One of my early videos was one I made for the 10th anniversary of Dead Space. To this day, Dead Space remains one of the best video games ever made and a pretty unique experience. It's not quite a survival horror game and it's not quite an action game. It has a bunch of puzzles and exploration despite having a very small and linear map. Its graphics still stand up today because the lighting and art design were done so well that the game is basically timeless. In that video, I said how much it bothered me that EA wouldn't just release a remake of the original game with modern textures and lighting, but this year we got the announcement of the upcoming remake. With the Dead Space remake right around the corner and coming from a new studio made up of developers from the original Dead Space, Callisto Protocol was always going to be compared to a classic game. Well after playing the game twice, first on Normal and then on Easy, I think I can comfortably say that Callisto Protocol could have been an amazing game. But a veritable mountain of small annoyances and odd design choices as well as a narrative that leaves the player wanting more means the game simply isn't all that good. Let's talk about what went wrong with the Callisto Protocol after the logo. Good pacing is hard. Listen, let me say right up front that this essay is going to lean heavily on the comparison with the first Dead Space game. I understand there are some people who will insist this is unfair because they're different games, but I love the belief that it's only through comparison that we can properly critique a work of art. And it's quite obvious that the Callisto Protocol is greatly influenced by Dead Space. I mean, you stop on enemies to get the loot out of them, there's just a ton of stuff, it's very clearly a modern version of Dead Space. So let's start with one of the game's greatest strengths that also ends up being simultaneously one of its big weaknesses. The Callisto Protocol's map and visual design and how it interacts with the way the game feels paced and its world building. It is important to make clear that the Callisto Protocol is an extremely impressive looking game. I play it on the PS5 instead of PC only because I felt like playing in my bedroom and that seemed to be a good decision as there were all sorts of like PC performance problems. But even on the performance mode on PS5, the game looks quite good. Lighting is excellent, textures are superb. The materials on Jacob's prison jumpsuit and especially his late game armor is truly excellent. When it comes to just the graphical technology on offer, the Callisto Protocol looks like a game from a big established AAA studio. It's obvious that a tremendous amount of effort went into pure graphical fidelity, asset design, and animation work. But everything in life comes with a cost and while the Callisto Protocol's graphics are as good as anything else out there, the art design and level structure aren't as impressive as the pure pixel count on offer in a screenshot. Let's start with that art design. The Callisto Protocol is extremely reminiscent of Dead Space in its basic art design. It's in the far future but you're in a prison so everything is designed to be drably utilitarian. Dead Space did this as well as any game you will ever play. The Ishimura is obviously inspired by the Nostromo from the first Alien film in that it's a far future that reminds us of our own world more than like a utopian future. Modern day caterpillar construction equipment is insanely advanced but because it's all industrial heavy machinery, it is not gleaming and new. It's beat up. It's made for task. In Dead Space, the entire ship is a character. The levels are filled with posters or signs that not only constantly remind you that you're on a huge mining ship, but also serve to explain the world to you. The game is one of the excellent examples of early environmental storytelling in games. Every room and hallway in Dead Space feels like a real place that served a real function and it did that despite the massive technological constraints of the time it was developed. The Callisto protocol should presumably have much more freedom to make it's levels even more convincing, but it fails. Not because the memory or the GPUs of the time can't handle the detail, but rather because the art design put more concern into making each level look scary and high fidelity and destroyed than it did into making each level look like an actual place that people lived and worked. Dead Space is pretty light on dialogue, but manages to pack a bunch of narrative into the game through short audio logs and especially that environmental detail. The textures in Ishimura are reused over and over, but each area still manages to feel like a distinct level and each area feels like a real, functional, utilitarian space. The posters in workspaces, the private items in the living areas, the different kinds of work areas. This makes the player feel like they're on a journey moving through a real ship. It's this sense of forward movement that makes Dead Space such a well-paced game. Each area feels unique, even though they're using such a limited number of assets. But in the Callisto protocol, the Black Iron Prison, which is an awesome reference to an amazing work by Philip K. Dick, by the way, but anyway, it doesn't feel like a real place. There are only a handful of areas that actually feel like they served utilitarian purpose. There's a laundromat. There's the sewer part. There's a very small medical bay section. And at the end, there's the ruins of an old settlement. But for the vast majority of the game, you're moving through nondescript rooms of pipes, like 80% of the game. When you're in the prison itself, it feels less like you're in a real prison and far more like a video game level. There are no pictures in the cells, no belongings, no posters. This is not what jails and prisons are like in real life, I know. People live in jails and they look like places that people live. But okay, let's say that this is a particularly terrible prison where nobody is allowed to have a toothbrush or deodorant or instant noodles or pictures of your family. That does not solve the game's problem of not feeling like a real place. Why does a prison have a bunch of shops where you can buy ammunition and weapons? On the Ischimera, this made a little sense because you're on a ship of workers, but it makes almost no sense in a prison. Then there's the spinning blades and spike walls. I have worked in several industrial facilities and in my experience, there are very few spike walls or exposed spinning meat grinders of death perfect for flinging bodies into. Are these things fun for gameplay? Yeah, they are.  And that comes at the cost of narrative cohesion. Surely, we could come up with an equally fun way to do that that doesn't include literal walls of dangerous spikes all over a place where thousands of people live and work, right? There's a lot of little things like this that all start to add up to make the prison feel very fake. And when you stack that up to dead space, which is renowned for feeling surprisingly real, it takes a toll. We can't leave this section about the design of the world itself without mentioning the mind-blowing amount of shimmying through gaps and vents and ducking under pipes that you do in the Callisto protocol. I assume, like in most games, that this is often hiding loading screens, but if that's the case, something has gone terribly wrong. There are entire sections of the game where you will shimmy through a gap, walk five feet past non-descript pipes, dunk out our pipes for a while, walk five more feet, climb a ladder, walk five more feet, and then spend 10 seconds crawling through a vent. An insane amount of Callisto protocol is spent crawling through vents or shimmying between walls. Now, Dead Space had this too. The doors would take a few seconds to open or you take elevators up and down. But generally, when you came out of an elevator, you had a good long area to explore. There's one thing to do this in God of War, or The Last of Us, where you will shimmy through a gap and enter an area that has a bunch of stuff to do. But here you'll shimmy through a gap to load a single hallway that ends with a vent which opens onto a single hallway that ends with another gap to shimmy. How can this be? It absolutely crushes the pace of the game. I wish I had the energy to go back with a stopwatch because I honestly believe you spend as much time shimmying, ducking, and crawling as you do fighting and exploring. And again, this hurts not only the pace and the gameplay, but also the world building itself. Who designed this prison that is chock full of places for prisoners to hide? Why is this building built with dozens of walls that are pressed so closely together you need to squeeze through? I want you to honestly think through your whole life and ponder it if you've ever seen a structure that was built with one foot gap between the walls just big enough for a person to hide in or climb through. But the prison in the Callisto Protocol seems to have been designed by an architect who was building for Slender Man. Never have I played a game where this was so egregious. And because the game loves to split its hallways and have one critical path and one loot path, you'll consistently find yourself having to shimmy through a wall twice, once to go get the stuff and once to go back to get where you're going. This is the difference between excellent world building and level design and bad world building and level design. If this was a tech issue, they needed to figure out a better solution. Even if that meant less pixels to load, because as it stands now, the game is extremely frustrating in this regard. Reinventing the Wheel So, where to start with the Callisto Protocol's combat design? At the start of my first playthrough, I truly hated it. But by the end of my second playthrough, I became pretty ambivalent about it. It's not as bad as I had originally thought, but it is certainly not very good either. There are a few reasons why it kind of falls flat, including the control scheme, enemy design, and again, the pacing. Let's start with that control scheme, because it's the one thing that the Callisto Protocol does in a truly unique way. Many years ago, the Lord looked down upon video games and said, It is boring to only avoid damage by jumping or moving out of the way. Let there be another way. And so he looked upon the video game controller and he said unto it, Let there be eye frames when dodging. And Moses said unto the Lord, O Lord most high, how shall we bind the dodge unto thy controller? And the Lord said, It shall be B, or sometimes A, or very rarely shall thy bind dodge to a trigger. And so it was done. Do you know why nobody but the Callisto Protocol maps dodge to the left stick? It's because that stick already does something. It moves the character. This one decision is what makes the Callisto Protocol strangely hard when you first start playing and then crazy simple after the absurd mapping finally clicks. The Callisto Protocol has this very odd system where once you're in combat, Jacob is synced up and locked to facing the enemy. Once that happens, the left stick no longer turns the player, but instead makes Jacob strafe. As the enemy attacks, you hold the stick to dodge, then flick it the other way to dodge again and then back the other way to dodge one last time. This makes for very slick looking animations in combat. It sure as hell looked awesome in trailers, but it's so weird and unintuitive that you will find yourself repeatedly failing at the start of the game. In fact, the game needs to tutorialize that there's no timing involved here at all. You don't need to do it early or late, you just hold the stick left, flick it back right and flick it back left and Jacob dodges for you. This makes the combat very easy whenever there's only one enemy in front of you and pointlessly frustrating if an enemy happens to get behind you because you cannot turn around and face the other enemy, the stick no longer does that and the dodge only works if you're facing an enemy directly and you can only dodge one enemy at a time.  You can be hit like twice before you're dead and unlike dead space, healing is not possible while in combat. The game leans pretty heavily on this melee combat early on when you don't have the gravity gun or shotgun yet and it is strangely difficult to get a hang of, but once you've got it, the combat becomes quite absurdly simple. There's a perfect dodge if you actually try and time it, but there's like no reason to bother, there's just no reason to even bother doing it. Once you have a bunch of guns, the combat gets a little less annoying, but it's never very good because a ton of other choices make it needlessly sluggish, which means the game can never design enemies that are interesting to fight.  In Dead Space, you heal very quickly by pressing the X button. This means that the game can throw a bunch of enemies at you at once and can create a ton of interesting encounters with all different kinds of enemies.  It looks quite authentic, but you simply cannot do this in combat. Once you're destroying everything that even looks at you aside from the occasional odd difficulty spike, this doesn't matter anymore and you'll just throw all the injectors on the floor. But this also means, again, the game cannot push the combat any place interesting because you simply do not have the tools to deal with interesting difficulty like you do in Dead Space where you have the stasis thing and the telekinesis thing and like five different guns that all work better or worse on particular enemies. The weapon system here is another great example of the game trading realistic and impressive looking animations that are amazing in a trailer for interesting and exciting gameplay. Survival horror has a long history of making the controls a little bit slower than an action game so that the tension is ratcheted up. But the Callisto protocol takes these two painful extremes. For the first half of the game, you can switch between your two short guns. This is what that looks like. From the harder difficulty where ammo is fairly scarce, you sometimes need to switch between weapons but it is so needlessly clunky that it is frustrating.  The only reason that this isn't constantly killing you is because the Callisto protocol almost never throws more than two or three enemies at you at once.  The game is balanced not around what would be a fun combat encounter but rather what encounters will work with its excessive dedication to animation realism. This is the exact opposite of what a game should do. When the choice is a realistic animation or an animation that allows for fun, fluid and interesting gameplay, developers should ALWAYS choose the latter ALWAYS. This whole situation gets even worse near the end of the game when you finally have access to long guns. Once you have two long guns and three or four short guns, you can switch between these two relatively painlessly. It's still needlessly slow and cumbersome but at least works. But every couple of hours the game will throw an arena or boss fight at you that requires you to cycle through all of your guns as you drain each of ammo. And like everything else about the controls, switching between weapons is needlessly slow and clunky. Again man, games have figured out a ton of different ways to switch weapons. From weapon wheels that slow time a bit, to weapon wheels that don't slow time, to just simply using one button, often Y, to cycle through all of your weapons. But the Callisto protocol has its weapon switching mapped to the D-pad. So to switch from your long gun to your short gun, you push right on the D-pad and vice versa. That is annoying and clunky, but the real disaster is once you need to switch between your list of short guns and your list of long guns. To do this, you push right on the D-pad, then up or down on the D-pad to select the gun you want, then press A, and only then will Jacob slowly disassemble and reassemble the gun. If you press something else at any time during this, it will cancel and return to the empty gun in your hand. The only time this matters is the few boss fights or difficulty spike waves, but because it's mapped so oddly, you have to run away with a left stick while you bring your right hand over the top and cycle through stuff on the D-pad before bringing it back over to press A. Here is a simulation of how that looks. It's just a mess and insane that this was settled on as a decent solution. They could not figure out a better mapping solution than this? I happen to know for a fact that they could, because it's been done better by literally every single game ever from 1990 until December 4th of 2022. So I already mentioned that because the controls game is so slow and clunky that the enemy design itself is forced to suffer. You cannot push the player when you're forcing them to use a crab claw to switch weapons. Nowhere is this more evident than in the two-head boss that you fight not once, not twice, not thrice, but four times. In each fight, every attack is a one-hit kill, even at full health.  That and exactly and only that is literally the entire fight all four times.  The only reason this even qualifies as a boss fight is because the boss kills you in one hit. So basically you have to run, shoot, dodge, dodge, hit, hit, five or six times perfectly without being hit yourself. If your hand cramps from doing the claw, or you get stuck on a box, or the dodge strangely fails as it sometimes does for no discernible reason, well then you just have to do the whole thing over again. This boss fight is the perfect example of how the gameplay fails. It is boring and formulaic and leaves precisely zero freedom or improvisation for the player. The enemy has one attack.  And the reason the enemies and bosses are so boring and formulaic and always attack exactly the same every single time is because the entire control scheme allows for nothing else.  Once they decided it was more important to have these admittedly quite amazing animations than it was to fluid an interesting gameplay, the entire enemy and boss roster has to be designed not around what will feel good to play, but what will look good. Never has a game looked so much better in a trailer than it felt in your hands.  Story? Dead Space is one of the best games ever made because its art design and graphics were amazing. Its level design was excellent. Its enemy design was excellent and its combat was well above average for the time. And on top of all that, Dead Space had a pretty good story that was made even better by having a world that felt real and interesting. Dead Space's story was paced so well because there were several things going on at once. As you move around the Ishimura, you're learning about the world of Dead Space including what the society is like, what the government is like, what this unitology religion is. There is also the story of Isaac looking for his girlfriend. There's the story of what exactly is going on in the ship. There's the story of the marker. There's the tension between Kendra and Hammond and not knowing if Hammond is actually on your side. There's the story of Dr. Kynes and more. There are multiple other characters that show up throughout the game. Even though there are very few cutscenes, the game gives you a constant drip of information. Its audio and text logs are short and simple, but most of them move the story forward or explain the world in more depth. There are of course a few that are just little vignettes, but most of them serve an actual narrative purpose. When you combine that story with the occasional puzzle sections and the combat and exploration, the game is consistently engaging you with something new or interesting. It is not just walking, shimming through pipes and shooting. The Callisto protocol has very good voice acting, but the story itself is almost non-existent for the vast majority of the game. It's so bare bones that the first 10 hours can be described as follows. Guy is on a ship, ship crasses, he is put in a prison for some reason, he meets another guy for 5 or 10 seconds, he walks through a prison killing stuff. That is the entire story for the first 80% of the game. By the end of the game, the Callisto protocol has in fact begun to kind of try and tell a story, but it is paced so badly that it's one of the most meager stories I've ever seen in a narrative driven game. All of Duty games have significantly more substantial stories than the Callisto protocol does by a lot. Resident Evil has significantly more depth to its story and that is really saying something. How does the Callisto protocol story fail so badly when its production values and voice acting is so uniformly excellent? There are two main reasons. While the game has a plot that is perfectly serviceable, the background narrative in world building almost does not exist. The game has a pitifully small number of audio logs and almost zero text logs. And of that pitiful number, maybe four are relevant to actual world building or plot. That's not an exaggeration, seriously maybe four. And all of the rest of them basically boil down to a guy saying, oh no, I can hear them coming. No. No. Actually, multiple logs actually end with, no, don't believe me, watch.  And even those do precisely nothing to tell you anything more than you already know. You know that there are monsters. Compare this to the logs from Dead Space of the crew of the Ishimura or the officers. Which actually slowly reveals exactly what happened, who is responsible, who betrayed who, and you can walk around while listening to them. The logs in this game are the very bare minimum. They do nothing other than check a box. The plot of Dead Space worked so well because most of what Isaac is doing is fixing the ship to prevent everyone dying. While he's doing that, he's also trying to find Nicole or at least figure out what happened to her. Because all this happens, you learn that the marker causes hallucination and madness which lends the whole game a psychological horror vibe that gives everything some more weight and intrigue. In the Callisto protocol, Jacob isn't actually doing anything. He isn't trying to figure out anything, he's just trying to run away. He shows an almost amazing lack of curiosity about what the hell is happening. In fact, he manages to deal with the death of everyone and the appearance of flesh-eating monsters surprisingly well. He merely just seems mildly annoyed most of the time. Because the main character seems to have absolutely nothing to do with what's going on, there are no personal stakes involved. The entire game I was thinking, surely we're going to find out that Jacob is actually infected or that he's some super special descendant of someone who's immune. And maybe in a sequel, that will happen. But in this game, nothing happens and you learn nothing at all. The warden released monsters because he wants to make better humans for some reason. I guess monster humans. Jacob's entire relation to this fiasco is that he happens to literally be the delivery boy who brought the box to the outbreak. The game tries to make this like he has some deep personal responsibility. But as far as I can tell, his responsibility is that he didn't do a better job properly screening his cargo. At the end it tries to make Jacob sacrifice his life for the sin of not really caring what he delivered, I guess. It's pretty terrible. The characters in the Callisto Protocol do nothing and we learn nothing about them. The criminal who helps Jacob at the beginning seems like he could have been an interesting character, but the game makes precisely zero effort to tell you anything about him. What did he do? Who knows? Where is he from? Who knows? Does he have family? The girl, Danny, isn't a character so much as someone who bad things have happened to. Her entire character is that her sister died in the last outbreak and she was framed for it. The warden and doctor aren't even cliche characters, they're barely characters at all. What is the world of the Callisto Protocol like? Are things going well in the world or badly? Is humanity thriving or spiraling downward?  There were a ton of text logs about how robots are now more expensive than people so humans do all the dangerous underpaid work again because the government is corrupt and corporations run everything. I have literally no idea what the world of the Callisto Protocol is like beyond the fact that there's at least one prison in the universe, there's at least one guy named Jacob in the universe and people live on Europa. That's it. That's all I know. With the vast majority of the game you have exactly no idea what is going on before at the very end the game tries to tell its entire story in seriously like the last 15 minutes.  That's it. That's the big reveal. It's dreadful. The big reveal that you've figured out by 10 minutes into the game. It is a story about nothing with characters who do nothing and often say nothing. Worst of all, the game has the nerve to literally not even have an ending.  The big villain gets away.  The prison that was going to blow up suddenly doesn't and you literally end up right back in the prison after the entire game being only about getting out of the prison. So again, by the end, nothing you did mattered. Exactly nothing actually happened and you learned nothing at all beyond what you learned in the first 30 seconds of the game. There are monsters and the warden is a bad guy. 12 hours and the entire game is monsters and a bad guy warden. Wrapping up. So I have a ton of complaints about this game and there are even more. There's just a million little things that the game does wrong. For example, the prison is like torn to shreds. It looks like it's been destroyed by a nuclear bomb. Even though all of this disaster seems to have begun literally hours earlier? Like how did this place physically fall apart in a few hours? This works in dead space because it's been weeks, if not months, since the outbreak.  Why do I need to stand still in the menu to listen to audio logs? Are you serious, man? How did that get through development? How? Why are there no text logs? Why are there no personal objects anywhere? Why does Jacob fall down a hole like five times? Seriously, I guess absurd.  After the end, when he's walking around Danny, he falls in a hole and gets separated like three straight times in 30 minutes. It's absurd. Why is movement so clunky? Why isn't there a quick turn in a survival horror game? Why is there so little enemy variety? There's just dozens of little things like that on top of the major complaints I've already gone over. And here's the real tragedy.  It's definitely not worth 70 bucks, but the core of a good game is in there. The game is beautiful. The voice acting is excellent. The animations are amazing. The textures are as good as you'll ever see. The progression is pretty good. The game feels like a very, very good proof of concept. If it sells well enough, I can honestly see the Callisto protocol 2 being much, much better. The studio that made this game can definitely make a great game. Now that they have the technology figured out, if they spend the next few years making combat that's actually interesting and not just cool looking, and actually like map out a story where stuff happens and the world is explained to the player, they could definitely make a Callisto protocol 2 that lives up to the hype I felt about this game. But what's here now is all gloss and no substance. It's worth playing for like 40 bucks maybe, it's worth your time, but its flaws are so very frustrating, mainly because it's so obvious that it could have been done better. I've rarely played a game that frustrated me so much without actually being totally terrible. The Callisto protocol is fine, I guess, but the things that make it only fine instead of good are so baffling and odd that it's one of the strangest game designs I've played in a while. Alright, either Bayonetta 3 or God of War or Evil West is up next, I haven't decided which one. I'd say that Bayonetta 3, God of War, good, and Evil West, very good. Thanks for coming, I'll see you next time, bye.


Hi guys, so let's learn Mercy by Sean Mendez. The songs on D major, so that means you'll have these respective available chords. D major, G major and A major will be all your available major chords. Also written it down in the chord chart which you can have a look. So D major is the 1 major, G major is the 4 major and A major is the 5 major. And then you'll have the 3 minors which is E minor, F sharp minor, 3 minor and B minor. And of course the rarely used C sharp diminished which you may not want to use in a pop song. The chord progressions for the intro, the verse and the chorus are identical. It's the exact same chords and I'm also going to show you the voicing and the inversions for it. It's very important to notice to play the chords rather deep in the keyboard if you're playing it on the keyboard. And also later on in the song we observe a 3 3 2 rhythmic feel which I'll try to talk about. A lot of the pop songs these days seem to have that feel. So let's go through that as well. So the intro of the song what you do is you just hold these chords E minor, G major, B minor, A major. Pretty much just hold it and E minor I'm playing as E, G, B as I've written there. G major I'm playing as D, G, B. B minor is F sharp, B, D. A major is E, A, C sharp. That's pretty much how it is in the track. So it allows this entire higher region for the vocalist and the other orchestration the synths to take over. So you have E minor, G major, B minor. This pretty much works for the entire song. So one way to first practice is to hold these chords. The other option is to try and bring out that 3 3 2 feel where you can go 1 2 3 1 2 3 3. So what I'm doing here is I'm playing the E minor chord three times rather I'm playing every chord three times but I'm playing the remaining two hits rather softer. So you go E minor, E minor, E minor so that's 1 2 3 1 2 3 1 2 3 1 2 3 1 2 3 I'm also adding some notes in the left hand. So essentially you always play the root of the chord in the left hand that's E minor, G major, B minor with B, A major with A and you could double up the root with the octave here but this octave you could play it as a different rhythm. So I'm doing ta ta ta ta ta that's left right, left right and the left comes with the thumb octave. Keep the pinky sustained in the left hand. And so on. Whenever the song breaks down usually at the intro or the verse section you don't have to play the groove just hold it like that for four counts. It's quite a nice sound. 4 2 3 4 There's a bridge which happens once in the song which I've mapped out here. You have G, B minor, D and A okay. B minor, D major, A major, G major, na na na na na, D major and then you build up and there's a nice chord here where you play G major in the right hand and an E bass in the left hand. So that's G in the right hand and E bass in the left hand. So for two times you do G, B minor, D, A for another two times you do G with E bass, B minor, D and A. So let's see how it sounds and keep the same 3 3 2 time feel going 1 2 3 1 2 3 1 2 1 2 3 1 2 3 1 2 3 1 2 3 1 2 3 1 2 and so on. And now G with E bass. Build up, get a bit louder. We have a stop and back to the chords. That's pretty much the song. So there's intro, verse, chorus, same chords E minor, G, B minor, A. Then there's a bridge which we've written down and try to observe the 3 3 2 feel and the song has a lot of dynamics. So when it gets heavy with the drums and the tom drums, try to play it a bit heavier. So I've given you like a simpler pattern where you just hold the chord 2 3 4 1, try 3 4 1 2 3 and then I've given you a busier pattern where you observe the 3 3 2 feel, rhythm feel. 2 3 1 2 3 1 2 1 2 3 1 2 3 and so on. The 3 3 2 feel is a very popular rhythmic feel in music. We've done another lesson on it on YouTube. So we'll try and put that out in our description. So do check the description and watch that video as well. So it's a good insight into playing a lot of the modern pop songs which have this 3 3 2 accented phrasing going on which is sort of becoming a very viral trend these days. So I hope you found that tutorial useful and if you like the video, do subscribe to our channel, share it with all of your musician friends. Cheers.


So welcome to the second invited talk given by Dan Murchtyn. Dan is one of the few members of our community who does not do introduction. It's a great honor and pleasure that we prepared to have a talk here. So Dan has a PhD from UC Berkeley from 1905. He's a professor at the University of Illinois at Chicago and part-time also at the U.N. School. If I would start reading a CV, I would actually take most of his time so I will not do that. Just a few things you may know Dan from when he was a PhD student he's from the U.S. government about export controls. He also, in 2004, found close to hybrid unisecurity holes for the students in their class on this. He's the author of Q-mail, PGB and DNS. He's known for his work on factoring and PCC but I guess today we want to hear more about his mental cryptology. So Dan is a designer of probably 1905. He has self-sacrifice, a few cash, and he's also running together with Tanya and Etax. So I believe he's here. So please join me in welcoming Dan Brunchen. Alright, thanks for the introduction. Can I get a check? Is the microphone working? No, it has to be on the right side. It has to be on the other side. Okay, let's try it again. Okay, checking again. Is the microphone working? No. Okay, third time. Is it working? Alright, great. So thank you for the introduction. Thanks to the organizers for the invitation. I've decided to start out with some quotes about the relationship between cryptography and information security. I see cryptography as a critical part of information security, but let's see what some other people think. Let's say, for those of you who might not be able to read it from the back, the left side there has a bad guy saying, his laptop's encrypted. Let's build a million-dollar cluster to crack it. And then the other bad guy says, no good. It's 4096-bit RSA. And the first bad guy says, blast, our evil plan has foiled. Now this is labeled a crypto-nurse imagination. Now on the right side, it says what would actually happen. And there the bad guy says, drug it and hit it with this $5 wrench until he tells us the password. The other bad guy says, got it. Then there's another maybe similar quote from Greg and Guptman from 2011 saying, in the past 15 to 20 years, no one ever lost money to an attack on a properly designed crypto system. What is a properly designed crypto system? How does the user tell what they give a definition? They say it's one that doesn't use home-brew crypto or toy keys in the internet or commercial world. And I have another question from Shamir saying, crypto is usually bypassed. I'm not aware, Shamir says, of any major world-class security system employing cryptography in which the hackers penetrated the system by actually going through the crypt analysis. Now, I'm not quite sure what these quotes mean. I mean, first of all, it's clear from the XKCD that the bad guys are unable to break the crypto. But what about this Greg Guptman quote and what about this Shamir quote? Are they saying that the cryptography is actually infeasible to break? Or are they saying that, well, it's feasible to break the real world crypto, but the hackers have easier things to do. And that's certainly all of the quotes I've given have this theme of, yeah, there's easier things than going through the cryptography. Well, Shamir very clearly says this when the hackers penetrate the system, they're not actually going through the crypt analysis and saying, well, XK, it's amazing that a comic strip is more clear than other people commenting on internet security. Well, anyway, there's another possibility which is that what these people mean, mainly that cryptography is not the weak point, that the attackers are not breaking the cryptography, either because it's not feasible or because it's feasible to break, but there's easier attacks. Maybe they're just wrong about all of this. The real world cryptography is actually breakable and it's actually being broken along with lots of other things. And if we actually want to secure a system then we have to fix the crypto and fix all the other things that are going wrong. So it's not some strong point in security, it's actually one of many weak points in security that we have to fix. Well, to resolve this question let's look at some examples starting with flam. Now the target here is the Windows update system.  And Microsoft announced about a week after Flam was publicly discovered. Microsoft said, we recently became aware of a complex piece of targeted malware known as flam and immediately began examining the issue. A bunch of computers are broken into, it's an issue. We have discovered through our analysis so cleverly are that some components of the malware have been signed by certificates that allow software to appear as if it was produced by Microsoft. They broke our signature system. So Microsoft has a Windows update system where any Windows machine will accept updates to Windows if they're signed by Microsoft. And the attackers one of the main ways that Flam broke into computers, well the main way that Flam broke into computers was by forging a signature which appeared to come from Microsoft. And the targeted computers looked at that signature and said, oh yeah, that's VAL. Now this sounds like a PKC issue rather than an FSC issue until you look at how they forged signatures namely a chosen prefix attack. A chosen prefix collision attack against NB5. Mark Stevens has a nice tool where he will look at a colliding message.  And so he was able to look at the Flam message they signed Flam the Flam signature and say yes that is part of a chosen prefix collision attack which is not his optimized collision attack. It's something different, it's something entirely new and unknown. Now the concept of Duke here is a little interesting because if you look at another report from the crisis lab that was one of the first labs to find Flam and analyze what it was doing they said that they have, there's a bunch of machines around the internet where they have virus protection and so on but maybe people get through that virus protection the malware protection, Flam of course got through lots of projections and these machines will still keep logs of everything that they're doing and send the logs off to other sites for analysis later. So it's possible to go back and see what was on those machines historically and in particular one of those machines in its logs in 2007 had one of the critical Flam Flams. Now the conclusion from this lab was that Flam was probably already active in 2007 which was before the real damage of NB5 not just that there are collisions but you can use them for reforging certificates that was before that was known before it was established in the public cryptographic community and they think that Flam was perhaps active for even as long as 8 years. Now if you go back to 2007 again problems known with NB5 people were saying in the mid 90s NB5 was a bad function don't use it but people were still deploying NB5 in 2007 there wasn't this rush to get rid of it in 2007 so NB5 was not homebrew crypto it was something which was standardized widely used and nevertheless the attackers will get and apparently they thought that this was one of the easiest things for them to do they didn't bother with some other attack which would have been harder the crypto was the weak point and the system at least it was the point that the attackers decided to break. If you compare this to what Grig and Guttmann are saying they say things like crypto system failures, orders of magnitude below any other risk and this is obviously a little bit of an exaggeration nevertheless that's what they say the crypto is fine the crypto is strong we're done crypto is successful mission accomplished yay let's look at another example there was a nice talk about web yesterday I have just two slides here saying a little bit about the history I would give some credit to Borisov and Goldberg and Wagner who in 2001 this was a flurry of attack papers a few years after standardized my equivalent privacy turns out to have as you heard yesterday a 24 bit message number so you have this long term secret key which is 40 bits or 104 bits and then you put on a 24 bit message number to get your 64 or 128 that RC4 key and that message number is never supposed to repeat of course the 24 bit number is going to be very frequently repeating and when it does then all sorts of things go wrong with the crypto it's all your confidentiality you lose all your integrity so it's already a complete disaster just from having a 24 bit message number used for a long term key and then the user authentication fails and then Flurman's engineer started off the types of attacks that you heard about in the talk yesterday where because the long term key is concatenated with this message number and there's correlations between the key bytes the long term key bytes and the RC4 outputs which you can see when you vary the message number you end up seeing the key bytes from a bunch of RC4 outputs and then lots and lots of papers about this perhaps concluding with the paper from yesterday saying you can really optimize this attack to the point of getting the wet secret key from 120,000 packets so incredibly weak cryptographic system now some people look at this and say okay you're pointing to a bunch of academic papers and sure a weapon is still used in the real world and it's weak the academic papers do say that but come on who's actually being attacked well here's an example of somebody being attacked some attackers stole 45 million credit card numbers and a bunch of other personally identifiable information from an American company TJ Maxx by first of all breaking into the internal network which was protected with what? now a company in the US when there's people losing money or maybe gaming money and there's a whole subculture of other financial research companies which will look around and speculate about how much it's going to cost them and so Forrester Research said TJ Maxx is going to be losing something on the scale of a billion dollars from this which is maybe correct with all the consulting fees and cleanups the only documented damage I'm aware of is that they paid 40.9 million dollars to settle a lawsuit about exactly this theft so nobody loses any money well okay here's an example of somebody losing money because of broken crypto let's try another example key lock this is one of these brick brick systems for car doors and garage doors Wikipedia says here's a bunch of car companies which have deployed it there's a paper in 2007 in the state of Heller and the government and part per nail called how to steal cars and what this says is that the security of the cipher used here this key lock cipher it doesn't give you 64 bit 2 to the 64 security you can break it using only 2 to the 44.5 encryptions and 2 to the 16 known plaintiffs now when I see numbers like this then I start envisioning okay what does that mean 2 to the 44 computations I've got some idea how key lock works okay what does that computation mean and then how about the known plain text 2 to the 16 known plain text okay okay for those of you who don't know our session chair part per nail is a parking valet at a very fancy restaurant now rich people come to the restaurant and they give them their cars and their car keys temporarily of course he steals the car at that point with the car key then they know it's him and he gets fired and gets in trouble but if he can clone the key and then give back the car and then sell the cloned key on the black market and then a week or a month later the car gets stolen nobody knows it was him so he drops the car away he parks the car and now he's got a little radio receiver which receives the key lock and he also has a second job as a professor so he has a bunch of graduate students and he gives the key to the graduate student he says ok graduate student push this key as fast as you can ok if you push it I actually tried this at a reasonable speed that it takes about three hours extrapolating it takes about three hours to get two to the 16 pushes and then fancy restaurant hours for dinner, perfectly reasonable, and sometimes it takes a long time for them to give you the bill and for the ballet to bring your car back. And then, well, by listening to the radio signals and doing a little bit of computation, he ends up getting the remote key and then being able to build a close-up. Then there was a paper the next year from Eisenhardt and Kostler and the Ruddy and Parr and Thomas and Zadda and Shalmani saying that they have a much faster attack, where they can, from some distance, intercept the radio signals of pushing the button once or twice and then immediately build a clone of the key. Having done a lot of initial computation, get the manufacturer keys out of these systems. So it turns out that the receivers for these signals, inside cars, inside garage doors, from each of these companies, they all share a manufacturer key and the main work that was done here was actually extracting the manufacturer keys from interactions with those devices, the receiving devices. Now, some people say that these authors of the second paper were cheating because this was a side channel attack. They weren't just looking at the legitimate radio signals that were designed to be outputs of the system, they were looking at the power consumed by the system. Now, maybe Schumer would say that this was bypassing the cryptography. Maybe it's not an issue that cryptographers should worry about, that there's these side channel attacks. There should be some other people who are protecting us against side channel attacks. But maybe there are interactions between the cryptography and the side channel. Maybe we can change the decisions that we make and there's more and more evidence that there are different decisions we can make in designing cryptographic systems which make the side channel attacks harder or easier to carry out. Another question that I'll formulate about this attack. I don't have any examples here of press about news stories about people who are stealing cars using these attacks. So some people would look at this and say, hey, there's all these academic papers, yeah, it's theoretically weak, but no attackers would ever carry this out in practice. There's no evidence that anybody's actually breaking the key lock system. Now, okay, suppose you have two academic teams. They find an attack against key lock. The first thing, if an attacker finds a break against a widely deployed system like this, there is 100% chance they will call the New York Times or some equivalent organization. If a real attacker breaks a system, then what's the chance they're going to call the New York Times? They don't want anybody to know they're breaking the system. So let's say there's a 0% chance the real attacker is going to call the New York Times.  Now, what does this tell us about n? Some people think that this means they're no real attacks. I think this doesn't tell us anything. If the system is weak, then it is presumably being broken by real attackers, even if we don't have news stories. Let me give you another example. VMWareView. So this one is maybe not so well known. This is one of these corporate, you buy thousands of terminals from some company, you buy from, say, Dell, and these terminals are going to have little desktops where the desktop environment that your user is talking to is actually generated on a server. So you have some central image server, thousands of terminals, all using some protocol, VMWareView, to send the graphics from the central server to the users of the user can interact with the computer system. Now, if you look at the documentation from VMWare from Dell, then they say you're supposed to switch from AES 128 to Saucer 2256, whatever that is, for the best user experience. Now, okay, this is faster. The best user experience refers to there's some speed limit for the hardware here, something like five megabits per second of network graphics, which AES can successfully encrypt. And if you switch to something faster on that hardware, then you will get faster. The ethics of the users are happier. So they recommend that. And normally cryptographically, I would say that this is also a good thing to do that this is increasing your, well, key size, it's increasing your number of rounds of security margin. There's lots of reasons that this is a reasonable thing to do for speed and security. But let's look at the documentation. I'll run through this slowly. AES 128, according to the protocol documentation is AES 128 GCM. Saucer 2256, according to the documentation is Saucer 2256, round 12. Now, does anybody see the problem here? Authenticated encryption says the parking bell is okay. AES GCM is not just encryption, it's also authenticating your messages so they can't be forced. Now this Saucer 2256 with 12 rounds, maybe, I mean, it could include some authentication that they just aren't saying anything about, but I see no evidence that they are including any authentication. So as far as I know, I haven't actually tried buying one of these things and carrying out an attack. But as far as I know, I mean, if it's doing just what that would suggest, this is completely vulnerable to packet forgery, where AES GCM is not. So at least from all the available documentation about this, I would say even though switching from AES to Saucer 20, I'm generally happy with switching from AES with authentication to Saucer 20 without authentication, that's a really bad idea. The user doesn't need just encryption. The user needs encryption and authentication. There's tons and tons of examples like this where the cryptography is failing because it's barely even being deployed. The IPsec null authentication is one of the most common ways to deploy virtual private networks. You have a protocol which could have some authentication built in, but the user actually does no authentication. And then they get surprised when their packets get fortune. Okay, let's try another example. SSL. Now in SSL, there's lots of stages to it. I'll focus on the secret key part as to this entire talk. What SSL should be doing is nothing at all like this. But let's start with CBC, normal AES CBC encryption. So you have a bunch of plain text blocks, P0, P1, P2, say 16 bytes each, 48 byte message. You encrypt each block by applying AES to it where you add something to each block. So you add the previous ciphertext block C02, P1, and then feed that into AES, get C1, add that to P2, feed it through AES, get C2, and you send along C0, C1, C2. Now at the beginning, the first P0, there's no C sub minus 1. So what you're supposed to do is generate a random number, which could be, for example, you encrypt a nonce, but somehow you generate a random number, somehow make sure the other side knows your random number, send along that number or have them implicitly know the nonce. Somehow the other side knows B and you add that random V to P0. Okay, so that's AES CBC, standard AES CBC encryption. Now here's what SSL does. You take, well, very much the same thing, you take each ciphertext block, add to the next plain text block, and then feed it through AES to get the next ciphertext block, except it's very beginning. Instead of making a random number, SSL takes the last ciphertext block from the previous packet. So it sends a packet along C sub minus 3, C sub minus 2, C sub minus 1, and then it gets the next packet to send from the user, P0, P1, P2, and adds that previous last C sub minus 1, which was sent along in the previous packet, sends that, adds that to P0 and encrypts that. Now the problem here, the order of operations is very important that because the attacker can see this last plain text, sorry, last ciphertext before choosing this next plain text, the attacker can choose P0 as a function of C sub minus 1. In particular, it can choose P0 to be C sub minus 1 exclusive or something, where the something is, for example, allowing him to guess some previous plain text block. So this is none of the random collisions that you were hearing about in David Brunstock. This is the attacker can actively say, okay, I've got a guess for, say, P sub minus 3. And I'm going to take that guess exclusive work with C sub minus 4. So that's what was encrypted before. If the guess is correct, that's what was encrypted to get C sub minus 3. And then I'll X or C sub minus 1 and put that into P sub 0. So if the attacker is trying to guess some previous plain text and controls this next plain text, then he does this. If the guess is correct, then the AS encryption of P0 plus C minus 1, which is exactly what SSL sends through AS right here, gives C sub 0. That's exactly the same as P sub minus 3 plus C sub minus 4, which gets encrypted to get C sub minus 3. So the attacker simply compares C0 to C minus 3 and then sees that his guess is correct, or that it's not. Then he tries more guesses. As long as there's not much entropy in this piece of minus 3, the attacker quickly figures out what piece of minus 3 is. So complete failure of the encryption to actually detect the data. Greg Bard in 2006 said, OK, if you've got a browser running in an applet, maybe then it could carry out this attack. There's no clear obstacles to carrying out this attack. It should be able to repeatedly carry out guesses. And then this was actually implemented some years later by Duong and Rizzo. It's called the beast attack against browsers. Browser exploit against SSL-TLS. And this really does work. And it really does get a cookie out of the browser in something like two minutes. So browser vendors look at this attack and say, OK, what are we going to do? We'll send along before we, OK, we get this P0, P1, P2 from the user. And before we encrypt that, before we add P0 to something, we're going to insert another packet before that, where that other packet doesn't have any data. It just has a message authenticator, which I'll get to in a moment. Every packet has a message authenticator. So the browser sends an empty piece of data with a message authenticator, then sends P0, P1, P2, which includes a message authenticator. And because there's an extra message authenticator before the P0, that randomizes the ciphertext block that's used to add to the P0. So the packet that gets sent is committed to before the c sub minus 1 is generated. And that's enough to make things secure. It doesn't quite work because empty data actually breaks Internet Explorer. But what browsers do instead is they take one byte of the legitimate packet, send that along, then send all their naming bytes. And that's probably secure. And it's actually deployed today. Now the attacker, instead of controlling the plain text, to try controlling the ciphertext, sending along forged network packets. But that doesn't work, because like I just said, each packet includes an authenticator. Each SSL packet has a MAC, which is protecting it against forger. And the way that works is SSL takes the legitimate data, puts an authenticator on the end, and then CBC needs to have 16 times some number of bytes, has to have an even number of blocks. So SSL takes the authenticated data, puts some padding on it, and then encrypts with CBC. And that padding is something I put on 1, 1, 2, 2, 3, 3, is whatever you need to get to a full multiple of the AS boxes. OK. And this is, it's a little complicated, but you can look at it and prove, paper by a project in 2001 says, this is provably secure.  So this is a cool way to secure money in 2001. I think this was presented at the crypto rump session right before crumpchicks talk. Say, this is completely broken if you have a padding order. Well, if you can tell the difference between a padding failure on decryption and a MAC failure. So the receiver has to decrypt the CBC, check the padding, and then check the authenticator. And if there's a way to tell the difference, for example, different error messages for these different failures, then in almost no time the attacker can figure out any plain text, random type of text box that he wants. Now this, if in the statement was, as far as I know, first demonstrated to be correct by Kanvel in 2003 who said, you know, there is one of these padding or goals where, here, let's watch the time that the server takes receiving this data. If the padding is incorrect, then it's fast to reject that block. If the padding is correct, it has to compute it back, and that takes longer. So by watching the timing of the receiver of this SSL-encrypted data, you can get exactly the padding or goal you need for Vaude's attack to work. So what do browsers do? Well, they say, okay, okay, let's always compute the Mac so that there's no longer this timing difference between having a padding failure and having an authenticator failure. And then just a month ago, Alphard and Patterson in the Lucky 13 attack said, okay, we can still break it because there's still some very, very small timing differences between having the padding failing and having the authenticator fail. Okay, so what does SSL do about this? There's obvious reactions, like, okay, really try to control the timing, and this is hundreds and hundreds of lines of code, all sorts of bugs just to deal with the timing issues here, incredibly fragile system. But SSL-TLS has an alternative to this, which is called cryptographic agility. Now cryptographic agility is a marketing stunt which has two points. Maybe the second part first, cryptographic algorithm agility means that you have some button which says press in case of emergency and then you will switch to different crypto. Nobody's ever tried the button, whether it works doesn't matter because it's a marketing stunt. Then the other part of cryptographic algorithm agility is because you have that button saying push if the crypto is failing, emergency, because you have that button, you don't bother having good crypto.  So everything's just fine. Now, as an example of the button not working, there is ASGCM, which has all of its own timing problems, but at least it would get rid of the basic problems with CVC, SSL in theory can switch, TLS 1.2 can switch to ASGCM. But it doesn't work because if you try turning it on, you find that 90% of web servers and basically 100% of web browsers don't actually understand it. Okay, so what do you do instead? Well, there is one alternative to ASCBC or other CVC modes, which is supported by all of the clients, all the servers out there, and which you can just turn on and that you really do have. Here's the emergency backup plan. In case of failure of ASCBC, you switch to RC4. And more and more sites are in fact doing this. This is now more than 50% of SSL connections on the internet. And lots and lots of people are recommending switching to this because it's obviously much less fragile than ASCBC. There's even statements from Revest, which people keep quoting and saying that RC4 is okay in SSL. It's not as bad as web. Web takes a long-term key, puts on a sort of nonce and then uses that in RC4. SSL does not do that. SSL takes a whole public key setup and then does some reasonable hash to generate a one-time RC4 key and then when it's done with that, it never generates any related keys. Good, sensible. There's no reason to ask for related key attacks. And Revest says the attacks against web don't apply to SSL with RC4. Designers of applications using RC4 should not be concerned. However, some of the problems with RC4 are a reason for concern. There's all these biases in RC4 output bytes. And at this point, I'd like to advertise something I've been doing very recently with Alphard and Patterson and Shulk which is called on the security of RC4 and TLS. Which is at the highest level saying, okay, you can actually do very much what Beast does where instead of targeting AES encrypting a cookie with CVC, you target RC4 encrypting a cookie. And then have, well, the same cookie or password or whatever sent through a lot of RC4 sessions the same way that Beast does and then use the biases in RC4 in order to figure out what the cookie is from all of these ciphertext bytes. Now, what are these biases? Well, those of you who were paying attention yesterday heard about some of what I'll say here. First of all, the best known one is that the second byte of RC4 output is biased towards zero. Has a probability of two over 256 and being zero instead of one over 256 that you would expect. That's not an issue here. And then Miranov looked at Z1 and found that Z1 is biased away from zero away from one towards two. And it's a totally weird distribution of the first output of RC4. And then much more recently, my Charlie Paul and Senhupta observed that Z3 and Z4 and so on through Z255 all have more than one over 256 chance of being zero which is contrary to something that Mantin and Cheney were claiming that they were exactly balanced all those other Z-survives. And then the key length dependent bias for people who were paying attention yesterday on Z sub 16, the 16th output byte is biased towards minus 16, assuming your key length is 16 bytes, 128 bits. Okay, that's not nearly the end of it. So here's what, with my co-authors, the conclusions are. There are 256 squared biases in the first 256 bytes of RC4 output, almost 256 squared. So we computed for every position, one through 256, and for every possibility for the i-output byte, what is the chance that the i-output byte of RC4 is zero, is one, is two, et cetera. And basically none of those probabilities are one over 256. Now, as a result of that, you can use all of these biases doing sensible statistics to attack SSL. The paper from yesterday was a little earlier, and certainly independent, but I think it was also, the results were found a little earlier than ours. We're seeing some of the bigger biases, which I've listed here. I'm gonna show you some pictures of what the actual probabilities look like. First of all, here's the first output byte, which again, from near enough, was already known to be a very strange distribution. So what the graph means, taking for example here, at 129, the value of this graph is 0.993. That means the probability of the first output byte from RC4 being 129 is 0.993 divided by 256. It should be one over 256. It should be a flat line, but no, RC4 is biased against 129, against 0, and towards some bytes here, away from other bytes. And you see there's some fuzziness here. This is actual biases, plus and minus. I mean, there's every 16 values of the byte value, X, there really is a spike up or down, as you see in this graph. There's also, if you look at Merinov's data about this, for some reason, the very negative spike here didn't appear. These initial values, the initial output bytes of RC4 are not too useful in attacking SSL, because the first few bytes are used to basically encrypt random data. But let's look at some follow up bytes. Well, Z2 is still not in the useful range, but just to indicate the graph that Mountaine-Chevier bias says the probability of Z2 being 0 is up at two over 256, so way off the graph. But then there's also all these other spikes up and down that you see. And lots of little fuzziness that you see in a general upwards tilt. And then moving on to Z3, well, the big things you notice are, well, there's a bias towards zero, there's a bias towards three, that's one of the things that we saw in this paper from yesterday. There's this bias towards 131. And then also, if you look closer, you can see some little bumps up and down, even without zooming in on the PDF here, you can see, for instance, maybe this bump down. If we move along in some bytes, you can see now that bump is up and then down and up and down and up and down, just the little bite there, along with some biases towards other positions. Well, it goes on for a while, eventually you see the key length-dependent biases, like here's this bias towards minus 16. And this is starting to get into the range where you can use this to attack SSL. We keep going like this. So, for instance, here's Z33. Oh, I should have emphasized that I get Z31, there's this funny fuzziness to it. What a weird cycle. Z33, as an example, there's these two big biases towards zero towards 33. Now, suppose you're looking at a bunch of ciphertexts, which are encrypting the same plaintext by that position. And you see that the most common ciphertext bite is, say, one. Now, that could be that the plaintext bite was one, exclusive or was zero. Or it could be that it was one exclusive or 33, which would be 32. How do you tell the difference between that? Well, if all you know is those two spikes, then that's the best you can do. But if you see the whole distribution, and you think what is this whole distribution, XORed with 33. And that totally changes the shape of this curve, makes a huge difference if you XOR it with something. So you can get a lot more information from seeing the entire graph than just what you get from seeing the big spikes in the graph. And it goes on like this for a while. You get home, maybe you can see things like, under the mouse, there's this little button, which is jumping along by 16. But enough admiring graphs, you can go back to slides online afterwards. And eventually, it seems like the bias is kind of smoothed out as you get to bite 150, 200. So eventually, the bias, like the bias bite 221, bias towards zero, bias towards 221, but it's more bias towards 222, 223, and so on. Then this tilt upward is very, very effective. And then eventually, you get to bite 255, and you start feeling like, at this point, it's almost a reasonable sight. You've got this bias towards zero, maybe we can deal with that somehow. It's maybe got a slight tilt up in town, but it almost looks kind of flat. And then you get to the next bite, and it's tilted. Okay, so we applied this to actually attacking as a cell situation of having a lot of plaintext being repeated in a lot of ciphertext. And then here's the probabilities we get, for example, from two to the 24 ciphertext with arbitrary plaintext data. There was a similar graph drawn yesterday where instead of, say, the 30% probability you see at the beginning bites here, it was about a 10% probability. So there's a big advantage to taking all the biases into account and doing the statistics properly. And then if you have more ciphertext, you're gonna have to say two to the 28 ciphertext, and then in the interesting region for SSL, you get complete plaintext recovery. So why do we have all of these breakable cryptographic examples? Well, you could say it's because the people who are implementing cryptographic protocols haven't gotten the memo. In many of these cases, they were doing the implementations years before AES, so maybe they shouldn't be blamed, but at this point, we just have to educate them, right? We just have to explain to them there's AES, and AES does not have these problems. Well, maybe side-general problems, but we also know ways to defend AES against side-general attacks. We have AESGCI, and that's got the authentication. It's maybe the words AES GCM, maybe that doesn't express to your average user, this includes authentication and you need authentication, but somehow we can educate them that AES GCM is what they need, authenticated encryption. And then again, we can protect the whole AES GCM, everything you need in secret key crypto, we can protect that against side-general attacks. So we just have to explain this to people doing crypto. Except maybe AES GCM is not actually what they need. Maybe AES GCM is kind of meeting some of the user requirements, but not meeting others. And the most obvious requirement that it's not meeting, especially with side-general protection, but sometimes even without, is performance. The users have some performance requirements. Here are all quotes of random examples, revessed again from 2001. The heart of RC4 is its exceptionally simple and extremely efficient pseudo-random generator. RC4 is likely to remain the algorithm of choice for many applications and embedded systems. And that's correct, RC4 has remained the algorithm of choice for many applications and embedded systems, in part because of the speed. You can find Adam Langley from Google online only a few years ago, something like two years ago, saying, here's the advantages of RC4. Here's why we prefer RC4 to Google. Number one, it's fast. Number two, CBC has bad history and it goes on to other reasons, but it's fast. Everybody knows that RC4 on a lot of platforms is fast. On a typical arm chip, it's twice as fast as AES. And so it's something which people like because of the speed. If people need that kind of speed, AES is not an option. Another example, OpenSSL in AES for extra speed is not doing what they should be doing for side channel protection. So OpenSSL is leaking a bunch of key bits to side channel attacks. For instance, in this financial crypto paper, 2012, from Lysen, Haydn, Stuck. OpenSSL is leaking something like half of the AES key bits to a very straightforward side channel attack because they're not doing what they should be doing in the implementations. Why aren't they doing it? Well, you look through the thousands of lines of comments in the AES implementation in OpenSSL, and they say it's because of the speed. They want better speed than they can get from a side channel protected implementation. Another example here different from speed is the size. If you have a small chip, very low cost chip, or a chip which has to do more than just the crypto and fit into low cost, that for instance RFID applications, you really need a small Cypher, lightweight crypto having a Cypher that fits into a small area and then maybe it also still needs to be fast. It's an incredible challenge. And the users can't just throw away these requirements. They really want the crypto to be fast. They need the crypto to be fast. And how do we give it to them? Well, there's all sorts of work on trying to make this happen. And I think this is one of the critical directions of continued research into security crypto is trying to do things which are better than what we have now in particular better than say AES GCM, where you don't have to reduce the security level to improve performance. AES has this huge 8-bit S-Box where it's taking 8 bits of data and then scrambling them, scrambling them, scrambling them and then taking this huge hardware server, a huge amount of energy just to totally mangle 8 bits of data. And that's overkill. There's lots and lots of Cypher's that do better than AES in all sorts of performance measures by not doing that overkill by having smaller S-Boxes than AES does. There's all sorts of fundamental constraints on what the users want, like they want the power to be smaller, there's some limit on how much power they can feed into the cryptographic circuits and they can't do an incredible amount in parallel. There's often limits on area. There's often limits on latency. You'd have a time that you can spend until you, maybe microseconds instead of seconds, but some limit on the time until you get your encrypted, authenticated data. Maybe what attracts the most attention is the throughput, the speed, the number of bytes per second, which you really should turn around into area times the amount of time to the byte, because otherwise somebody can always increase the bytes per second by doing two parallel encryption units. And then they get twice the area and half the seconds per byte. Well, to not be trivially allowing the throughput to go through the roof, you should be multiplying the area times the time. And then similarly, you can optimize the energy, the battery life of your cryptographic algorithms, which is basically optimize the number of bit operations you need to do crypto. Except if you're doing lots of big random access to big tables, that consumes a huge amount of energy. Also makes the area time a little bit. There's lots and lots of platforms for doing that. And of course, just to briefly summarize a lot of the research, and this would be a whole hour talk of all the different ways that people have been improving the performance of authentication and encryption, improving the performance of secretly crypto. There's, of course, lots of different application environments where maybe you have long plain takes, maybe you have short plain takes, maybe you actually want to encrypt five-byte plain takes all the time. And you save time by only having five bytes of encryption instead of 16 bytes of encryption. Tons and tons of optimization work and design work to make secretly crypto meet the user's performance requirements. One of the questions that I find most interesting is whether there's a way for one design to meet lots and lots of application requirements, to be good in particular for hardware and for software. I think a lot of people say, oh, hardware optimization of ciphers looks like this, software optimization looks like that, and you really can't do both at the same time. But there's some great examples of ciphers which are optimized for hardware, but they're still pretty good in software. Trivium, Ketchak. These are, well, Ketchak used in, say, an authenticated encryption mode, like the duplex. These are ciphers which are designed for hardware, designed to be really, really good in hardware. And they aren't really, really good in hardware. But they actually also provide pretty good software performance. So you can try to start from ideas like that, see what makes them work well in both of these environments and try to do even better. Or you can say, let's start from the software designs and see what's making them not so good maybe in hardware. So one suggestion here is to replace ARX and Rotate XOR with ORX or Rotate XOR. Now, if you remember the SCAME mix from earlier today, you can't do that with OR because OR doesn't give you the invertibility for a SCAME mix. But you can do, say, the basic operation in salsa 20, where you take two state variables, you, instead of adding them together, you OR them together, you rotate by some fixed amount, and then you XOR that into another state variable. And that's invertible. And, well, it's not as much diffusion across bits as addition, but it's still okay.  You can build any function out of this if you want. You probably need a few more rounds for good diffusion than what you get from an ARX design. But hardware people are gonna be much, much happier with ORs than they are with additions. Additions are these huge carry chains. Hardware people are constantly complaining that doing an ORX design should be much, much better for hardware. I say it without having actually tried. Something else you can do, which I've seen lots of papers on, and I think it's one of the most important directions. It's not something where it's maybe motivated by current problems in cryptography, but we're clearly gonna have more problems along these lines of the future of our security not being good. And there's one thing to say, okay, we've got something secure, like ASGCM, it's not fast enough. Let's make something that security level that's fast. But how about when people get to the security level of ASGCM and say that's not as secure as we need? For instance, the 128-bit block size starts breaking down horribly once you've encrypted two to the 64 blocks. Even two to the 60s start getting failures. Some modes, two to the 40, start getting failures. That's not that many blocks to encrypt. So maybe we should have some of these birthday, beyond the birthday downs modes where we don't worry about two to the 64, we can encrypt much more. Or maybe we should have instead of 128-bit blocks, maybe we should have 192 or 256-bit blocks. Now, another direction of smallness in our current ciphers, authenticated ciphers, like ASGCM, the authentication, I guess there'll be a talk, well, the very next talk today is exactly about what security do we get out of the authentication in ASGCM? And there's a 128-bit key pipe inside GCM, which is really starting to feel uncomfortable. And some people would say for these kinds of issues, oh, the problem with having a 128-bit block with, say, counter mode, which breaks down with the birthday bound, some people would say the problem is counter mode and use a better mode. Some people would say use a bigger block. Same thing here, with a 128-bit pipe, you're gonna have some people saying, well, your mode is not making the most effective use of that pipe as you can change your mode so that it's safer. And some people would say, your pipe should be here. Can you do that efficiently? For instance, something I haven't seen people looking at, there's all these optimizations of 128-bit universal hash from just polynomial hashes. Has anybody looked at 192-bit, 256-bit? I don't think 256-bit should be twice as soft. I think it should be maybe 20%, 30% slower. But I haven't seen anybody try it and I think it would be a really cool thing to have for bigger, more secure design. Maybe the extra security issue that's attracted the most attention is misuse resistance. So instead of insisting that the message number would be a notch that somebody only used that number once, how about allow the message number to be repeated? Now, of course, if somebody has two different messages, M&M Prime, they encrypt them with the same message number, they're going to get different ciphertexts if they were different messages or if they were the same message, they'll get the same ciphertext. So there is a leak to the attacker if the message number is repeated. I mean, the message number repetition leads to the message repetition. But users get surprised if the message number repetition is making the authentication fail, for example, or leaking the XOR's messages or leaking much more information. So one proposal for dealing with this is to do authenticate then encrypt. And if you're careful about the details, this is the SIV mode from Robert and Trenton. What they say is you take your whole message number and message, you authenticate that with something, it has to be a little strawberry than just an authenticator, but do some appropriate thing to look through the whole knots and message, well, message number and message, and then use that result as if it were a knot. So that's something which would be a knot if the N changed or if M changed. And then use that to encrypt and counternote the whole message. Now, this should, well, you can prove if you do the details, right? This will protect against all of these message number repetition attacks except full-linking does the message repeat. But it also comes at some performance cost, which I think is maybe not primarily the cost of looking through the message twice, but what worries me the most is if you're in a denial of service situation, somebody's giving you lots of forged messages, then can you throw those forgeries away? If you have encrypt then authenticate, then if you get a forgery, you just check the authenticator, throw the message away. And that's cheaper than doing an encryption, a decryption of the message. Can you do something like this where you get protection against the message and over being reused and the forgeries are still fast to throw away? Another direction people have looked at is having integrated authentication, like OCD mode or Helix or Felix. I don't know whether having message authentication so you have these designs have some state where a plaintext block comes in, the state encrypts the plaintext block into ciphertext in an invertible way, and that plaintext block modifies the state for the next block. Now, can you do that in a way that's still secure if your message numbers are repeated? Obviously the data flow has to change, but can you do this efficiently and have some very fast, lightweight, have some good performance integrated authenticated encryption mechanism, whether it's some mode like OCD or something designed all at once like Helix or Felix, can you do that in a way that's not broken by the message number being repeated? Had you do it in a way that allows forgeries to be rejected quickly? I don't know. Maybe there's a good way to do this. One possibility would be, this is not really satisfactorily answering things, but something you could try is to have a block site for four round flight spell, HFFH, HFFH means you do a lightweight hash at the top, lightweight hash or lightweight, a very efficient, say a polynomial hash at the top, polynomial hash at the bottom, and put all your strength, all your defense in the middle two rounds, the FF rounds. The only job with the H's is to make sure that there's no internal collisions inside the input to the second round and working backwards the input to the third round. Now, if you have an HFFH block cipher, then that top gauge looks very much like what people want to do for authentication. Authentication, those people do some very simple transformation of each block and then, say, add up the results and then encrypt that one sum to get an authenticator. And so the top level of a sensible encryption mechanism looks very much like what you want to do for an authenticator or for what you want to do for this SID mode. You can also use the last stage and use the last stage for authentication. And I think you can get both of these requirements if you want to have your authenticator being, say, 256 bits instead of 128 bits. But that's quite a bandwidth limitation. So I don't think this is a really satisfactory solution. But this is just one of lots of directions that people have been trying things like this and people have been making lots of obvious improvements and performance and security over ASGCM. So just to summarize, ASGCM is obviously not satisfactory for all the users. It's something where the performance could be better, the security could be better. And if we don't worry about the security now, we're going to get people who eventually can get something with OK security and good enough performance and then they're going to get broken by the next round of attacks. Well, we've already seen those reviews attacks. You could have, if you like building modes and you want to do something better than ASGCM, you can certainly make a better mode than ASGCM even if you still use AS and still use GMAT. You can also make a better rack than ASGCM, something that's much faster in software, easier to protect against side channel attacks or even faster and harder. You can make better ciphers. AS, again, is certainly not the best that we can do. It was okay for the 90s, but hey, we know a lot more now about cipher design. Or you can put everything together, make a big integrated, preferably small integrated, lightweight, authenticated encryption system. If you're interested in any of these things, then some of you have heard, in case any of you have not heard, there is a Caesar competition coming up. So this stands for competition for authenticated encryption, security, applicability, and robustness. The main webpage for this is competitions.cr.yp.to, and then you see on the left side things like Caesar, if you can really ask questions and stuff like that. There's a mailing list for it. This is the main place for public discussions of what are the requirements and what are the decisions. If anybody from industry has some ideas of, okay, here's what I would like to see for authentication and encryption doing better for us, then this is the right place to tell people about it and say, please, please give us a better cipher. We're not happy with AESQCM, and here's why you can do better for us. NIST has burned themselves out on competitions for the moment, but they have been nice enough to provide some funding. So there's a cryptographic competitions grant, which is making sure that there's things like workshops and software benchmarking and such all going to be handled. Of course, this is not an infinite amount of money, so people want to scrape off more funding to keep this running nicely than that's, of course, appreciated and happy to chat with people about how to get funding for authenticated encryption generally and for this competition in particular. Let me finish off with just briefly showing you, I'll skip past a review of the older schedules and just say the most critical date for the moment if you're interested in designing a new authenticated cipher, so authenticated encryption system. The deadline for submissions will be the middle of January, 2014, and then a month after that, you should have the software done. And then the round two candidates will be at the end of 2014 and round three at the end of 2015 and so on through the end of 2017. Last slide that I have, workshops. We've already had a 2012 eCrypt-funded workshop on directions and authenticated ciphers. The outcome, and there's going to be, well, thanks to this NIST grant, there's going to be forthcoming workshops. Unfortunately, NIST money can only be used for the U.S., but hey, if you're scared about more money, you can have workshops outside of the U.S. as well. DIAP 2013, we're looking at Chicago either before SAC CryptoChev's or right after SAC CryptoChev's and people have any scheduling requirements. Now's a great moment to say that and then there's already been some volunteering for running DIAP 2014 in California close to crypto and then 15, 16, 17, well, there's the funding, just don't know yet where those will be going. All right, so if you're interested in authentication and encryption, then Caesar's great moment for you to show off what you can do and then starting in January 2014, that'll be a great moment for you to start breaking everybody else's submissions to this. That's it, thank you for your attention. Quick questions for Dan? Yeah, so the comment was that the Z1 distribution, which I will get back to you any moment now, there's also some fun things happening here. Yeah, so the Z1 distribution, if you look at that journal of cryptology paper from Sindhupta and Mitra and Paul and Sarkar and then you will see a theoretical curve which goes down and up and up and down and is sort of like the actual curve shown here. It does not explain the positioning of the curves.  It does explain it up and down. It doesn't explain how far down it's going, how far up it's going. It doesn't explain this spike, doesn't explain any of these little spikes. So it's certainly a big step forward understanding where some of you, the facts are coming from. But there's also a huge amount of RC4 biases which are totally unexplained by the theory so far. And yeah, for people who are interested in RC4, RC4 has been, of course, studied by more pretendless than AES, more papers than AES. Some people would say this means it's more secure than AES. If you like doing that stuff, then understanding what's going on in this graph, and in this graph, and in this graph, I'm sure there's some students who need to understand why RC4 is producing these distribution. Okay, thank you very much, and we're very pleased to talk. Thank you.


Now for some sports news, Tottenham striker Harry Kane has been crowned Premier League player of the year at the London Football Awards. The England international beat-off competition from team mate Hyun Min-San, Western duo Declan Rice and Thomas Susek and Chelsea's Mason Mount to win the award after scoring an impressive 21 goals and 13 assists in the league this season. With five matches remaining, the England captain is leading the race for the Golden boot with 21 goals and has the most assists in the top flight with 13. If he maintains both leads, he would be the first player to be, to be, to rather to complete the double in the Premier League era.