to that way too much because this would take another talk which would span multiple hours. There is a lot of research going on in the metal stability field, but in case you are entering the FPGA technology, you don't have to worry about that. The FPGA tools will take care of not doing anything very funny at least at the beginning. Alright, so another property of FPGA is implicit parallelism. So I was saying that the FPGA is field-programmable gate arrays, so arrayed of gates. The FPGA is a highly parallel chip. All of the logic elements are running in parallel, right? And in case you use the HDLs, I'll get to that soon, they look considerably similar to programming languages, but they don't behave that way. And this is where a lot of people who are entering the FPGA fields kind of start pulling their hair, it's getting really crazy. So in case you implemented this first snippet, first example in C for example, you would have two variables, right? And if your compiler was not optimizing at all, if it was just spitting a sampli, then what it would do? It would check the first variable, if it's 1, then it would do assignment, right? And then it would probably check the variable again and do the assignment again. If you observed what's going on there and tried it for both values of the variable, you would see that it's assigned a different time, this bar variable, in case it really wasn't optimized at all. Now, in case of the FPGA, this entire statement, both of the lines are executed in parallel, so the FPGA is testing both 1, 0 in parallel and then based on that doing the assignment. Because this is synthesized as an actual knot in the logic element. The other example is even better and even more confusing. Now, both of the assignments happens in parallel because they are synthesized in two different logic elements and in case you swap these two lines, it would have exactly no impact on the design. It would be synthesized into exactly the same thing because this just runs in parallel. Do you have any questions about this crazy stuff? Yes? One, yeah, I should be 0 and one, which one? I can't part of the symptoms sort of go with it, so can you read what it, what do you mean the apostrophe? Oh, I mean the apostrophe, this one. So this is kind of, yeah, the question is what does the apostrophe mean? So this is kind of like Vitalog, but not really Vitalog, which is one of the HDLs. I didn't want to get into the details that much in here. So the apostrophe means that the one says it's a vector which is wide exactly one bit or one signal. The apostrophe is just a delimiter and the B means it's binary. And in case we actually spoke about Vitalog then this is a blocking assignment here and this would be a register. So this would be a signal most likely and this would be a register which is then assigned a value. Any other questions? Because this is really important, the implicit parallelism of FPGAs is really important, you should keep that in mind. No, okay, so moving on, let's talk about FPGA tools. So FPGA tools are kind of in a sad state, the FPGA vendors are doing a lot of work in there in that area and they are trying to keep all these algorithms, they use closed source, so the tools are unfortunately closed source. Each vendor has their own specific tools. Also the bitstream format which is the programming file for the FPGA is unfortunately closed source. Now this is not entirely true, there are projects which are trying to open source this kind of stuff by means of reverse engineering but the FPGA vendors are not very happy about open sourcing their own algorithms for obvious reasons because they are spending billions on actually developing them and they don't want other people to use them. Now the standard vendor tools are actually available free of charge and they are not that limited so you can download them. It is really a big bulk of software and in case you are entering the FPGA field again with some sort of smaller FPGA then the standard free tools are not that big of a problem. The free tools are actually missing stuff like incremental compilation but that's only for FPGAs which are really big. In case you use a small design and small FPGA it takes minutes to compile so that's not a problem. You have all the verification and simulation tools there for the small FPGA, it's also not a problem. Let's see what is missing, yeah, that should be about it. You can implement your data cruncher and try it out, see how it works for you with the free tools, pretty much not a problem and in case you are getting a small FPGA we are talking like 100 bucks bulk arc so this is kind of fine. Once you install the tool, let's talk about the flow a little. So you generate your design, you pretty much write it, some sort of hardware design, you put it into the vendor tools. So what happens then when you want to generate the programming file? First of all you run analysis and synthesis, at that point the vendor tools parse the textual representation of your design and generate some sort of net list from that and then they check connectivity, they check if your net list is actually valid circuit or not and spit out pretty much some sort of high level net list. It contains gates and all but it's not possible to put this net list onto an actual physical FPGA, it's kind of something which you put on a virtual circuit. Now after that you do place and route and this is the first stage which knows for which FPGAs you are synthesizing and it knows the actual physical properties of your FPGA. So it takes this high level net list and generates a net list which is compatible with your FPGA. It can do register merges, it can throw away some pieces of the circuit because it doesn't make sense on that FPGA and so on. This is also the most gruesome part for CPU. It really stresses the CPU because it's really, I mean it's NP complete problem so it has to do all sorts of heuristics at that point and it takes a long time. Now the result of this is actually net list which can be mapped on your FPGA but it's not a programming file. For that you need an assembler which reads the net list again and generates the finally the binary file which you can program into your FPGA so to say. There is a bit of more magic involved but let's not get into that. The net list which comes out of place and route also can be used for timing analysis so you go through that. You figure out whether, well timing analysis tells you which signal paths are the longest in the FPGA and from that you can infer how fast your design can go. So timing analysis is something you want to do with your design and in case timing analysis tells you well your design cannot run at 100 MHz it can run at 50 then you should run at 50. If you don't, if you try to stress your design over what the timing analysis tells you is the maximum speed of your design then your design will likely not work or it will misbehave or it will just give you wrong results. Now speaking of the flow here the analysis and synthesis can be done with open source tools like Icarus, GHDL and so on. The place and the route can also be done using open source tools surprisingly. There's a lot of academic research going on in that. One of the tools is Versatile Place and the Route made at University of Toronto I believe so VBR this is what you want to check and the only really hard closed source part is the assembler but like I mentioned before there are some projects which are trying to change that. Like for example Project Ice Storm this is for the latest FPGAs but unfortunately only for the small ones. Okay so how do you implement your actual hardware model on the FPGA? This is like, this is it. FPGA, to implement hardware model on the FPGA you use HDL, hardware description language it's a textual representation of your hardware model. There are two mostly used HDLs, Veralog and VHDL. I'll show you examples of both. The vendor tools allow mixing these two so it's not a problem to have one file on Veralog and the other in VHDL. Of course it might be a little problematic for the hardware guys but it's not a problem mixing these two. Now at this point it makes sense to point out that there's a project which is called OpenCourse. If you are searching for readily available hardware models on the sensible license then check it out. They have everything ranging from simple communication controllers like serials, port stuff, all the way to PCI Express, USB 3, this sort of stuff. They also have cryptographic implementations of pretty much everything you can think of. It's likely at OpenCourse. They have CPU implementations pretty much. Everything is there. Another thing is set an open hardware repository. This is mostly tools which make your life with FPGAs a little easier. When you are working with the OpenCourse course you will find some nice tools at the set an open hardware repository to deal with that. I want to stress out one thing. When you are modeling hardware for an FPGA you cannot think about it like writing a computer code. This is a very nice slide. I believe I really like that. In case you are working with CPU you have this universal machine, universal hardware which can execute instructions and you are working on top of that. You are writing those instructions through your algorithm using this universal machine. In case you are modeling FPGA content to implement some sort of algorithm you are not working at this high level. You are working much lower. You are implementing a kind of a CPU so to say which can only run one algorithm. You can throw away all this unnecessary stuff which you have in a general purpose CPU. You are just implementing a really simple kind of design which runs one algorithm really well. That way you are throwing away complexity. You don't have to implement that many gates in your design and your hardware becomes simple. It can become faster. It can become much more efficient in terms of energy consumption but it won't run any other algorithms which I believe is fine if you just want to run one thing. I would like to show you CRC5 which is awesome when you implement it in hardware. It's designed to actually be implemented in hardware. In case you are doing Ethernet you are doing CRC32 I believe and it's just very similar. This is a schematic of CRC5 unit with polynomial x to the power of 5, 2 and 0. It's actually really simple. You have a code input here which synchronizes the entire circuitry. Then you have one bit data input here and you are getting CRC5 CRC bits in each tick of the clock at the top signals here.  This is the way you implement CRC. In case you are wondering about the polynomial, the power of 2 to 0 and the power of 2 actually denotes these sort of gates over here. If you want to implement it in FPGA, the snippet of a Veriloc code which I will show you now is what implements that circuit. I picked it from ASIC World which is a great website in case you want to learn Veriloc. There is a lot of examples, lots of beginner kind of things which you can read about Veriloc. It's a great website. Just like I had in the schematic I am implementing a Veriloc module which is like the building block in the HDL. I have clock input, I have one data input and I have a 5 bit CRC output. I also have a reset. That's a really good idea to have a reset of your module. Now the main meat of it looks like that in Veriloc. In case I have a post divided clock, I am checking the reset. So my reset is actually synchronized to the clock. In case I have reset, then I just set the CRC to 0. In case I don't have a reset, then I am doing the actual CRC computation. The check for a reset and execution of the subsequent computation again happens in parallel. So let's see, about the CRC computation, there is a trick that here this stuff on the right side is actually done using a combinatorial logic. So pretty much everything is pre-computed and when the clock edge comes and the reset is not asserted, then it's just this latching which happens at that point. So no real computation happens here as in the traditional sense that it would be doing like the data crunching. Also if you look at this, all of this stuff happens in parallel, it would not make any sense if this was implemented in C, right? In case you have some questions about the Veriloc, some more detailed questions, I will be running it on the conference so please just catch me and we can talk about that. VHDL syntax is based on Ada language and other than that, essentially the implementation is the same thing, Veriloc, sorry, VHDL has a little better typing system, so Veriloc just gives you an array of bits or arrays of signals, VHDL gives you some sort of a little better control on that, but other than that I have an entity which has, again, data input, reset and clock input and then the CRC output and now I'm doing the CRC computation here in case I have resets and currents to clock, oh yeah, right. Then I am resetting it to once, unlike in the previous design, sorry about that, and in case I don't have a reset and I'm just clocking out the CRC. Now, Hdls are not really friendly, right? It looks weird and it's just kind of like doing assembly and writing a kernel in assembly, no. That's why there is a lot of attempts to actually fix that and there's a lot of research going into that area, like some sort of higher level synthesis languages. Now, Chisel is a very interesting option there. It's based on Scala, which is a functional extension to Java, but it's not that they are using it actually to compile anything, they are just using it to model the hardware and they are using the functional and object-oriented properties of that. So essentially you get inheritance there immediately. You don't have that in the Hdls. So you can just model some sort of hardware and base and inherit something from that and just do some sort of minor changes or tweaks to the hardware just like you are used to when you are using object-oriented programming languages.  It's still closer to hardware than to software development, so it's still kind of HDL but with a little bit more powerful modeling. What's interesting is that the RISC-5 processor is implemented in that. The RISC-5 is backed by Intel, Google and a lot of other companies. So this, I believe, has potential. In case you are interested in checking this out, if you are bored by these HDLs then the website is here, there is a nice tutorial to that, which is really cool. So I would suggest you to skim through the tutorial. It's like 15 pages and it's really well written. Now, very similar to that is my HDL. This is Python to hardware. Again, the Python is just used as a modeling language. You cannot run that, but it supports simulation, verification, so you can essentially simulate your design using Python by means of native speed of your processor. The results can be exported to HDLs and then compiled on your FPGA design. So I have to speed it up a little. I was still talking about HDLs to this point. Now let's talk about some standard programming languages to hardware. It starts with C2H, C2 Gates. The idea was that you have a small software in the FPGA and you are affloating some functions into the actual hardware. So the downside is that you were running bare metal code on the soft cores. That's unfortunate. And you actually placed some marshalling code into your software, which then called the stuff which was in the FPGA. This was great for iterative functions and it did speed things up, but unfortunately the marshalling was not great and you had to have the core in the FPGA. Similar to that is ROCCC, which is a research project. It's C2VHDL, it's not locked to any particular FPGA vendor. C2H was locked to an Altera in their NIOS 2 soft core. Okay, so one last thing about this is Altera OpenCL. This is pretty interesting in fact, because it is possible to use OpenCL kernels and compile them into an FPGA bit stream. Now the compilation takes a lot of time, so it's not really possible to do that at real time to actually compile the kernels. That's why the Altera uses the OpenCL Embedded Profile, which allows you to do a compilation of the bit stream offline and then just deliver it to your machine. It's closer to software because you are just implementing OpenCL kernels than HDL. Altera also provides a kernel module, which is used to communicate between the host PC and the FPGA. This is also used to tunnel the data between one and the other. And the unfortunate part is that you actually need a license for the compiler, even though it's based on LLVM, you actually still need a commercial license for the compiler, so that's unfortunate. There's a lot of examples of that. Altera has some sort of extensions to the OpenCL in fact. There is one extension which bypasses the sort of GPU thingy where, in case you're communicating between two threads of execution in the GPU, you have to use a cache in there. In case of the FPGA, you can just build a direct pipeline between these two threads of execution and just pipe data back and forth. You can also use it as a synchronization primitive. The OpenCL stuff, I believe, is really closest to the software part compared to the rest of the hardware design when you're doing the FPGA stuff. Now, talking about Linux interface, this is the last chapter. This is kind of really, really nasty. This is like a wild west in case of the FPGAs. Because when you implement something in the FPGA, it's completely up to you what you do there. There is really no standard interface with Linux kernel. Unfortunately, there are attempts. In the embedded, there is the device tree overlay stuff, so you can have device tree overlay for your FPGA design, which describes what is in the FPGA. There's also attempt at CERN to define something which is SDB. It's very close to ACPI kind of for FPGAs, which again is a small piece of memory which describes what is in the FPGA. But the problem is that you usually have some sort of control registers there and they can be completely ad hoc. Whatever you just implement there, it will be there. And also you can have completely custom DMA devices there in the FPGA, which can poke your CPU's address space. No problem. And the kernel doesn't have drivers for that. You would have to implement them and so on. This is where it becomes nasty. So there are two ways to do or deal with that. One is to implement your own custom kernel module per FPGA design. Now, this is downsides mostly. You need to make sure that you are running the right kernel module against the right FPGA content. Sure, you can figure out what FPGA content version you have based on some register. You can work around that, but it's still kind of custom solution. You need custom user space IO unless you really put a lot of effort into doing it right. In case the driver is badly written, then it can crash your machine, which you don't want. In case you upgrade the kernel version, then you still have to log around this driver and update it to a newer kernel version and so on. There's a lot of maintenance overhead. That's not really cool. Then the other option is user land approach where you can export basically the FPGA register space into user land that let user do all the register poking and handle all that in the user land. But then you have problems with DMA because exporting DMA, Apple memory into user land is a little difficult. You can use CMA for that. It's possible, but then you are looking basically user control some sort of DMA somewhere which can be used for malicious purposes. It's also not great. Okay, so let me just do a quick summary here. Whether FPGA is great for highly parallelized pipeline tasks, basically when you put data into the FPGA, just pipe them through, do some transformations, put them somewhere else. What is FPGA really bad for is in case you're doing general computing tasks with a lot of branching, this is not where FPGA's shine. Also the good point of FPGAs is that they're manufactured with the real estate of the art technology. This is great. So you save a lot of power consumption. Right. The downside is there is no unified kernel interface. Doing the FPGA development can be difficult but you can kind of work it around by using the OpenCL or maybe stuff like the MyHDL or Chisel, this might help. And the FPGA ecosystem is still rather closed so there is no really open source implementation of the FPGA assembler that's unfortunate. And I'll cut the short here. Thank you for your attention. And questions, please. No questions. I'd like to just remind that for questions, my chance to reward you with a depth of thought so you can try it a little harder. Thank you. Okay, so that one and after that one and I believe there was one in the back, right? So that one will be third. So go ahead, please. So what's the cheapest way to start playing with it? Is there some simulator or something? Okay, so the cheapest way to enter into the FPGA land, right? Okay, so there are simulators. They are actually part of the design softwares. You actually get a software simulator for the FPGA design. You can do that. You can analyze what's going on in there, actually trigger on all sorts of signals that's possible. And then there are really cheap FPGA kits on the market recently. You can get a pure FPGA without any RAM for like 20 bucks. It's really simple. Then you need some sort of debug probe, but that's like, I don't know, again, 10 bucks or something. You can also get nice kits from certain Taiwanese corporation. And they're like 100 bucks. They also have a small ARM core. They have about gigabyte of memory. They have gigabit ethernet. So you can already use that for data cruncher. I used very similar kits for doing, let's see, some clustering application. And even that sort of stuff was usable there. So 100 bucks is a nice kind of ballpark when you can enter the FPGA technology. Thank you. Can we give them a scarf? No, it's up to you. Yeah, that was a really good question. And it was definitely not covered in the talk, so you know what, come for the scarf or maybe after the talk. So I have one ready for you there. Marcin. I just wanted to ask which boards you can buy for cheap to start. All right, so which boards you can buy for cheap for starters? For the Altera FPGA, there is Jurassic Socket. That's like 200 bucks or something. There is also Jurassic the E0 nano sock chip board. That's like 100 something box. And it also comes with the debug probe. So you don't need anything else but a USB cable to actually get into this field. There is something with Xilinx Zinc chip, but I don't know what's the name of the board. Sorry about that. Also, there is Lightness Ice Stick, which is the reference development kit for the ice storm stuff. And there is also open source, entire open source tool chain for that. It's the Project Ice Storm. So this is notable and it costs like 40 bucks. Thank you. The third one, please. You mean when you programmed the FPGA? You mean what happens electrically when you program an FPGA? Okay, so yeah, I was actually planning to do an entire talk about that at another conference. That's really bad. So electrically what happens, the FPGA has an SRAM in that, a big SRAM, which just connects to the transistor. The memory cells in the SRAM connect to the transistors in the FPGA. And based on what you put into the SRAM, you actually configure the transistors which then implement the lookup tables and the registers. This is what electrically happens. That's not necessarily true. Okay, so the common FPGAs are nonvolta, I have SRAM in that, but there are FPGAs families like Altera, Mox, TAN, which is something between CPLD and FPGA, and it has a permanent flash storage instead of the SRAM. So they are nonvolatile. But most of the FPGAs are, yeah, volatile. It's not a problem. There is actually, you can have an external memory from which the FPGA programs at start. Outside work there is a new zoom, right? It's in the money space to use, so don't worry to reach in that far. Good, yeah. Thank you. You need as many as you thought possible. Can you put it in there yourself or should I do it or do you want to use this computer? I can use this one.


Hi, my name is David Heath. In this video, I'll be presenting log stack and improvement to the recent stacked garbling technique. Stack garbling improves on the classic garbled circuit technique by reducing the communication cost of conditional branching. Unfortunately, the reduced communication comes at the cost of increased computation. In log stack, we further improve stacked garbling by reducing computation without sacrificing the improved communication. Let's get started. While that in garbled circuits, we consider two parties, a GC generator and a GC evaluator. The two parties have some function in mind, f, which they would select to securely compute. For garbled circuits, we need the parties to represent the function f as a Boolean circuit. The generator g starts by encrypting the Boolean circuit gate by gate. To do so, he first chooses a pseudo random seed, which will be the source of his randomness. This choice of seed will become important later when we talk about stacked garbling. He then expands this seed to choose pseudo random keys, two per wire. The two different keys represent the possible semantic values that can appear on the wire. For example, in this diagram, a red key represents a logical zero and a green key represents a logical one. Based on these keys, he constructs encrypted versions of the truth tables of each of the Boolean gates. So for example, in this particular gate, if the evaluator E obtains two input red keys, then she should obtain an output red key. And in all other cases, she should obtain an output green key. So this would encode a logical OR gate. The generator continues to step through the circuit, gate by gate, constructing encryptions of each of the logical gate gates until he has completed encrypting the entire circuit. We refer to these encryptions of the gates as the garbled circuit material. For the purposes of this talk, I'd like for you to think of this material as nothing more than a pseudo random string. And indeed, formally, most garbling schemes satisfy the property that their material happens to be indistinguishable from uniform strings. This property will be crucial when discussing stacked garbling. To continue GC evaluation, the generator G must convey the material to the evaluator E such that she can use the material to securely evaluate the circuit. This process is simple since the generator G just sends the material across the wire. However, here I'd like to emphasize an important point. The simple transmission of material from G to E is the most expensive part of garbled circuit protocols. This is the communication bottleneck that stacked garbling helps to relieve. To finish evaluation, we convey input keys to the evaluator E. From here, the evaluator can step through the circuit gate by gate, decrypting individual rows of each gate and propagating input keys to output keys. To reiterate, the bottleneck in this entire process is the amount of material that is sent from G to E. As I've already stated, stacked garbling is a technique that helps to relieve this bottleneck. Suppose that the target function F is expressed using conditional branching. For example, on the right, I have a piece of perhaps C code that uses a switch statement. The crucial property is that there must be some branches of the code whose behavior is completely conditional. That is, only one of the branches is actually going to be taken. The key idea of stacked garbling is that since only one branch is actually evaluated, we actually don't care whether or not any of the inactive branches are evaluated correctly. We only care that the single active branch is evaluated correctly. Before stacked garbling, it was necessary to express a conditional by expressing each of the branches separately. If we think back to our garbled circuit protocol, this meant that the GC generator would encrypt each of the branches separately, constructing material for each of the branches, and then send all of this material to the evaluator. Thus we needed material proportional to all of the branches. Stacked garbling showed that this amount of material is unnecessary. We can sacrifice the correct behavior of the inactive branches, which in some sense is not a sacrifice at all. What this means is that we only need enough material for the single longest branch, as I'll shortly explain. Unfortunately, stacked garbling has a downside. Specifically, the amount of computation consumed by the parties is increased. We're going to look at the cause of this increased computation in just a moment. Indeed, this is the entire focus of today's talk. Before we dive into any constructions, I'd like to have a look at the formal contribution of this work at a high level. Suppose that the function F has B branches, and further suppose that each branch has the same size. This restriction that the branches have the same size is not a limitation of our approach, but rather is used to simplify the analysis. In standard garbled circuits, the parties will separately handle each of the B branches. Thus each party incurs communication and computation that is linear in the number of branches. Stacked garbling improves on the communication cost. In particular, the communication cost is independent of the number of branches. However, notice that the computation is made far worse. Together, the parties have to consume a quadratic amount of computation in the number of branches. This work, LogStack, improves on this computation cost. We retain the communication advantage of stacked garbling. Our communication is also independent of the number of branches. However, our computation is greatly improved. We consume only order B log B computation. Next, I'd like to dive in and have a look at all three of these different approaches to conditional branching. My emphasis will be how stacked garbling improves over standard, and how this improved stacked garbling method leads to greatly increased computation. Then we'll look at how LogStack helps to relieve some of this computation overhead. Suppose, for sake of example, that the function F has eight exclusive conditional branches. Further suppose that each of these branches is expressed as a Boolean circuit, in this case, C0 through C7. I'd like to begin by covering how standard garbled circuits, that is, without stacked garbling, would handle evaluation of these circuits. First of all, we need to properly handle the semantics of conditional branching. What I mean by this is that although we will evaluate each of the eight branches, only one of the branches will be active. We'll use a special multiplexer circuit to select the output from the active branch and to discard the output from all inactive branches. Note that in standard garbled circuits, these multiplexers are nothing special. They are simply built from more Boolean gates. The multiplexer will take in indision bits, which indicate which of the eighth branches are supposed to be evaluated. Just like before, the generator G will start from a pseudo-random seed, then expand the seed into material. We'll denote the material corresponding to each of the subcircuits separately. Though in standard garbled circuits, the generator G simply takes all this material, concatenates it together, and sends it across the wire to E. Of course, this is very expensive. Upon receiving this material, the evaluator E will evaluate like normal. On the active branch, this will generate some values, which will be then propagated by the multiplexer. The evaluator also evaluates each of the inactive branches, since she doesn't know which branch is active. Stacked garbling works differently. The key contribution of stacked garbling is that it reduces the amount of communication needed. In particular, we won't send the material corresponding to each of the eight branches separately. The generator G doesn't start by drawing one pseudo-random seed for the entire circuit. Rather, he draws eight, one per branch. He then separately generates the material for each of the branches. Notice that now each of the seeds is a compact representation of the material of its corresponding branch. In particular, if the evaluator were to receive, say, the seed S3, then she would be able to recover the material M3 without needing to receive M3 directly from the generator. This is the key observation of stacked garbling. The generator stacks together all of the material and sends it across the wire to E. From here, we ensure that the evaluator E will obtain inactive branch seeds via encrypted truth tables. I won't go into the details on this, but suffice it to say that it's relatively simple to convey to E each of the seeds for each of the inactive branches. Crucially, we will never send to the evaluator the seed corresponding to the active branch. In general, we need to handle the case where neither player knows which branch is evaluated. Let's suspend that for just a moment and suppose that E did in fact know which branch is evaluated. We will restore obliviousness in just a moment. If she did know that C5 was the active branch, it would be relatively easy for her to correctly evaluate now. The idea is that she will take each of the seeds and copy the actions of the generator to recover the material for each of the inactive branches. The point is that since the generator only sent the X-word material rather than the concatenation, the amount of information transmitted to the evaluator is much smaller. We also need to convey the seeds to E, but these are short cryptographic seeds, not entire garblings of circuits, so we've greatly diminished the total communication cost. Now that she has all of these materials, notice that the evaluator E can reconstruct the material for the active branch. Notice that she can do this without the generator needing to explicitly send the material M5. Since she has the correct material, she can now propagate input keys to output keys, correctly evaluating the active branch. Much like the standard handling of conditional branching, we also need a multiplexer component to do stacked garbling. However, this multiplexer component is a special garbled gadget that needs to more carefully dispose of the outputs from the inactive branches. Discuss this more in a moment. There remains a key problem. We assumed that the evaluator E knows which branch is active, but in general, of course, she does not. Moreover, she should not learn which branch is active. This would be insecure. Stacked garbling solution to this problem is actually quite straightforward. E will simply try to evaluate each of the branches. In more detail, if in addition to receiving seeds for each inactive branch, the evaluator will also receive a seed for the active branch. However, this seed, S5 prime, will not be the seed that G used to construct material for C5. This will be some garbage seed, indistinguishable, yet distinct from the seed used by the generator. What this means is that when the evaluator generates material for C5, she will not obtain the correct material, M5, but rather some distinct material, M5 prime. Having constructed these materials, the evaluator now goes through the conditional branch by branch and tries to evaluate each branch one at a time. Notice that when the evaluator tries to unstack the material by XORing with her combined material received from the generator, she doesn't receive good material for any inactive branch. Rather, she receives some distinct string. So for example, on C0, she receives the string M0 plus M5 plus M5 prime. Here is where it is crucial that garbled circuit material look uniformly random. Since the material looks uniformly random, there is no way for the evaluator to distinguish whether she is correctly unstacking material for C0 or if she is constructing a string of some different form. We refer to these differently formed strings as garbage material. The garbage material does not correspond to the garbling of a particular circuit, but instead is essentially a useless string. Continuing, the evaluator tries to reconstruct the material for each branch. Notice that she only succeeds on the single active branch and everywhere else she receives garbage material. Having reconstructed all these materials, the evaluator interprets each of them as the correct material for that branch and tries to evaluate. There's a crucial detail here. On the active branch, the evaluator will correctly evaluate each of the internal Boolean gates. However, on every other branch, the Boolean gates will act in a seemingly uniformly random way. They won't correspond to any logical semantics internal to the branches at all, because the evaluator is essentially just using a random string as the material, not a well-formed encryption of a logical truth table. This means that instead of getting well-formed red and green keys on the output of, say, circuit C0, she just receives uniformly random keys. In terms of security, this is no problem, since the evaluator is unable to distinguish good keys from bad keys. Recall that stacked garbling needs a special multiplexer gadget to dispose the output from inactive branches. Although I won't cover this in detail, it turns out that to construct this multiplexer, the generator must know the form of each inactive branch label. As I stated earlier, these inactive branch labels are not well-formed red or green keys, but are instead random garbage output strings.  Thus, to calculate the garbage outputs, the generator is forced to put himself in the shoes of the evaluator when guessing which branch is active. That is, he explicitly evaluates each branch using corresponding garbage material. Notice that, as shown on this slide, the form of the garbage material depends on the identity of the active branch. For example, the garbage material for branch C0 depends on the material M5. Suppose some different branch, say, C2, were active, then the specific garbage material for each inactive branch would be different. This means that the garbage outputs from each branch will also be different. In full generality, each of the B branches has B minus 1 possible garbage outputs corresponding to each possible different active branch. To garble the multiplexer, the generator G must compute each possible garbage output label. This requires that the generator G evaluate each of the B branches B minus 1 times, leading to quadratic computation overhead. Having done so, the generator can finally garble the multiplexer. To recap, to design this multiplexer, the generator G must know all possible garbage output labels, which requires G to consider all possible pairs of the active branch in combination with a guess made by E about which branch might be active. There's a total of B squared such combinations. This is the source of Stack Garbling's B squared computation overhead. This significant computation overhead is problematic for the generator G, especially if the number of branches is large. We're finally ready to look at the log stack construction. Recall that log stack reduces stacked garbling computation overhead from O of B squared to O of B log B. To do so, log stack reduces the number of possible garbage output labels from B squared to B log B. Mechanically, this computation reduction involves organizing the branches into a binary tree. Specifically, the generator G will no longer sample eight independent pseudo-random seeds. Instead, G samples a single root seed, then derives a full binary tree, where each node is generated by its parent in the natural manner. From here and as before, G uses the leaf seeds to derive material for each branch. As before, we convey seeds to the evaluator. However, the strategy by which we reveal seeds to E is far more complicated. Although I won't describe its implementation, log stack uses a simple garbled gadget that we call the sorting hat to reveal certain seeds. The sorting hat distributes to E a labeling of the binary tree. Specifically, each node is labeled by a pseudo-random seed. Suppose that, as before, branch C5 is the active branch. The sorting hat will distribute to E seeds such that only the seeds just off the path from C5 match the seeds chosen by G. Every other seed will be independently and uniformly sampled. As before, the evaluator does not know which branch is active, and so simply tries to evaluate each branch one by one. Let's start by examining the evaluation of C0. E's strategy is to look at each seed in her tree just off the path through her guess. She then recursively derives trees of seeds starting from these parents until she's derived one seed for each leaf, other than her guess. She then uses these seeds to construct GC material. In this case, she constructs garbage material for each guest in active branch. She then attempts to use all of these materials to unstack material for her guest active branch. In this case, E generates garbage material, and hence when she evaluates, she obtains garbage output labels. Let's demonstrate that the strategy yields the correct result for the active branch. Consider what happens when E tries to evaluate the active branch. She again considers the seeds just off the path to her guess. Notice that this means that E chooses seeds that G used when constructing the full binary tree. Thus, when she recursively derives seeds for each branch, she obtains good seeds for each branch just other than her guess. Therefore, she correctly generates material for each guest in active branch. When she unstacks, she gets correct material for the active branch, allowing her to correctly evaluate. I claim that this binary tree organization of the branches has reduced the number of possible garbage output labels from B squared to B log B. Let's see why. Let's consider eight worlds, each of which has a different active branch. We will consider what happens when E evaluates circuit C0 in each of these worlds. We'll see that there are only a logarithmic number of possible garbage outputs from circuit C0. First, consider the world where circuit C0 is indeed active. We've already seen this one of counting for correctness. As already shown, in this case, E correctly reconstructs material for each guest in active branch, correctly reconstructs the material for the guest active branch, and evaluates correctly. If instead, circuit C1 is the active branch, then E will construct garbage material for circuit C1. When she goes to unstack, E will therefore unstack garbage material for her guest C0. This leads to a garbage evaluation of C0 in the first set of garbage output labels from C0. If instead, circuit C2 is the active branch, then E will construct garbage materials for both branches C2 and C3 due to this fixed seed as their parent. This leads to a second garbage material for C0, and hence a second possible set of garbage output labels from circuit C0. Now consider the world where circuit C3 is active. Here's the crucial point. Notice that E's evaluation of circuit C0 is entirely the same in the world where C2 is active and in the world where C3 is active. More precisely, E reconstructs the exact same garbage material for circuit C0 and arrives at the exact same garbage output labels. Thus, in both of these worlds, there is only one possible garbage output evaluation. Further, notice that in the four worlds where circuit C4 through C7 are the active branches, there's only a single possible garbage evaluation. Namely, in all four of these worlds, the evaluator E will reconstruct the same garbage material for each guest in active branch. This means that she will unstack the same garbage material for the guest active branch and arrive at the same garbage output labels. Thus, across all eight possible worlds, circuit C0 has only three possible garbage output values. More generally, for a circuit with B branches, each branch has only log B possible garbage output values. By extension, each branch will have only log B possible garbage output values, and therefore, together, there are only B log B total garbage output values. This means that the generator G can construct the multiplexer using only B log B work, whereas before, he needed to use quadratic work. We've now seen the key ideas of the log stack construction. Like stacked garbling, we compress GC material by XORing together the material from each branch and thus decrease the total communication cost for conditional branching. However, log stack reduces computation cost by consolidating the branches into a binary tree. As I showed, this binary tree arrangement reduces the number of possible garbage output labels from each branch, from order B to only order of log B. The GC generator must still compute all such garbage labels to construct the multiplexer. But of course, G can compute each of these O of B log B garbage labels in order B log B time. Thus, log stack greatly reduces computation overhead. We implemented log stack in comparative performance both to standard garbled circuits, that is, without stacked garbling, and to stacked garbling. On this slide, I plot wall clock time as a function of the branching factor. Here, for the purposes of benchmarking, each branch is simply the SHA-256 function. Log stack outperforms prior work both concretely and asymptotically. Although I didn't yet discuss it, log stack also asymptotically outperform stacked garbling in terms of space consumption. Specifically, stacked garbling consumes space linear in the number of branches. Log stack improves this space consumption to only order log B. So this was log stack. Again, log stack is an improvement to garbled circuits. Log stack improves the computation costs of stacked garbling while retaining stacked garblings' important communication advantage.


Why the narcissist did not come back? We always talk about the Hoover. We always talk about how narcissists tend to return to their victims. They always return to the scene of the crime. But that isn't always the case. Sometimes the narcissist does not come back. And this is actually more common than people think. The narcissist isn't really as tough as people think they are. Many of them are non-confrontational. They tend to avoid arguments. Especially those they know they cannot win. And that is why they will often disappear without a trace. Because they know you're on to them. So they will run from the truth. Because they see it as a threat to their false image. And if you've really figured them out. They're not going to come back. They're not going to come back if you maintain no contact. They can't come back if they don't even know where you are. But even if they could, they're not going to do that. Because they're afraid of rejection. They have too much pride. They're not going to put themselves in a position where they could be at risk of being humiliated.  They will stay hidden. You won't hear from them. They may also fear that you will reveal this information to other people. You may disclose to other people about what they really like. And they don't want that to happen. They don't want to provoke you into doing something that would be unfavourable for them. So they will hide. They will find people who are unsuspecting. People who they can deceive. They can't do that with you anymore. Because you've figured them out. You're not someone they can play with. They can't mess with you anymore. Because you're no longer willing to be their workhorse. You're no longer willing to be their doormat, their punching bag. So they have to find someone else to replace you. Once you take away your emotional investment. They know their time is up. They know they have lost you. So they will avoid you. When the narcissist starts devaluing you. It's because they're idealising someone else. They have to see you as being bad or wrong. So they can see this other person as being good. They have to see you as a piece of trash. So that they can start getting rid of you. But before they can do that. They have to ensure that this new person is going to be a good source of supply for them. So behind your back they will be doing this. And when they're finally ready to advance this new source of the primary position. They will discard you. But if they know that you're still waiting for them. And you still have an interest in being with them. They will continue to control you in an unfair and selfish way. They will consider you casually. And without making a decision. They will tease you. They will deal lightly with your emotions. They will leave you. But then they will come back. Because they know you're still hopeful. You're still looking for answers. You're still trying to fix the situation. So in that situation. They will come back. But if you figure them out. If you know who they are. And they are aware of this. They know that their scheme and deception has been revealed. They're not going to be able to manipulate you. In the same way as they did before. So they're not even going to bother to hide who they really are. Because they know that you know. So they will just show you. But at some point they have to focus their attention on something else. Because it doesn't make any sense for them to come back to you. You're not going to give them what they want. And they know that. Because you've already rejected them. You've already caused a narcissistic injury. You've shown them that you have the power to walk away. And once they can see that you're happy with your decision. And you've moved on. You know you're not coming back. So they will forget about you. And you figure them out. You know they don't have any value. You know they don't have your best interest in mind.  Into something positive. The best revenge is your success. And when they see that you're happy and you're doing well. Why would they ever try to come back? When you know who they are. When you know what they're about. When you don't want anything to do with them. It would be a waste of their time and energy. It wouldn't make any sense for them to come back to you. When you've moved on with your life. When you're not affected by their attempts to bring you down. They're not going to come back to someone who has put themselves in a position of power. They would be putting themselves at risk. They have to be around people who they perceive as weak. People who are not going to stand up to them. When the narcissist can see that you've moved on.  It causes a narcissistic injury. It makes them sick. It kills them inside.   So they're not going to come back to you. You may never hear from them again. Because they're so losers. They get very angry and upset when they lose. So if the narcissist doesn't come back to you. It means that you have won. They're not going to come back to you. They will go and find someone who is unsuspecting. Even though they may not be as good as you were to them. They know they can't do anything with you. If the narcissist comes back to you. They still see you as a joke.  When they don't come back. It's because they've realized they can't mess with you anymore. So they're not going to bark up the wrong tree. They're not going to do the wrong thing to achieve something intended. They will go and find someone else. Someone who will believe their lies. Someone who will see them as something special. Someone who is unaware of what's going on. So when all is said and done. They will find someone. Who is how you used to be with them.  Until they're caught out again. And then they will find another unsuspecting target. The cycle never ends. Thank you for watching. I hope this video resonated with you. Please like, comment, share and subscribe. If you would like to donate. My PayPal link is in the video description. Coaching Inquiries. You can email me at coaching.nax if I have got the clue okay. Thank you for watching and I'll talk to you soon.


What can you guys do to really ensure that the next time you meet up with these guys, you can get those tickets. Right. Just being in a better position. I felt like they're pretty good but we kind of gave them a short field for that game. So just making those plays to keep those guys out of scoring range as far as getting into the end zone. Making those guys kick field goals. Limiting them to the least amount of points as possible. I think that's going to be the big deal for us this game. How good is Brandon Cooks? What's the challenge against him? He's really good. He's a big, deep, direct guy. They're going to try to get him the ball. He's the one that gets their offense going. So we feel like as he goes, the offense goes. They found the running game. So just trying to take him away. Make sure that they try to beat us some other way. Some other players they have. Kevin just said how much they've run the ball recently. You guys like to stop the run though. This is one of those games. This is a defense. It's kind of mono, mono, strength for strength. Yeah, I feel like a lot of, this has been a lot of the games lately. A lot of great teams we've been playing have a real good run deep. I mean, good running offense. So that's just going to be the main part of moving forward.  A lot of teams are going to run the ball on us.  And it's going to leave us in situations, you know. So you got to make sure we play together as one.  You guys like to tap this run-up and support against the mono. Where does that kind of release or something that you guys really speak about? Yeah, that was one of our main keys, you know, as a defensive back group. You know, we wanted to work on our, like being at the right leverage as a tagler. Not only as like, you know, defending the pass, but as a runner. You know, I feel like if you have a good angle, you know, you take your proper leverage. You know, you're, you are made to tackle nine times out of ten.  How important is in your mind for you guys to end the season on a high note? Get the number one seed in the playoffs? It'll be big, you know, just from a standpoint of getting guys healthy. You know, we want to be as healthy as possible. We want to take it one game at a time. Getting this win to be used for us, you know, and setting the tone for us, you know, moving forward into the playoffs, but just being healthy. I'll say that's the biggest thing, you know, winning this season. You feel the energy, has the energy kind of built the confidence growing on this team and you kind of feel it now more than ever? Yeah, it's definitely growing as a team. You know, we always been confident in ourselves, you know. We kind of try to leave the outside noise alone and build it up in our building so that we know what we got to do come Sunday, you know. The outside noise don't matter come Sunday. We play football so we just try to, you know, build on that every week.


Use gamification to motivate employees to complete a certain task more efficiently. So, check this out. Team morale is everything. So, as the person in charge, you need to ensure you're on top of this. But try thinking outside of the box with ClickUp AI. So what you need to do is specify the task that you want your employees to complete more efficiently. An example prompt could be, List three ways to use gamification to motivate employees to complete customer service calls more efficiently. And doing this will allow you to create games that provide incentives, rewards and recognition for completing tasks quickly and accurately. And as a result, employees will be more engaged and motivated, leading to improved efficiency and productivity.


first squadron putting their mounts over the snow-clad hills and jumps in a daring display of horsemanship. The west coast of South America and twice over the Andes. A remarkable flight, both as a goodwill mission to our Latin neighbors and as a demonstration of flying efficiency. Lieutenant Colonel Robert Olds, commander of the flight, gets a hearty welcome from high-ranking air corps officers and the courageous crews of the six great bombers receive the commendation of the secretary of war and the Army's chief of staff. Off it's new dress uniforms. This one is the formal full dress for off-duty and this is the full dress blues for daytime wear and underarms. Next the formal mess uniform for evening wear that makes a lieutenant glisten like a general and a major in his new special formal dress for evening is to be just about the tops in swankiness. The new styles are all in blue with gold braid and will be worn by all flying officers beginning next fall. At ease gentlemen. Watches as the pick of the Army passes in review before him. National defense, tanks and planes and guns and marching men, the price of independence and democracy. The United States Military Academy hold its first outdoor dress parade of the spring. These Sunday parades attract thousands of visitors who come to thrill at the precise marching and counter marching and the colorful ceremonies in the car waited as the world's best-grilled military unit officers. Some of them now in the ranks destined to be generals but if they never have anything to do but thrill this country will be just as happy. The waiting class of the Army's first auto gyro school is having commencement exercises today with a mass flight of five of the craft Dean of the school is Lieutenant Colonel Hoppe who sees five pilots and eight mechanics graduate with honors today. When more men are trained and more gyros put into service they will replace balloons for artillery observation like so many people the gyros can hold her over one spot almost motionless. Troops of the 33rd Division the Illinois National Guard field into a real soldiers field as they rehearse the gigantic war show to be staged later this month promises to be the biggest military show ever put on in this country a complete battle waged right before the future generals that is until they learn can throw cold water on their enthusiasm some of the boys will be big guns in the Army someday. The Secretary of War Woodring at the impressive graduation exercises of the United States Military Academy it's the culmination of four years of rigorous training and this year the ranking man of his class is John Robert Jannarone of Knutley New Jersey now they have to start climbing all over again as second lieutenants. West pointers in working clothes get a chance at the infantry school at Fort Benning to try out the machine guns they have learned about in classrooms. The future generals they have plenty of need for these great shooters some of the Army's big guns at Fort Story. Once they get the range look out.