what are we doing today you're driving me to work you're driving me to work this is not by choice well I have a choice but she made me an offer I can't refuse beautiful all right everyone so I have the luxury of having dr. Chilini drive me to work today I mean personal chauffeur hashtag personal chauffeur hashtag Uber driver hash tag Uber driver and then he's gonna pick me up from work tonight whoo party how did you entice me to do this whole thing I told him this would be a great opportunity for him to see his barber one last time before we get out of NYC and he thought that was a brilliant idea and I'm like yep that's why you're married to a genius so yes she demands me to go to my haircut and that's the reason why well there's only one more appointment left so I figured you know I'm moving out to New Jersey hopefully next week and I won't have access to my barber like whenever I want him so I don't know when the next time I'm going to be up in the city to do my haircut is so I'm gonna go ahead and do that now well I had to drop her off at 1045 my appointments until one but I'm going to find a coffee shop because I have to study again I just don't want to leave you say goodbye to everybody see you later we'll see when we pick you up now she's finally gone am I right now I'm just kidding so basically it is 10 a.m. right now my hair appointment is not till 1 p.m. which means I have to go all the way uptown where my barber is somehow find a coffee shop and I'll probably study for like three to three hours and then get my haircut go back to Queens and then come back to later to make up and drown it from work at the end because she has no car here but right now first and foremost you're gonna try to find a coffee spot uptown give a real talk you know that problems I had with finding parking well just found a parking spot in like two seconds it's on the avenue but nonetheless time to go find a coffee shop don't really know where I'm going I don't know how many places I have like indoor seating anymore so I haven't been really coffee shop at all this whole year because couldn't go inside all year so try to find one close by to the barber and go from there time to get to study oh my gosh literally change of plans and whoever says New Yorkers aren't nice that's so incorrect because I just got out of my car and the lady behind me was like you know you're gonna get a ticket if you park here I was like what do you mean because remember one of those videos I said there's alternate side parking and it changes like every street this one you can't park here from 9 to 11 across the street is like 11 to 12 it's like so annoying the street back there you can park here after 10 30 but then this street which is one street up you can't so she told me she let me know she says you're gonna take it nicest lady ever she was like it's a big ticket to couple hundred bucks so she just saved me a couple hundred bucks and people actually say New Yorkers aren't nice do you believe that all right so there's a lot of time in my car today didn't really anticipate that but I can't find a parking spot both sides of street right now say 11 to 12 30 this is Monday through Thursday Monday or Thursday this is Tuesday or Friday it's currently Friday which means I have another hour until I can park here without getting a ticket so what I'm going to do is just sit here for an hour and study in my car then I can go to coffee but it's gonna be like 30 minutes before I get my haircut but nonetheless this is what I have to do and this is why I remembered why I hate parking in New York City and I probably sound like one of those people I was like oh yeah I left this city it's garbage now that I left all that stuff but this is okay I still love it here but this stuff like drives me insane it just the city just makes more of a headache for everybody involved all the time for no reason and this is just part of it so this is what it is so I'll be sitting here studying let me get my book I haven't even told you all why I'm studying but we're getting back to the looks more on that in a minute so I'm at this coffee shop now and ironically this coffee shop that is down below my old apartment I used to live in this building right here you probably can't see it but this coffee shop wasn't here and when I say used to live in this building I used to live in this building before I started residency six years ago I was there about seven years ago and this coffee shop wasn't here but if it was here I would have been here all day so coffee now haircut in a second that'll be it fresh cut has been acquired and now I'm going to go all the way back to Queens I'm going to do a little more studying check out the stock markets a little bit and I'll tell you exactly why I'm even studying because you're probably like I mean you just you're in attending now what are you studying for well you know studying never ends so I'll tell you why as soon as I get back to the house so officially back home I'm gonna go inside now tell you exactly why I'm studying but first big shout out to board vitals and thank you for sponsoring today's video so let's go and hit that at first and I'll tell you why I'm studying alright so this video is sponsored by board vitals now you may have heard my prior video on passing the core and what my thoughts were on the core examination last year when I did this video and I discussed how the hands-down best resource for this exam is the board vitals question bank the questions are almost identical to that on the actual core exam the explanations of the questions are second to none I learned so much from this Q bank I can't even recommend it enough even if this video wasn't sponsored I would still tell you all that this is the best Q bank far and away that's how much I loved it all of my colleagues who also passed the core exam felt the exact same way about this Q bank so do yourself a favor and use my code dr. Chalini to get 20% off the entire board vitals website with the exception of the CME gift card products so use my code dr. Chalini now get 20% off your board vitals radiology question bank and pass the core exam now let's get back to video okay so I am studying again because I recently received an email from the American Board of Radiology stating that it was time for me to schedule my board exam or my final examination to be a double board certified diagnostic and interventional radiologist so the only problem is they just sent us an email like a month ago telling us to register for their exam and the other issue is there was only one date they gave us which was September 1st so all of a sudden they told us this as we were finishing fellowship and then like oh by the way congrats on being done but now you have to take your board examination on the only day September 1st so this came out of shock to us because usually you take your board exam almost a year after being a practicing attending physician so I should be scheduling this for like next May but all the sudden this year is the first time they've done this they changed it completely and now we have to take it on the only date offered September 1st and they gave us like two months notice now like honestly whatever right I'll roll with the punches do this do what I have to do but it comes at mid select everybody's moving starting their new job all this kind of stuff so it's kind of a hassle to do this straight off the bat with no notice but whatever now I just start studying the other issue too is we don't really know what resources to use because there aren't many resources or aren't really widely known resources to use other than board vitals question bank which obviously I'll use because it's phenomenal but I don't really know what to study so I'm just using my old resources to study that I use for my core examination and radiology residency so basically all the sudden I have to start studying now I have about three weeks left and hopefully everything goes smoothly because this is also not only the first time they've offered this examination as soon as you finish fellowship but it's also the first time they've done this kind of joint test which is diagnostic and interventional radiology subjects combined also they do have a short notice that we will be taking our oral board examination in October just a month ago they said by the way you have your written board exam and also your oral board exam coming up soon and best of luck so now that you know exactly why I have to study again it's time to get to work studying done it is now time to go get ready because we were going out to dinner and I have to get dressed and pick up and your honor back at work in just a minute so let me get dressed get back in the car and head back to the city alright so quick little wardrobe change here well not really wardrobe changes all I did was change my shirt shorts new shoes and we are headed to pick up and your honor at work at the same place I dropped off this morning so let's pick it up also it's almost what is it 610 and it's still 86 degrees out I think it's actually hotter but it is scorching look at that 86 degrees it's almost six I mean the sun's going down it's so hot okay back to picking up and drama my chauffeur's here chauffeur's here so and drama's here the package has been picked up we're headed out to get some sushi with some friends and that's pretty much it for this day I didn't get as much studying done as I anticipated or I wanted to but you know there's always tomorrow so you want to send us out and we'll see you on our next vlog smash like subscribe on follow us on Instagram and her channel on YouTube and we'll see you on the next one bye bye


Enjoy more, please. Oh, and I'm back, dawg. Yo, I really wish I could play music. What's God? Dunk life. Daily yo, we hit 30K, though. 30K, bro. Right into it. We're getting right into it. Thank you so much. The grind from 20 to 30 was looking slow, but that's because I was learning. Wasn't dunking as much. I understand algorithmics better now, but not even that. I wanted to use the metaphor. It's a perfect one. Growing on YouTube is the same as my dunk journey. Growing inches. Wink. Trying to jump your hi is trying to push yourself physically is the same as other endeavors. And this one's a really similar type of adventure where it just took a long time. And the main theme for anything you want to achieve simply put in three words. And I'm going to tell you those three words right now, but I want to hype it up. And those three words are the only thing you need for it to achieve anything you ever want. Actually, there's two sentences that are three words long, but I believe in both of them. I just gave a hint of what one of them was, but the first one I was going to say, which I promise you, I will say so soon and you will love it and it will help you out so much in anything you want to achieve. And it's a secret to everything. It's a secret to life. It's everything you ever wanted. And I promise I will say if I don't say it in the next 10 minutes, then you might want to keep, stay tuned because I will say it. I won't not say it because I have to say it. And the other one is believe in yourself, but the never give up one is give up if it's not what you love. Like there's things that are motivating that are extremely motivating. For example, dunking is another good example. I haven't even said any examples, but the point is dunking sometimes there was a part of me that wanted to prove people wrong. And then I had to get over that because that that was hindering my performance in my mindset when I would go to workouts. I was I was like rushing things, but that is a strong motivator. But if that was the only motivator, I don't think that's I should be dunking or trying to do something because once I prove them wrong, I'm not like fulfilled. But the reason I continue to dunk and continue to jump higher because it's my favorite thing to do. It's my favorite feeling. It's my favorite energy. It's a dream every time I dunk and making progress, there's no better feeling than making progress jumping higher for me. So that's what I'm saying. My point is is never give up. If you want it, never give up. Just think of it as a mountain. If you want, if you find the mountain you want to be on top of, never give up climbing it. If you need to go all the way back to the bottom. That's fine.  But that's never giving up. You'll get to the top of the mountain if you want to, but make sure you're at the right mountain and YouTube is another mountain for me that I love because I love videos and I'm an entertainer. OK, I love helping you guys enjoy more, whether it's me actually causing enjoyment in your life from this podcast.  That's my favorite thing in the world to do is help people enjoy more. I had that life insight on yesterday's podcast. If you listen to it, but nobody did. Everybody did because I have 30k now.  And yeah, so enjoy more, find your mountain and never give up because the thing with dunking is that it took me so long to do a strength phase correctly, literally like two, three years. I tried one way. I did the reps wrong. I did it for too long. I did it at the wrong timing to match up with dunk camp. I was jumping poorly during dunk camp and dunked afterwards. So I learned about the timing. I learned so much about my nutrition. Look how goddamn shredded I am now.  The point is I'm learning about how nutrition works, how my mind body connection is getting stronger, how that applies to my training. So many different things that if I gave up, I would have never learned. So because it's a mountain I like to climb, I'm learning about the crevasses of the mountain. I'm learning about the trails and the trail heads and the different animals that live along this path and the people that have died along the way. And I'm stepping over. Those are the bodies I'm going to catch in dunking. I'm going to dunk today. My back hurt yesterday just because I think I jumped too much. I slept a little weird. I slept so good last night. Actually not too much, but I was just super pumped from everything.  I love dunk mixes, but I just need better dunks. But I'm hoping to go today. I might try to keep it but I got to celebrate 30K. I'm trying to keep it disciplined for my hamstring. It's my hips and my glutes are getting more flexible. And that's leaving tension on my hamstring. I could feel it kind of getting a little better. It's just such a slow process because I believe it's the tendon, not the muscle, which is another thing to get into. But that's part of the mountain. I'm climbing it. I'm never giving up. I'm feeling really good about it. And this is something totally off topic, but it's been on my head and I've been wanting to mention on the podcast for no reason, but I just want to get it out there. I'm going to be doing a little bit of a bench. So billboards are one thing. Benches are not who buys them add on the bench. And it was I just need to share this to see what you guys think. And then we'll get to everyone's favorite part. Oh, my CBD fell. Shout out to these guys. Oh, and also people have been giving me really great reviews on the book. Thank you for that. I'm going to probably make a part two soon or something. Something new soon. I have so many ideas that I've been writing, writing, writing, writing, and I'm trying to condense them. I did improv. I just remembered last night. I had a dream that. Oh, my God. I had a dream that in the improv class, we were taking turns. And I wish I remembered, but someone said something and it wasn't my turn, but nobody know what to said. So I just said it anyway and it made the whole place laugh. And I loved it. Making people laugh in my dreams. That's my favorite thing. I was about to say, oh, yeah, I saw this sign on a bench and it said emergency bird clinic. And I was thinking, huh? Why? I saw it on a bench. Who's going to use it? And then it said 24 hours. So I'm thinking, when is someone going to see that number one? When is someone going to see that in the middle of the night? Because 24 hours only applies to people that need to use it in the middle of the night. Are they going to see it during the day? Okay, that's good to know for my bird next time he's ill. And then it's like, okay, do they write that number? I don't get it. Who spent money? That's got to be a cheap, bad thing. But I'm thinking how many people like when you when I think of things when I'm making content when I'm thinking of anything I'm thinking like what should I worry about? Should I worry about this thing? There's like so many things that are like one in a million or like the most majority of it. You know what I'm saying? It's like, but this thing is like on a bench on the random side of it. Like how many people are going to pass that bench that have birds that get sick or get injured in the middle of what? And so I was I really am curious what that business how that business is doing and how many bird emergencies are there? Are there any? Are there ever a time? Okay, that's it. I just had to get that out and those are type of things I want to express and I need to share because I've got no one to share it with and I'm just thinking I just hope the birds are doing well. That's it. All right, now I'm going to go over the best part of the podcast. Oh my God. I had the on this day in history. Where is it? There was other things I wanted to say but you know we keep it doing every single day. We do this. Okay. So I'll be here tomorrow but I got them hair cut. I feel amazing. Oh, it's the best feeling. I feel like you shed a whole layer of skin when you do that. Bro, the other thing a little more motivation real quick is that learning about my body and the thing about my body and like getting leaner and more cut and doing things is that there's parts that I didn't even know existed. So it's like climbing a mountain and then you're finding caves that are just bonuses. You're like, oh shoot, there's a cave with gold in it. I didn't even know I can do that too. I thought I was just trying to get to the top but along the top you're out like gain all these things as well. So it's really fun to find things about yourself that you didn't even know existed in your brain somewhere and things like that and then on top of it making progress on that it's just compounding bro. Okay. Today in history, August 18th, 1737, first public admittance to the Ceylon de Paris art exhibition of the Louvre of Paris. Okay. No one gives up. Anything good? I don't know if I moved off it loses 69 aircrafts. I don't know, dude. These are terrible today. There's not even one for music today. Today in film, 1926 weather map televised for the first time. What? It was only 90 years ago that the weather map. I guess that makes sense. I was thinking about weather too is like how do we how do we have all like how can we see planets that are billions of years away and be like like I watched the black hole thing and it was like that black hole collided and we're hearing it and we heard it in 2015 a little blip we can do that we can but we can't even like predict with such certainty that a storm's coming on our own but i don't get it how it's such a big disparity to me today's sport 2008 belarus weightlifter andre everon breaks three world records for the snatch clean and jerk and total on the way to winning the men's 105 kilogram gold medal at the beijing olympics fucking sec bro i'm going to dunk soon i can't wait uh okay bro i got a new review on my podcast thing here we go i love these so much wait that was that one where is it i thought i saw a new one was it a new one oh laura blue laura bloom again what she was a key she was one of the first ones ever i've mentioned them what's good best dunking podcast out there this guy's a total jokester claims he can dunk but then turns on the emits he's only 5 10 next time check your psychosis at the front door bro i mostly listen for today in history no one does where the host tells us what happened to old folks that just did that that's hilarious bro laura bloom you're definitely the goat of the reviews you left one let me tell you how long ago where was the first one maybe it's maybe if you damn i think if you review again it doesn't it shows doesn't show it i'll try to find it but it was like one of the first ones ever gotten near the nicest ever thank you so much for all the support and everything and now the dunk life of the day i dropped the vlog yesterday all my dunks poster practice bro poster practice my man julian super nice dude he helped me try to dunk on him he's six three he just let me try to dunk he was awesome he was just doing from a stand still um let's see uh i just like this one right here Matthew Smith steven it's time to take this shit to the next level i got you bro i'm on it and then last podcast dunk lifer of the day um got a question what is the best recommended durable dunk shoes you got i really like the mamba instincts they're cheap they were like 50 bucks and they've lasted me a long time each um free book would be amazing loving your dailies jacob lee bro guess what free book for you the first one i read i don't know if other people do it but i told yesterday i would give one book away jacob lee i got you comment on this video and i'll i'll find a way to get you anyway have a great effin day it's a beautiful day bro i got a beautiful haircut i'm gonna dunk my body's looking like the skin of a fucking excellent person and we're gonna dunk on somebody today maybe not maybe just work on my footwork like i should and keep my hamstring healthy but i gotta think long term and listen to myself but it's been a great time and i'm looking forward to the future because i'm at 30k now and it's only gonna grow and you gotta never give up because the mountaintops are where we want to be because they're high up there and we have good vantage points and if we want to see more of the world we gotta see from that vantage point and we gotta look out over everything and everything's gonna be looked at but bring people with you too i want you guys to enjoy the mountains so my job is to get you up there i'm oh i gotta i gotta go i jump i got i got i got i got too hype and i dropped my whole crystal i hope i hope the energy is not upside upside down i gotta go to the little


The Ukrainian company Burisma, which is at the center of the impeachment saga, and not only does this new reporting stir memories of Russia's interference to the 2016 campaign, it is also very much in the here and now. The Russian hackers, they're from the GRU, the same unit that hacked the Clinton e-mails, the center of this scandal the company that Hunter Biden served in the board of. And the fear here is that what they're looking for is the same kind of dirt that Donald Trump wanted from Ukraine when he pressed the bill of investigation into Burisma. Remember when the Democrats were repeating over and over that nobody is above the law? Despite the fact it's Democrat run cities that are giving sanctuary to people that are breaking our immigration laws. No one is above the law, not even the president of the United States. Nobody is above the law. No one is above the law. No one is above the law. No one is above the law, not even the president of the United States. No one's above the law. No one is above the law. That no person is above the law. Nobody should be above the law. Nobody should be above the law. Yeah, it's different when they do it. Well, now the media is trying to set up a narrative that Democrats are basically above the law because if you accuse them of corruption, it's because the Russians did it. I kid you not, they're seriously suggesting that if you think Biden might be corrupt, it's because the Russians somehow planted that idea in your head. No, no, no, no. It has nothing to do with Joe Biden being on video bragging about a quid pro quo that involved firing the Ukrainian prosecutor that was investigating the corrupt company that Joe Biden's son was inexplicably a board member of. This latest attempt by the Democrats in their media to steal this election is very similar to how they reacted to the DNC servers when they were hacked, which exposed Democrat Party corruption and collusion with the media. So interesting to remember, it's illegal to possess these stolen documents. It's different for the media. So everything you learn about this, you're learning from us. What did they do? They buried those stories, never to talk about them again because it was unfair. In case you need to be brought up to speed, the election is only legitimate if a Democrat wins it because Russians and Democrats can't be investigated for corruption because Russians. So now the media and the Democrats are putting forth a narrative that they're hoping will give Democrats an edge in 2020. This new narrative started with a supposed hack on Burisma, which is the corrupt energy company that Joe Biden's son was a board member of. The New York Times just broke this story and they're citing findings by a cybersecurity company called Area One. Unsurprisingly, Democrats are now taking their cue from the media and trying to frame any negative news or legitimate questions about Joe Biden as Russian interference. Now this is where it gets interesting. Here's a list of things not mentioned in this New York Times article. The first thing that's odd and not reported in this New York Times article is that the company that supposedly caught this hack on Burisma, Area One, was started by a former employee of CrowdStrike. You'll remember CrowdStrike was the company that certified the DNC servers were hacked by Russia. Now, according to Breitbart.com, Area One has now been hired by most of the Democrat presidential candidates.  It's also odd that Area One is partnered with Google and CrowdStrike was actually funded by one of Google's parent companies. Another thing is if you look at Area One's co-founder on Twitter, he's clearly a Democrat supporter.  According to Breitbart.com, Falco Wittes is an expert for the annual RSA conference on cybersecurity, where Dmitry, CrowdStrike's co-founder and chief technology officer, serves on the advisory board. Area One participates annually in the RSA conference alongside CrowdStrike's Alparvovich. CrowdStrike was financed to the tune of $100 million from a funding drive last year led by Google Capital. I know, I know, this is all getting into Pepe Silvia territory, but stick with me. Google Capital, which now goes by the name of Capital LG, is an arm of the Alphabet Inc. Google's parent company. Eric Schmidt, the chairman of Alphabet, has been a staunch and active supporter of Hillary Clinton and is a longtime donor to the Democrat Party. Area One, meanwhile, partnered with Google to become Google's cloud technology partner for security. A major Area One investor is Kleiner Perkins, whose employees give overwhelmingly to the Democrats. So what's my point? I guess what I'm trying to say is that all of these parties, be it Google, Area One, the Democrats, the media, all of them have a vested interest in Democrats being in power, as well as demonizing and destroying their political opposition on the right. Oh, what a surprise that they're actually trying to rationalize out some sort of a narrative where Democrats are actually above the law. The media wants to constantly blame Trump for eroding public confidence in the media. But really, it's this. Thanks for watching. Please like, share, and subscribe. Go ahead and hit that bell notification while you're at it so you can be alerted to my new content. With YouTube demonetizing everything that I upload and then never manually reviewing any of it, I'm not making anything on any of these videos, making it hard to justify all the time it takes to put them together. That's why I rely on my subscribe star, Patreon, and PayPal supporters. If you'd like to support this channel, you can find all the links in the description and pinned comment. Thanks for watching. Keep coming back.


At Audiology Associates of Prestonsburg, you can live your life the way you want and find the freedom of better hearing. With 40 years of being in the hearing care industry, you'll experience patient care that is specific to you with exceptional follow-up care that ensures your hearing and balance needs are being met. Audiology Associates at 1428 Northlake Drive in Prestonsburg. It looked like a ball of fire, yellowish-red, and it started dashing across the sky and right behind it was a big long tail. Around 2 a.m., Wednesday, August 2nd, residents across the region were startled by the appearance of a broad meteor streaking through the atmosphere. I was standing out here. We were having some electrical issues and Kentucky Power was here several men. And I was just standing here talking to one of the gentlemen looking up at the transformer on the pole. And before I knew it, saw something dash across the sky. Despite concerns over potential damage, there had been no reports of any impact or harm caused by the meteor. Instead, experts speculate that the rumbling sound heard was likely the sonic boom as the meteor entered the Earth's atmosphere. I didn't feel any rumbling or heard any sound. I just saw the thing. It was just...  It's just amazing. For those who missed the meteor siding, there will be more chances in the coming days. Former East Kentucky Science Center director Steve Russo revealed that this year's meteor swarm will be visible from August 9th to 15th. Prom viewing time will be 2 to 4 a.m. on August 12th or 13th. I mean, it didn't last long. It wasn't something that was, you know, 30 seconds, 40 seconds. It was there and then it was gone. I mean, it just completely, once you saw it and it raced across the sky, then it was gone. Reporting from Mountain Top News, I'm Ethan Miller.


In this video, I will present our recent work on concretely efficient zero-knowledge arguments for arithmetic circuits and their application to lattice-based cryptography. My name is Karsten Baum and this is joint work with Aril Noff. The paper will appear at the PKC 2020 conference and the full version of our paper can be found on a print on the link shown below. Let me recap what a zero-knowledge argument of knowledge actually is. For this, we will be in a situation where the proof and the verifier, which both know a certain statement, the prover, will try to convince the verifier that that statement is actually true. To do so, the proof and the verifier will exchange a set of messages at the end of which the verifier is going to decide whether or not to accept that interaction. In order to be a zero-knowledge argument of knowledge, this interaction will have to have three properties. First of all, it must be complete. Second, it must have knowledge soundness. And third, it must provide the zero-knowledge property. Completeness means that if the statement is true and the prover has a witness for it, then a prover will always be able to convince a verifier about the truth of the statement and the verifier will always accept at the end of the protocol. Soundness means that if the statement is not true, then a prover will only be able to convince a verifier with negligible probability. In particular, knowledge soundness means that there exists a certain algorithm called the extractor such that if we have a prover that can convince a verifier with a certain probability, then the extractor can extract a witness for the statement from that prover. Last but not least, zero-knowledge is a property that intuitively means that the verifier does not learn anything from this interactive protocol beyond the fact that the statement is true. More concretely, it means that we can construct an algorithm called the simulator that outputs transcripts that are distributed as they are in the interactive protocol except that the simulator does not get access to the witness which the prover actually has. More concretely, let's assume that the prover and the verifier both know a circuit C and an output Y of the circuit and moreover the prover has a witness W and it wants to convince the verifier that it knows this W and that C when applied to W outputs Y and the whole construction is called an argument of knowledge because we assume that the prover is computationally bounded. In this work, we present two main results. First of all, and use your knowledge argument of knowledge protocol which is based on the so-called MPC in their head technique. Our work is concretely efficient in the sense that the communication in our protocol might not be sublinear in the circuit size as it is in other protocols but it has small very concrete constants and it's very fast when implemented and we only use symmetric key primitives which means that our solution is plausibly post-quantum secure. We then show how to apply our protocol to a problem in lattice-based cryptography, namely we show how to construct a protocol to convince a verifier to the certain SIS problem has a solution with low prover time and moderate proof size over in comparison to other solutions. In order to understand how our protocol actually works, let me first introduce the concept of multiparty computation or MPC for short. In MPC, a set of servers has some certain inputs, WI, and they run an interactive protocol over a certain network after which they each obtain an output. Now what we want to have is that if we feed the individual inputs of each server into a circuit then these outputs will appear as the outputs of the circuit. Now a simple solution for that would be that each party simply broadcasts its input to all the other parties so let's make the whole thing more interesting. So in MPC we require first of all that if the parties learn the output then it is this output of the computation. That means that even if we have servers that try to disturb the computation they will not be able to make an honest server output another value and think that this output is correct. Moreover in an MPC protocol we further more require privacy or T privacy where T privacy means that no T parties can learn anything beyond their inputs and outputs from the protocol meaning that they can run the computation and they they can derive no information about the inputs of the other parties by only looking at the values that they've seen in the transcript of the protocol. A well-known paradigm for constructing as your knowledge a protocol is the so-called MPC in the head paradigm. There a prover will simulate in its head an MPC protocol between multiple servers so it will simulate these servers. It will first secret share its witness of the statements to to all of the servers in the multi-party computation and then these servers will run an evaluation of the circuit C and this whole interaction only happens in the head of the prover. Then after this is done the prover will commit to the views of the different servers that means it commits to both the input shares and the randomness and also the exchange messages of each of the servers individually and it will send these commitments to the verifier. The verifier will then ask the prover to open a certain subset of let's say T views of this multi-party computation interaction and then the prover will open these commitments based on the choices that the verifier has made. Then the verifier will inspect these views that he sees namely the secret shares of the inputs, the randomness and the messages and he will check if all of these messages that were exchanged were consistent. He will check that each of the servers will have acted consistently with its input and its randomness and the messages that it has and that the correct output was obtained and then the verifier will accept otherwise it will reject. Now MPC in the head has been around since the seminal work of Hishai et al in 2007 and the first practical implementation of this paradigm has been provided in the ZKB protocol and the ZKB++ work that followed upon it. Furthermore the Ligero protocols showed how to instantiate the MPC in the head paradigm with sub-linear communication complexity so this is asymptotically less than what we have in our solution. In 2018 the KKW protocol showed how to combine MPC in the head with the so-called pre-processing paradigm which has been very popular in the area of MPC for a long time. Now in comparison to these previous works we generalized this pre-processing based MPC in the head and we show how to use this more specifically for protocols that run over large prime fields. In MPC with pre-processing we assume that before the actual MPC protocol runs there is a trusted third party that samples correlated randomness according to a certain distribution and it then gives each of the individual servers a share of that randomness in secret. This pre-processing is supposed to be input independent and it will allow us to lower the cost of the actual MPC protocol in terms of either communication or computational complexity. Now it's not very straightforward to apply this paradigm in the zero-nord setting for MPC in the head simply because we assume in the MPC with pre-processing that this server who shared the randomness is a trusted third party and that the randomness is therefore correct. Now in the MPC in the head we will have to assume that the prover will simulate this trusted third party but then it's not clear that this secret sample data is actually correct so it gives the prover more opportunities to cheat and fixing this is what is important when constructing MPC in the head with pre-processing. Popular application of pre-processing to an MPC protocol is in order to allow for multiplications of secret shares values. For this let's denote by v in brackets a secret sharing of a value v and we will say that abc with brackets as written here is a random multiplication triple if a and b are indeed random and if c is a times b. Now a straightforward approach is to multiply x and y but as you could check directly using abnc this is a deterministic process and this will always succeed but it will require that abnc is always correct so this is a strong claim that we make about the pre-process data and on the other hand there exists a technique that allows us to verify if three values x, y, z are actually correctly multiplied using a random multiplication triple abnc and if either of them is actually not does actually not follow this multiplication relation then this process will fail with probability 1 minus 1 over the field size. Now that means that we will be able to use pre-process data that is not always correct by adding additional randomness to the npc protocol. Intuitively it could be said that the protocol by Katz et al follows the first approach that was outlined before namely the prover will first generate correlated randomness by committing two random multiplication triples and it sends these commitments to the verifier. The verifier will then ask to open a subset of these triples and the prover will then at the same time decommit this chosen subset to prove to the verifier that the multiplication triples are correctly formed. It will then run in its head multi-party computation using the remaining triples and will commit to the views of the parties as outlined before then the verifier will ask to open a certain subset of the views of the parties and these will be decommitted by the prover and the verifier will then first of all check that the triples were correct, that the views were consistent and then that the output is correct as well. This uses a cut-and-choose paradigm because the prover will first generate all these commitments and then in an interaction a so-called cut-and-choose protocol the verifier will check some of that and the rest will be used in the actual protocol. In our protocol we instead follow the second approach that was outlined before namely first of all the prover commits towards the verifier to random multiplication triples but also to an evaluation of the circuits and for that it commits to secret shares of all the wires of the circuit. Then the verifier will ask the prover to use search and randomness for a verification computation on these secret shares and the prover will then simulate in its head a verification computation on these secret shares with this randomness and it will commit again to the views of the parties. The prover will then be asked by the verifier to open a subset of the views and it will decommit those views. Now the verifier will first of all check that these views are consistent as before and it will check that both the actual actual computation of the circuit will output that the circuit is correct and this is correct and it will check that the verification of the multiplication in our case showed that all the modifications were correct. Now after this it will decide to accept or reject accordingly and this is in comparison to the protocol by Katzedal a sacrificing based approach in the sense that we sacrifice one random multiplication triple to check one multiplication in the actual circuit. As was shown both cut and choose and sacrificing can thus be used to construct an MPC in the head protocol. Both in the actual MPC protocol will have similar communication cost per multiplication gate that is evaluated in the circuit and the MPC protocol that is thus used has both free addition and multiplication by constant gates. This is important for application. Overrings or small fields sacrificing as we presented isn't that beneficial. The reason is that the success probability of the sacrificing is proportional to the field size and if the field size is small then obviously the advantages are not that big. On the other hand if we do computation over a prime field then the saltiness of the sacrificing actually allows us to have less repetitions in the MPC in the head protocol and thus we get less overall communication. When using the MPC in the head paradigm as we do then the communication complexity of the overall protocol will directly depend of the communication complexity of the simulated MPC protocol that is simulated in the head of the prover. Now if we have free multiplications with constants and free additions then this means that we can actually construct a low overhead zero knowledge argument for the so-called SIS problem. In the SIS problem the prover will have a matrix A and a solution T which the verifier also has and it wants to convince the verifier that it has a certain value S a vector S such that A times S is T and furthermore that S is small meaning that this is below a bound beta that the verifier also has. Now it's clear that this is a very easy task if we only wanted to show that A times S is T and the hardness comes from the fact that S has to be small and this is a crucial building block for all kinds of post quantum lattice based cryptographic protocols so it's very important to have efficient protocols for proving such a statement. In order to demonstrate how to apply our zero knowledge protocol to the SIS problem let me first introduce the binary SIS problem. In binary SIS the prover will want to convince the verifier that it knows a value S such that A times S is T and that S is actually a bit strange. Now if the prover secret shares S to the parties in the MPC protocols then the first of the two steps in the proof are actually for free because we can do three linear operations on secret shares values because the matrix A is a public value known to both the prover and the verifier so all we actually have to take care of in the proof is to show that S is a bit strange. Now showing that S only consists of bits is easy because each value S i will only be a bit if and only if S i times S i minus one equals zero. Now that means if we follow this very straightforward approach we obtain a circuit that has M multiplication gates so this is the first step of implementing this. Now for arbitrary bounds this can be obtained by constructing general range proofs where since the prover knows the binary composition of each value S i it can just prove that each value of its binary decomposition is a bit and then we can compute the linear combination of these bits in the MPC protocol which is free and then perform the multiplication with that with the matrix A which is also free. So more generally using a standard range proof this will mean M times log beta multiplication gates so this is a very direct way of applying our protocol to the SIS problem. The outline solution only uses standard multiplication gates so an obvious question is if one can actually do better by for example having a circuit with less multiplication gates or by using special gates and in our work we actually show that this is possible. First of all bit tests can be done using square gates instead of multiplication gates where square gates have less overheads in the preprocessing stage. Furthermore for the binary SIS problem we show a circuit that just uses one multiplication gates instead of M multiplication gates where M is the length of the input vector and for general SIS we show a circuit that has one multiplication gate but where the proof is approximate meaning that the proof does not give the exact bound beta but something that is a bit bigger than beta. Mind that many proofs that are done in the SIS setting only give such an approximate solution. We also show a solution for the general SIS problem that does not use any multiplication gates whatsoever. Now the main idea that we use to actually construct this is what we call circuit sampling. The idea of the circuit sampling process is that the prover and the verifier together negotiate the circuit that will finally be evaluated by the MPC protocol. Here the hope is that if we have a large number of possible circuits to choose from we can choose a class of circuits that overall have a smaller complexity and thus we can reduce the communication complexity of our protocol. This will work as follows. First the prover will commit to an extended witness meaning from the from the witness that the prover has for the original circuit. It will compute an extended version of it that contains some additional information which could be helpful during the evaluation of the negotiated circuit. Then the prover and the verifier together will pick such a circuit and then the circuit will be applied to the extended witness as before. Now the idea will be that a prover might try to tailor its extended witness to one specific circuit instance but if there is a large number of possible such circuits then a prover cannot alter or make up a witness that would make all of these circuits evaluate to a positive outcome while at the same time it does not have a witness to begin with. This in itself is not necessarily straightforward for two reasons. First of all as mentioned soundness might be complicated in particular as we will want to have that also the prover will have a say when choosing such a circuit for reasons that will be clear later and furthermore we will still have to make sure that the zero knowledge property of the protocol is preserved. As an example of the circuit sampling technique consider the range proofs that we have to do in our protocol in order to verify that a witness indeed is valid for an SIS instance. There for the range proofs to go through we will have to test whether input values are bits and this is done by multiplying these input values with the input value minus one and then testing whether the outcome of this product is indeed zero. So if we have n input values and we want to check that all of them are bits this will mean that we will have to do n multiplications and for these n multiplications we will have to originally generate n random multiplication triples in the pre-processing. Both these multiplications and this pre-processing will be part of the communication that has to be done to the verifier. So can we do better and yes indeed we can by amortizing these bit tests for an amortized bit test the tests if all values of w are bits simultaneously we have instead the following solution. First of all let us define a polynomial f of degree n minus one where f at point i evaluates to wi meaning f at point one evaluates to the first element of the witness and so on and so forth. Now this polynomial is uniquely defined by the input w and furthermore we can evaluate this polynomial at any arbitrary value in the field using Lagrangian interpolation. Now Lagrangian interpolation only requires us to perform linear operations and this is for free in the npc scheme. Moreover let us additionally define a polynomial g which at point i evaluates to wi minus one. Now additionally as part of the extended witness we will share a polynomial h and we will then have to test if indeed h is the product of f and g. Now this can simply be done using only one multiplication where the verifier chooses an arbitrary value from the field and then the prover will evaluate h f and g at that point it will then multiply f at that point with g at that point and subtracted from h at the value chosen by the verifier and if the output of this computation is zero then by the Schwarz-Zippel lemma with overwhelming probability a polynomial h of degree two and minus two is indeed the product polynomial of f and g. Now this helps us to establish that both f and g if defined as above imply that all the values of w are bits as follows. By the fact that the evaluation of a polynomial at a certain point is a homomorphism we only have to check now that h at points one to point n is indeed zero but this actually comes to us for free namely we can simply construct h this way because the verifier already knows that h must have this specific shape now that means that in order to send h as part of the extended witness we will only have to send n minus one additional values and that means that we will have a larger extended witness which now has length two n instead of length n but we'll only have to do one multiplication. Now multiplications are the specifically costly part in our proof system so this will help us save communication. For details of that please have a look at the paper. Now we will also make other techniques available for SIS in our paper in particular we showed that rejection sampling can be done if both the prover and the verifier have a say in which circuit will be used and for that I also want to refer to the full version of our paper which can be defined on your print as mentioned before. We implemented our protocol and tested how feasible it is in practice in terms of runtime for that we implemented the binary SIS solution but the unoptimized version where each bit of the witness individually is tested using a multiplication for that we used an amazon c59x large instance both for the prover and for the verifier individually and we implemented our protocol for different parameters namely we let the field be of size for 15 bits up to 61 bits and the matrix A of dimensions 256 times 1024 meaning compressing from 1024 input values over zq to 256 up to 4096 to 512 now observe that in our protocol the matrix A is unstructured meaning that we cannot use additional techniques for efficient polynomial multiplication. For example if we choose the largest instance that we measured for namely if we have a modulus of size 61 bits and we have a matrix that shrinks from 4096 to 512 field elements and if you want to have 40 bits of silence in our interactive argument then the protocol runs in 1.2 seconds if both the prover and the verifier have only a single thread at their disposal now if each of them use 60 or more threads then as can be seen down there in the graphic the runtime shrinks to around 250 milliseconds for the overall protocol. Now we observed in our implementation that over 90 percent of the runtime is actually due to the multiplication with the unstructured matrix A which in our experiment was chosen uniformly at random if we would instead have a as a ring SIS instance then using efficient NTT algorithms we could probably have a much much lower runtime of the overall argument. Now depending on if one prefers a faster argument or less communication one has to choose the parameters for the MPC instances differently if one chooses more parties per MPC instance that means that each of the MPC instances has a better soundness guarantee one needs less MPC instances that have to be communicated to the verifier this overall gives less communication but it increases the computation time because the prover and the verifier now have to run more parties in their head if one instead uses less parties per MPC instance then this gives a better soundness this gives a lower soundness guarantee for each of the individual MPC instances but this then leads to less overall computation time because one just repeats this more and more often and this is nice when done with multithreading. To conclude our paper makes the following three contributions first we generalize the MPC in the head with pre-processing paradigm in order to support both protocols with cut and choose and with sacrificing we give full proofs for both of these approaches second we show how to apply our protocol to the SIS problem in order to construct an efficient interactive argument system third we introduce some new ideas in order to lower the communication complexity for the SIS setting and in order to prove security for these techniques we construct a new approach called circuit sampling which might be of independent interest with this i would like to thank you for your attention


Today's topic is leases. Now let's first of all see the learning outcomes. Students will be able to understand what is meant by the term lease as per IFRS 16. What is the difference between operating and financial lease? Learn how to calculate and record the leasing transaction in financial statements. A lease is a contractual arrangement whereby the leaser, the person who owns the assets, allows the leasy to use the assets for a specified period of time.  In return of a periodic payment and on every month or every quarter or every year they have to pay a certain sum of money. A financial lease is in substance purchase of an asset that is financed with debt. So if it is a financial lease, it means that you are buying an asset but you are not paying immediately or paying slowly over a period of time. The leasy record both assets and liability equal amount to the balance sheet. The leasy or liability both will record the leasy, although the asset is of leaser. The leasy will recognize depreciation on the assets and interest expense. Currently, under IFRS 16, they decided that there is no difference between financial lease and operating lease. In fact, let me just give you briefly what operating and financial lease is.  You will never become owner of that house. You just keep paying the rent as long as you stay in that house. What is over a financial lease is concerned. After making all payments, you become the owner of that asset. That is the difference. That is why it is substantially it is you are the owner and that is why you are recording it in your books of accounts as well as liability. Operating lease is essentially a rental arrangement. No assets or liability is reported by the leasy and periodic lease payments are simply recognized as rental expense in the income statement. It is very clear but since IFRS 16, there is no difference between financial lease and operating lease. That is why now we have a bit simpler. The objective of IFRS 16 is to prescribe the less see and the lesser. The appropriate accounting policies and disclosure apply to less leases. This is one important thing. Since there is no distinction between operating lease and financial lease, anyone therefore all assets or leases to be treated leased assets and here again we used to use this word leased asset under financial lease or leased assets but now they are saying it is not like that. It is right of use asset. So the name is now asset when you borrow or you take it on lease. It is known as now assets right of use asset. In the books of less see and related raise liabilities and lesser will record receivable. So if you are recording the liability, so the other party will record receivable. Exemptions are leased to explore or use of mineral resources. So those are the long term leases. So they are not included in this chapter. Licensing arrangement like copyrights, movies and plays etc. That is also not included in this standard. Now, financial lease is a lease that substantially transferred the risk and reward of ownership to the less see. Important thing is the risk and reward of ownership is transferred to the less see. If the asset is given to the less see, he is 100% responsible for use whether maintenance also and operating lease is a other than the finance. So that's the definition given previously. The present value of the lease payment is substantially all of the fair value cash price in lease in finance lease. The substance of the transaction is that although less see is not legal owner of the machine, it has in commercial reality terms acquired the assets and using a finance deed debit right of use assets and credit obligation under finance lease by the present value of lease payment. This is an important word. Present value of the lease payment. For example, you are taking an asset for five years lease and each year you are paying let's say 10,000 every year. So it's not 50,000 asset, but you need to work out the present value of those payments and that will be your liability. The non-current asset should be depreciated over the shorter of the useful life of the assets and the lease term. Here, clearly, if an asset is let's say for 10 years life, but you are taking it for five years lease, so you need to depreciate it over a five years. Now, there is a bargain purchase option allow the less see to purchase the lease assets for a future price, which is substantially lower than the future fair price, fair value. This is also possible that if the less see want to buy this asset, so they have an agreement purchase option also. So what they do normally, they just pay a little amount and the asset will be transferred legally transferred in the name of the less see. If the option exists, the less see must increase the present value of the minimum lease payments by the present value of the option price, which is really the guaranteed residual value. Here also, there is a one is a guaranteed residual value if there is a residual value and if this is you are going to pay to get the asset in your name, then you should also include the residual value, present value also in your release payments. About the lease, we call it off balance sheet financing. It means we previously we don't use report in the balance sheet asset, although we are using the asset, we are generating revenue against this asset, but we are not we are not recording it in the balance sheet. So this is off balance sheet and it is no more allowed. Motivation for keeping finance of the balance sheet includes the following effect on leverage. If you are including the liability, it means your total liabilities are increasing. That's why you not to increase it now. Borrowing capacity, borrowing cost and management incentives. So these are various things which we used to have when we are not including the lease assets in our library in our balance sheet. Thank you very much.