot be used for generating other signatures. So basically, this action does not help. However, it is unclear whether the anniversary can do some other arbitrary things or the combinations. So we define this following WFRS problem to capture all possible ways the anniversary can combine different sessions to get a new signature. But due to the time limit, I will not go into details here. But the main reason why WFRS is hard is because, essentially, the only way that the anniversary can break, sorry, can combine different sessions is the trivial way I showed in the previous slides. And this is mainly because we have sample random y here. So by the end, I would like to mention a few open problems. So, first of all, all of our results assume either the AGM or GGM. So a big open problem is whether we can get snore style schemes with exponential security, assuming only the random miracles. Also, it's interesting to know whether there are other applications for WFRS. So yeah, that's all my talk. Thank you for listening. Well, thank you so much. Do we have any questions for the speaker? Perhaps I can ask. So intuitively, why do you need algebraic group model and not standard model where you got this necessity of it in your construction. Yeah, actually, so yeah, so the main reason like we need the algebraic model is because we need to extract basically what's the adversary do. So basically we extract the RFN and beta. So basically that represents what the adversary do to combine different sessions. So our main argument is that if they do something like that, then the adversary cannot break the scheme. So if you're in a standard model, you have no idea what it was redo, although it might not be able to do something more but like we just don't have form argument to argue that. Okay, that makes sense. Thank you so much. Yeah, thank you. If you have any further questions, then let's thanks the speaker again.


So looking at your email you are saying props will be replaced with higher-grade ones in the future past Boogie of flowers and a heart-shaped box of chocolate.  I love it Cauliflower though, right? It would be cauliflower So I like this I don't think I do that I do do that. It's great My only comment will be and this is up to you if you want to do that or not Then a thing with dialogue is usually kind of a waist up So I'm glad it's a bit of a different framing but the other thing that frequently happens is that People are kind of stuck in in place now I'm not saying that you just add movement for movement sake, but you can add steps to kind of reflect her Her state like her how she changes. So by that, I mean what if She is already Taking a step back. So she's already kind of moving backwards here and then finishing a step through there That's all cute and maybe you would have to start her Slightly here ish So that way she takes steps forward that doesn't look like she's just coming straight to camera So perspective wise, it would be kind of weird to see that. So you would have a little bit more movements Left to right. So she comes forward stops on that That way she does this full stop here and you do exactly what you do here They go, okay. Well, what's going on with me and then And then on this you take a tiny step back So that visually cameras here, right? She's here She comes forward a bit stops and then maybe goes back this way or maybe back away from us It's not exactly back the same spot Unless it's a minimal that it doesn't quite matter Which is probably the case but that to me will be will be an interesting just change of it. She's a bit more Casual You know, she might be waiting for the date or a cab or something but still she could stake She could take one or two steps backwards Stop on this, right? Boom like that with that move. That's your last step forward. Like this is kind of a neat look Big weight shift there, but you can kind of imagine she takes she starts here Finishes exactly to this Is that great look? It's really great. I really like it and then here they'll take a little step back And then here you can decide how far you want to push this where she potentially might get more freaked out So maybe raising the shoulders a little bit for more tension bringing that arm up Box chocolate a bit more this a little bit tighter grip and then the bouquet of flowers will be here So just just a bit more tension potentially and how far you want to push this But I think this could be interesting as of now the body Scrubbed through there is pretty similar That's my main impression if I had to say one post that one post one comment is that it's all very similar in terms of posture except, you know the changes here are minimal see-kerf changes, but I think the steps forward and back and a bit of more tension here always experiment with Do that where she's unsure and then maybe here a bit more tense brings it up a bit more more towards us then And then oh I do that that realization you would then drop the shoulders more drop this drop this drop that That could also be something where she was oh no, and that is kind of a I was a relaxation of the body But it's good.  He'll keep alive there And I love this little finger detail I think that could be okay where Maybe it would be the second version That she gets more insecure, and that's why she brings it up closer to the tiger tiger with the thumb Everything's just kind of tighter and closer not trying to hide it kind of like what did I do and then the opening of oh, man I did it. I wonder if you need this car This is super picky. I hear things maybe in the back this guy I hear this would just be a very loud sound So I don't know this could be something I mean you can see I don't know how props you're gonna put in there and you know different cars or just leave it at that just as Include as indication of where she is that could be fine, too. Maybe that's up. That's just enough I'm just being picky on sound But that's about it. It's a great start. Yeah, I'll take you going Actually one more thing sorry just because I'm stopping this I know it's a detailed thing But as you move forward just watch out that we have Posing on those eyes. It's always kind of you drag it I box over there. That's gonna be okay It's gonna be very buried. So I'm gonna start animating I box is separately. So it's one over It's not so cut off. It's a bit more in line with this And then it's kind of you how cross-eyed you want her to be the cliche thing that I see a lot of movies is to have women to be Be a bit more cross-eyed Just to make them maybe cute or I don't know slightly innocence To you how far you want to go It's even here So it's kind of do you how far you want to go All right, all right, this is really it. Thank you All right, there's an email you can sign up you can start whenever you want you can submit whatever you want You get 16 submissions either way a like and subscribe would be awesome. All right. Thank you


Appalachian Wireless now has new forward pay pricing where you can pay up front and get the data and features you desire. Five gigabytes of data, just $39.99, unlimited, just $79.99, better service, bigger savings. That's today's Appalachian Wireless. Repairs to a road in Pike County could take a while due to utility issues. Kentucky Route 1499 in Feds Creek, also known as North Lavisa Road, collapsed two weeks ago. The collapse caused the road to close and forced motorists to take an hour-long detour toward Kemper and Pikeville. Feds Creek, slide 1499, is a cylindrical failure. It's common. It occurs especially in really wet periods of time and unfortunately this one just happened in the middle of a roadway. Access to Kentucky 1499 is restricted from Biggs Bridge to the Feds Creek Bridge. Traffic cannot get through the work zone. Both lanes and the shoulder of the road on both sides collapsed after prolonged rainfall. This February was probably the wettest February on record and so it just became saturated, it slipped and it fell down. The contractor making repairs to the pavement collapsed as the work could take up to a month. It has a 10-inch water line in the ditch line and then there's a fiber optic cable and utility poles in the lower end of the slide so it was going to take longer and cost more to relocate them while we work so we're trying to work around them. So we have to take a really kind of what I call Rubik's Cube approach where we take out some, put some back. The contractor and officials at Highway District 12 understand how long and time-consuming the detour is but thanked motorists for their patience during the road repair. In Feds Creek, Shelby Porter, EKB News.


Persona 4 Golden is heading to PC. While Atlas hasn't yet made an official announcement at the time of recording this video, evidence of a Steam listing for the game has been uncovered, making it clear that it's only a matter of time. Soon, PC players will get the chance to meet Teddy, Chie, Yosuke, and everyone's favourite, Kanji, as they cruise the Junares food court. But why bring Persona 4 to PC? And why now, when much of the discussion surrounding the series is dominated by requests for a Switch port? Official comments from both developer Atlas and publisher Sega make it clear that this has not been an easy decision to make. From the sound of it, Sega has been pushing relentlessly to release Persona games on non-PlayStation platforms, while Atlas has been taking the cautious approach, not wanting to make a misstep. Atlas is not very experienced at releasing games on PC. In fact, it seems that the company has only started making steps in this new direction due to fan demand. All the way back in 2017, Sega Europe's Vice President of Publishing, John Clark, made it clear that Sega was considering every possible game in their catalogue for release on PC. He said, If I asked you to write me a list of 10 games you want Sega to bring out on PC, it probably isn't any different from the list we have. When asked specifically about Persona games, he said, Of course, of course. We don't feel that anything is off the table in terms of these conversations. The fact that as an organisation we're having these healthy conversations, they're constructive. We recognise the value. We recognise the value of the community, the IP. The IP has got continued life to grow and get bigger.  Whether for good or ill, the company actually issued a DMCA takedown notice to a fan project called RPCS3, which was attempting to bring Persona 5 to the PC by way of PlayStation emulation. Said Atlas, We understand that many Persona fans would love to see a PC version, and while we don't have anything to announce today, we are listening. For now, the best way to experience Persona 5 is on PlayStation 4 and PlayStation 3. It seems that Atlas was genuinely eager to hear fan feedback. Every year, the company puts out a customer survey to gauge what ports players might like to see. In 2018 and 2019, this survey included a question on whether players would like to see Persona games or any other Atlas games make their way to PC. Possibly as a result of these surveys, in 2019, an Atlas game finally made its way onto Steam. Eight years after its original release, the original Catherine was released onto the platform. Again, a representative of Sega was eager to talk up the possibility of more Atlas ports, saying, We hope to have more exciting news to share from Sega and Atlas in regards to publishing on PC in the future. John Clark said, I think for us it was always step one. Let's launch Catherine, which then gives the IP owners and business owners an Atlas, who are in their first foray into the PC market, the ability to evaluate the success and how that can fit in for their future roadmap. I'm pleased to say they now have that information, so they're able to evaluate it. For us, it was a positive experience, and hopefully they'll share that and consider it in their own roadmap. Now, finally, it seems that Atlas is willing to take another careful step forward with the release of Persona 4 Golden. So why is this game coming to PC? Because fans demanded it, Sega wanted it, and, after enough persuasion, Atlas is willing to do what everyone wants. It seems the moral is that if you don't ask, you don't get. This is good news for everyone waiting for Persona 5 on Switch.


President of the United States. Please be seated and thank you. Every year we meet at about this time when you have your national convention, but this year I've got to hand it to you. You've shown a sixth sense for the timing of a story. As you know, last night I addressed the American people and talked about the initiative to Iran. One thing that has made our Republic great is that we don't hide from our mistakes. We learn from them and then we go on and do things better than we did before. That's what I intend to do and that's why I say you've shown a sixth sense. Not because you come here after last night, but because you've come here before tomorrow. We've spent enough time the last few months on inside Washington politics, who's up and who's down, who's in and out. The investigations will continue when they should, and the committees will continue to meet and they should. I've said the administration will give them every cooperation and it will, but so far as I'm concerned, the American people sent me here to do a job and there are just two years left to get it done. And part of that job is to strengthen the foundations of world peace. I've never felt more optimistic about the prospects for success in this area than I do today. And that's because this past week we've had a major breakthrough on the path toward an agreement for mutual and verifiable reductions in arms between ourselves and the Soviet Union. As I announced earlier this week, the Soviets have at last agreed to negotiate a global reduction in the number of U.S. and Soviet longer range intermediate nuclear force, or as we call them, INF missiles. The arms reductions agreement that as a result of the Soviet statement is now within reach derives from my zero option proposal of 1981. That proposal calls for eliminating all INF missiles. This negotiation will be conducted without strings attached. The Soviets have dropped their demand that we abandon our strategic defense initiative as a precondition to an agreement on INF and I welcome these developments. This change in the Soviet position is a great breakthrough and shows that in working for the cause of peace preparedness pays, patience pays, and firmness pays. That should be three truisms that preparedness, patience, and firmness each pays. But again and again over the last few years I've had to defend those truisms to protect the policy that has brought us to this moment of hope. First we were told that if we rebuild America's defenses, that if we help to make our alliances more prepared, we would make an arms reduction agreement less likely. The Soviets said that they would walk out of arms talks in Geneva if we deployed our INF missiles. But we and our allies knew that while the West had stood by, the Soviets had been deploying their own INF missiles at a rate of about one a week for several years, bringing a new and unprovoked threat against our friends and allies in Europe and in Asia. We knew this would make peace not more secure but less secure. And we knew that if we were ever to bargain for an agreement for reducing the Soviet INF missiles, we would have to have something worthwhile to give up in return. So we and our allies decided on a reasoned INF deployment as a balance against the new threat posed by this Soviet buildup. Then after the Soviets refused to respond constructively at the negotiating table, we began our deployments. We were prepared and then the patience came in. Yes, the Soviets did walk out of the arms reduction talks. It was part of a sophisticated play to public opinion both here and in Europe. But despite some dissent on both sides of the Atlantic, the American people and the people of Europe stayed with us. Together, the Western alliance waited the Soviets out. And then when it was clear that not just the leaders but the people of the alliance could and would wait and that neither the people nor their leaders would buckle under, the Soviets returned to the bargaining table. Patience. You know the story after that. Two years of meetings, hopes, successes, as well as disappointments. After saying they would not, the Soviets tied INF to agreements in other areas, including their effort to kill our SDI program. But again, we and our allies remained firm. We stood firm because SDI is a vital role to play in the journey to a more secure world for all. SDI supports our goal of deep, equitable, and verifiable arms reductions. It risks the, reduces the risks of war and the threat of ballistic missiles. I for one have no intention of bargaining away mankind's dream of a safer world. But we remained firm in another way as well. We said that our objective should be to ban all longer-range INF missiles from the face of the earth. When I announced it as our goal six years ago, the zero option was greeted with a great deal of skepticism. Some said that I couldn't be serious, but I must be proposing a zero option because I knew the Soviets would never agree to it. Or because I was so innocent that I didn't know any better. Well, after several decades in Hollywood, that was kind of a new thrill for me to be called innocent. I was and am determined that this decade's legacy to world peace will be better than just another step in regulating the arms race. The American people and the people of the world don't want arsenals that are growing only a fraction as fast as before. They want shrinking arsenals. And now we may be on the threshold in one critical category of weapons of getting just that because we stayed firm.  It's come time to plan the next step. And that's why you've come at the right time. Tomorrow I'm going to meet with Ambassadors Max Campleman, Ron Blamin, and Mike Blipman, whom I recalled from Geneva. I will discuss with them America's response to the Soviet statement. I've already instructed our team to begin putting our draft treaty on the negotiating table. This is a great moment of hope for all mankind. Hope, yes, for this agreement. Hope for other agreements as well. Agreements that increase our security and strengthen the foundation of peace. The flame of that hope burns today because we didn't give in at the first signs of a Soviet public relations campaign. This is the lesson of the last several years. We and our allies did not and will not let ourselves be pressured into an agreement. I will not let the hope for real peace slip by. Sometimes we get so caught up in day-to-day events that we forget the great promise that is our nation and our future. We live in an age of hope, a time when the dreams of mankind for the end of great wars and the extension of freedom to every nation and peoples may at last be realized. A time when we're looking to a new epoch of opportunity. This is not to say that all issues are resolved. The INF talks, several important issues remain. We need to agree on equitable constraints on shorter-range INF missiles. This is because the Soviets must not be able to circumvent an agreement on the longer-range missiles through a build-up in short-range ones. And furthermore, to be sure that the Soviets keep their word, we must continue to insist that all agreements will be effectively verifiable. I'm not particularly a linguist, but in the Reykjavik meeting, I had a Russian proverb that I could say in Russian to Mr. Gorbachev, and I said it, Dover, I, no proveria. Trust, but verify. He smiled and changed the subject. But finally there remain large imbalances in short-range nuclear weapons, chemical weapons, and conventional forces in Europe. We and our allies are addressing all of these issues. And as we address them, we today can begin to dream, as only a few years ago, humanity scarcely dared to dream, of the final end to nuclear terror. We can dream of a world of lasting peace. We can dream of hope and opportunity and of freedom for all mankind. No one should think that our aspirations for a safer world will materialize in a moment or for just a wish. We've come this far by being strong, patient, and firm. And we'll need those qualities on the rest of our journey for real peace. But we know now that it's a journey for which there is an end. We're not at the beginning of that end, but as Churchill said in another moment, we may be at the end of the beginning. We've come this far. We've traveled a long and weary road, but there's a great strength within us as a people. There's a great strength of purpose in relations between America and our allies. So let's go forward to our common dream and go forward together. I cannot believe in continuing to base the safety of the world and of mankind on a policy called MAD for Mutual Assured Destruction, the idea that if we had enough missiles to blow them out of the earth and they had enough to blow us out of the earth, we could sit here comfortably with the knowledge that sometimes somebody could push a button and world destruction would start. That's not my idea of a guarantee of peace, looking back on the history of the world in the past. And I think the answer that we have come up with is leading toward the elimination of those horrible weapons and then at the same time maintaining a defense against them, because now that we know we can make them someplace sometime, there could come along a madman that would again start to make them. When we promised to give up gas as a weapon after World War I, everybody kept their gas masks. And that's all we're suggesting, and we believe that there's some possibility of getting that kind of an agreement. Well, I've taken too much of your time and, you know, as I promised at the beginning, I didn't tell you, but as Henry VIII said to each of his six wives, I won't keep you long. So thank you all very much, and God bless you all.