10 things to do before selling t-shirts t-shirt business tips. Hey, have you thought about selling t-shirts online? Hey, it's a pretty cool thing to do. You can sell all kinds of t-shirts online and make a lot of money But if you do it wrong, you could lose your own shirt. Okay. We don't want that to happen in this video I'm gonna go through the 10 things that you need to do to be successful selling t-shirts online and we're starting right now Hey, if you're new to my channel, I'm JR Fisher. I appreciate you being here on this channel I teach you how to start running grow your online businesses now. I've been selling online since 2009 gosh went by fast and We've sold millions of dollars of both physical and digital products online and along the way I've learned a few things so I thought I would start this channel and actually share those things with you guys So you can get good results too now at the end of this particular video. I have a free course It's a $97 e-commerce course. You can find it in the description below click and learn no credit card required You can grab that also if you've already tried to start a t-shirt business or you have questions about it I want to hear your comments below. Tell me what your experiences have been Tell me what you've been trying to do if you have questions put those in the comments below Really appreciate it. Don't forget to subscribe.  It'll sound just like that if you ring the bell it will try it You'll see and once you do that make sure you turn on all notifications That way if I come out with a new video We can actually just notify you and let you know you don't have to search It saves you a lot of time in a hassle and the cool thing is you're kind of a VIP You're gonna be ahead of everybody else because you're gonna know about it before they do so you don't want to miss out on that You want to make sure you turn on all notifications now in this particular video? We're talking about selling t-shirts and you know for years I've sold a lot of products digital and physical and matter of fact I had my own branded products of thousands of websites including Walmart, but this t-shirt business thing This is pretty cool. If you follow these 10 steps, you can be wildly successful at selling t-shirts online All right, let's first talk about what selling t-shirts is.  It's nothing like that. This is what's called a POD business POD And let me explain to you what POD is that's print on demand So what you actually do is you integrate with one of these companies that prints t-shirts and as you sell t-shirts They actually print them up and they ship them out for you So you don't even have to touch the shirt You'll never see the shirt unless you order one of your own and it goes out to the customer and all you do is keep the profits Now I always have a lot of people ask me. What's the best business? I mean you own a survival food company and you own a course business and you own these other businesses Which what is the best one and the truth is there is no best business What it is is you find something out through like and some are better than others But you find something you like doing and you just proceed with that if there's a market for it out there You can pretty much sell anything online now Let me kind of explain to you though You do want to niche it down or niche it down whatever you want to call it You don't really want to have a general store a general store is where you sell everything to everybody and doing that is incredibly hard You're going to be competing with Amazon and Walmart and you know target in places like that And that's really tough to do so what you want to do is be more targeted now to give you an example a General pet store would be a pet store where you sold all kinds of items for all kinds of pets and dogs and cats and birds and all that That's a pretty generalized thing and that's pretty hard to do But if you opened a store and you catered just to people who had shawalas, okay? That is more of a niche Okay, so everything shawalra related their sweaters their collars their beds Everything having to do with shawalas and t-shirts that said shawalas on it that would be really niche in doing something like that You're going to be a whole lot more successful because you're really going to speak to the people that are interested in that the people who are Passionate about that now that was number one, but number two is yeah, okay I want to back up for just a second you could have a general store You could have a general store on some place like Amazon, okay? So if you wanted to sell products on Amazon and you wouldn't sell dog collars and you wanted to sell You know printers and you wanted to sell jewelry you could certainly do that on a place like Amazon But for your own store and to generate your own traffic that just won't work So what I'm talking about is if you're you're building your own brand you're building your own store You don't want to go general number three is to sell simple text-based t-shirts now Everybody who's getting into t-shirts says well, I'm not a designer. I don't know how to design t-shirts And I don't understand how to do that and I'm not good at graphics Well, you don't have to be some of the simplest t-shirts out there are just text-based t-shirts And they sell really well, so that may be something you want to check out. Let's go ahead and take a look at some of them right now I'm gonna run over to Etsy and look at some of the t-shirts out there. Let me show you some of the top-selling ones Okay, I'm over here on Etsy right now and I'm gonna go over here and take a look at clothing and shoes I'm gonna go to men's I'll go to shirts And let's just see what's going on here. What's shaking what's going down? All right now check this out The shirts that are actually selling well, you know, you can tell by the number next to now check this one here out It's got 559 sales. Let's see what this shirt says Well, there you go beautiful boobies that that's a shirt that is actually selling on there now You can see there isn't a lot of Actual graphics here, right? This is just a t-shirt. So that's one that's selling and you can actually go through here Let me close this out and we can find other shirts that sell well. This one here has sold 1,960 7 shirts and look what they did be kind. That's it That's all they did with this t-shirt is be kind So, you know, you don't have to have these great ideas like you think you do a lot of the t-shirts And this one here's got a real fancy design and sold 1,300 of them But a lot of these you can look at this is a very popular one here. Ooh people So they didn't put a lot of thought into that And this one here's a custom one so you can do custom ones And let's just scroll through and see some of the ones this one hope see here is sold 10,000 t-shirts Let's check it out Now you can't copy Exactly somebody's t-shirt they won't allow you to do that, but you can do something similar change up some of the words This here just has two different fonts on it. That's all this is and you know, they have a little saying she is Loathed with strength and dignity And she laughs without fear of future. Okay, so, you know, that's what they put on this particular shirt here It didn't take a lot of effort. You don't need to put a lot of effort into this stuff Now I'm not going to suggest that you sell these t-shirts with paid Traffic the the ones with just text on them because that'd be kind of tough to do but they're great upsell They're great at your checkout on your page and you can pick up a lot of sales if it's related to the thing that the person just bought Okay, number four, let's go ahead and check out what t-shirts customers are buying that are actually printing t-shirts So let's go over to printful. I'm gonna do that real quick. Okay. I'm over at printful right now And I'm just gonna look through their site here a little bit. I'm gonna click accept on their cookies And we're gonna look at products and let's let's pick women's t-shirts right now And see what we got Now here's the cool thing guys at printful you can see which shirts are selling by the number of reviews here These are all the different types of shirts than you have access to okay, and you can see which ones do well Like this one here is rated very low. It's $15 Not doing well $13 people don't like that one 37 reviews only three stars So let's look through here. So sometimes buying these super cheap ones like this even though they look super cheap People don't like them. They're not good. So let's scroll up to the top here And this one here $7.95. It's a very basic one But it's got 328 reviews and that's the cool thing with printful, which is one of the print on demand People I would recommend is you know, they let you know people get to rate these things. They say what they thought of these shirts This one here is a woman's shirt 32 reviews. This is a hundred and six here. It's a unisex one But we know women like to have ones that are more form-fitting. So if you're selling the women, I would recommend that This is a unisex one right here That one there didn't get great reviews This one here got pretty good reviews guys 26 and 17 95 and So you can just scroll through here and find out which shirts are good. Which ones are now another place You can go to is Jiffy t-shirts to find reviews And you can look at the different types of shirts and see which ones did well because they saw a lot of shirts there And then you can go over to printful and actually read the reviews of the t-shirts like we just did So let's check out Jiffy t-shirts real quick Okay, so we're not going to actually sell out of Jiffy t-shirts But what we're going to do is we're going to look over here because these these t-shirts here are sold in bulk So you're going to have hundreds or maybe even thousands of reviews on let's go ahead into Jiffy right now and check it out All right. So here we are at Jiffy and if you look through here, we can blow this up a little bit They have Gildon Which is a top seller 17,000 reviews on this one here. So so we know if it's a Gildon that's probably going to be a pretty good shirt We can scroll down here and look at some of the other ones. This is Gildon This is Haynes right here. So you can see Haynes t-shirts. You can see what the rating is on this one here This is a thousand reviews and it's four and a half stars So we can actually figure out from here Which of the shirts are good because sometimes when you get over to something like Printful and you go over there. There's you know 20 reviews or 15 reviews.  How do you stop them?   They're not gonna like that. Okay They're just not gonna like that or worse yet. They go ahead and order it from you and it doesn't fit They're automatically gonna want to refund from you So the first thing I will tell you is if it says in that corner right below the picture Size runs smaller than normal. Don't get it. Okay, don't get it. Don't get it Those those are causing more refunds than anything else you can imagine in these printable demand stores number seven I want to tell you is be aware that Some of these t-shirt printers don't print big letters So if you've designed something and it's got a big print on it and big letters on it It's supposed to cover the whole chest of the shirt You've got to look at the print area of that particular Shirt and that manufacturer because in many cases it's a lot smaller and it's not gonna fit your design And you've wasted all your time by coming up with this design that's not even gonna fit on the shirt So that's another thing that's really super important. The next thing I want to tell you is number eight Now when you get these t-shirts, you're gonna be stuck with the image that they have on the site So when you design a shirt, it's gonna be a flat shirt laying somewhere with your design on it But if you have a mock-up, it's gonna sell much better. I want you to check out a place And I'm gonna give you a link below Where you can get this it's called place it Dot net and I want to go over to place it dot net and what place it dot net does is you can upload your image There and they'll put it on a person on a shirt, right a male female Whatever in different, you know poses and you can actually use those images on your sites Let's go check that out right now. I'm over at place it dot net right now So I'm gonna go to t-shirts and what we're gonna do is we're gonna upload an image So I'm gonna pick an image right here off my computer And let me find an image that I want to use Okay, so I've got this image and this is me Doing some of my coaching stuff and that's the actual image right here. So we're gonna go ahead and crop it And I've got that image ready And I'm gonna pick a white t-shirt. Okay And then look at this They've now put that image on all these shirts here now I can move this image around and change it the way I want, but if you notice they've got all types of different people that are now wearing my Shirt look at that check it out Is that cool or what? And the thing about this is people can actually see what it looks like on a person Which also will drive down your refund because if they can see what it looks like on a person You know, then they're gonna be better to imagine it, you know So you can see it on all these different types of people. They've got all different ages And you can just scroll through here now you could do this on mugs You can do this on you know posters whatever you want, but if you've noticed they've just done It looks like thousands of these So any type of person you want to wear your shirt for your ads, you know, you can go ahead and stick it on there Now this was just an habit or ad that I Used or picture I use for one of my coaching calls Now don't think you can screenshot it because it says place it on here and you can't do it can't steal these But this is very economical. It's like a few dollars a month and you can have access to all of these different People in here. So I would highly recommend using place it will really help you with your Designs it'll help you with your sales and you actually will get more sales now The next thing I'm going to tell you is to use a print company that does what you want Okay, so there are print companies that will print on the front and back of the shirt. It's great. That's what you need That's perfect. That's what you need There are print companies that will also print on the sleeves of a shirt So if you want to print on the sleeves of a shirt, you've got to look at those particular companies Because if you don't have the ability to do that then of course, you know, it's not going to work for you So you want to make sure you're using the right company for the right services and what you are doing you want to make sure they're trustworthy and I'll leave a link to some of these, you know print-on-demand companies below in the description But just pick the one that works for you and understand that each one is a little bit different the size of the image is different Where they're going to print on the shirt is different and keep that in mind when you're picking the print-on-demand company You want now if you're going to use some type of niche or logo or something I would highly suggest Before you do that that you actually check to make sure that your idea hasn't jumped the shark now years ago There was a TV show on called happy days, and it was one of the most popular shows on TV It did great It had you know rave reviews and everybody loved it But as time went on times change people kind of got bored with it They got tired with it and they were doing more and more things to get interest in the show And on one of the shows Fonzie actually jumped over a shark In one of the scenes and that started a site by a guy named John Hein Who now works on the Howard Stern show and he started this the site called jump the shark and what jump the shark Essentially was was that you could tell when a show was over with when they did something on the show That just was totally ridiculous So he started the website jump the shark and he actually ended up selling that site for a lot of money To a big corporation and the corporation never did anything with the site, but it did start the jump The shark type saying so you may have a great idea, and it may be an idea that is super It's fantastic, but let's check and make sure it's a good idea first and you could do that by looking in Google Trends So we're gonna run over to Google Trends right now check that out, and I want to show you How you can actually check to see if your trend is still trending okay? I'm here at Google Trends now And this is a really cool site. I mean it's got some really cool stuff in here But what you can do is you can type in any term in here to see which direction it's heading to see what's popular So I'm gonna type in something that I have no interest in, but I don't know if other people don't put ice skating All right, let's see what we come up with here And it looks like ice skating. Oh there was a big insurge or resurgence of ice skating What do you know right around Christmas time? Okay, so this is within the past 12 months and what you can do is do a drop-down here And you could say within the past 90 days five years I'm gonna go five years, and I'm gonna see how ice skating is trending now if you look at this chart guys This is an example of a seasonal interest. Okay, so here's 15 16 I guess 17 18 19 right here, and if you notice it always peaks right here Which is looks like December to January right December to January This is where all the interest in ice skating is December to January and there are other things like that So if we get rid of ice skating Let's remove that and we put in another term. We'll put in baseball So if you're selling products that are related to baseball if you notice see the same trends Over a period of time and you could actually probably go back to the beginning of time Which is 2004 as far as Google goes and you notice It's the same trend over and over and over and over and over now. That's not true with all Products, so let's let's remove this for a second and let's go in here and put in fidget Spinners and let's see what that looks like. Look at that. That's interesting, right? So over time there was a huge interest and it looks like in 2017 and there's been some interest since then but almost zero So this is what I would call a fad product It's a product where you're gonna jump in there and if you get in at the right time You can make a little bit of money, but it's not gonna last. It's not gonna last And I'm gonna pull up a couple more examples here. Let's pull up Cupcake stores And that was a big fad a while ago Or a cupcake shop, I guess would be better And let's see what that's doing Yeah, there it is again so if you look over time there was like some interest some interest some interest and then in 2000 January 2019 cupcake shops for some reason were really super popular And you can type in any type of like I think foods are a good thing to put in here just to check them But we can put in there frozen You know I'm gonna get rid of Ohho. We don't need that. We just need to frozen yogurt Okay, there's frozen yogurt and as you can see There's some trends here. Okay. It was like dead in 2004. Nobody was searching for it and then it looks like 2011-12 it was going up and up and up and 13 and it's going back down again So if you were trying to sell frozen yogurt, I would say stay away from this now That's not to say that a lot of these products don't have peaks and valleys And if you can jump in in the valley when it's getting ready to peak again Yeah, you're gonna be good off But make sure that whatever you're trying to sell even if it's seasonal, there's nothing wrong with selling seasonal But even if it is seasonal make sure that you understand it's seasonal You don't want to get surprised by these things like our survival foods are kind of politically driven depending on who's in office And you know, they're gonna sell really well when a Democrats in office and not so well when a Republicans in office And there's a lot of reasons for that but the point is we have to understand that we got to be prepared for that We got another sales are going to go down. We can't depend on those sales if we've got a Republican in office And there's a dinner guy in office. We could depend on the sales It seems like we sell tons of them because people are worried about the guns and food and everything else So just keep that in mind when you're marketing your product So I've given you a lot of tools in here to sell your T-shirts and your niches out there, but I want to hear your opinion You know, what have you tried out there put that in the comments section below Let me know what you've tried Let me know what worked for you If you have questions about how to do any of this or any of these things I discussed in this video Feel free to put that in the comments below. I'd love to hear your comments. Now, don't forget grab your $97 course There's a free e-commerce course you can get and all you have to do is click the link I mean, it's really easy to do and you can get access to a free e-commerce course worth $97 so check that out. That's super important that you do that in addition to that if you haven't done so already Join the family just join the family. How are you gonna do that? You're gonna hit that subscribe button down there once you hit that subscribe button down there You get one more step actually to Gotta ring the bell you got to turn on notifications And then the third step is you got to turn on all notifications because it's gonna default to personalized or whatever Make sure you turn on all notifications that way when I upload a video We can tell you about it that way when I'm going live we can tell you about it You don't miss out on stuff you get in front of the line and you don't have to search for this stuff It comes to you so make sure you do that very very important now if you like this video Give me a thumbs up down there. I really would appreciate that. Don't forget Subscribe notifications grab your course, and I'll see you in the next video Thanks for watching my video Don't forget to subscribe to my channel and click that little bell right there so you can be notified every time I do a new video Also, click one of these videos there


They're saying just keep it, yeah, like we can go on forever while we're coming off. It's the same after we're taken into a pool. They're hopping, pushing to the south side. Hey bird 2, bird 2, if they land at the same time, there's 9 and 10 at. Okay, strength of 13. External for a bit, like here like the Apex. Start cycling guys over for Lyndon. Run that long wall if you see any window. Close, close. School field. Hey, one, two. Three, two, one. I'm losing my grip a little bit.


Are you wasting your time learning MySQL in 2020? Well, you used to write video. Let me explain. This video was brought to you by Digital Academy, your number one source to learn how to make money programming and get that six-figure salary you desire. Our Academy have a wide range of courses, including 3K in 30 days, our mentorship membership program, and much, much more. When you sign up for our free community, you get access to our membership community with like-minded professionals who's gonna help take your career to the next level. So let's take the first step to get started and really take your career to the next level with our seven-step money guide today. So let's go ahead and click the link below to sign up for our free seven-step guide to help you get your career started today. So you're trying to determine if you wanna learn MySQL and you're really trying to put yourself in a position so that you can get that six-figure salary learning MySQL, but you wanna know, hey, am I gonna get rewarded in this? Am I wasting my time and I wanna give you guys some context on this? So, guys, I made some quick points here. I wanna make sure I cover them, but I wanna tell you a quick story about my particular situation so it'll resonate with you guys. If you guys haven't already know, my start in programming started on the database side with SQL Server, Microsoft SQL Server, and I started writing reports and then store procedures and then functions and start passing data alongside of the core application, the controller, and end up doing a lot of front end work after that. So I started off on the database layer, got exposed to the back end, and eventually got to the front end. But a lot of you guys like that path, but you're focused on the MySQL side of thing, which MySQL is a really great platform. I've used it for years and it's very reliable, especially after technology advances. But at the end of the day, guys, you have to figure out where the value is in a particular programming language.  But I would say for a long time, it has this wrap of small projects with MySQL and a lot of web-based application. It really didn't scale in an enterprise solution or at least this was the perception for a long time. But guys, Oracle is really getting it and making it an enterprise solution so that it could scale or the perception of it is, it could scale, it always could scale in the past. It's just a matter of really doubling down on the technology. But with technology going in the direction it is, it's really in a position of win. So at this point, you got a lot of applications that are leveraging MySQL from a web perspective, even in a non-web situation, if you got some data to store, you don't wanna go through the Microsoft world with MySQL and with MSSQL and all that, you got options there, guys. So at the end of the day, should you learn MySQL in 2020? The answer is yes, guys, you should learn it. Is it gonna be as easy as Python and JavaScript in a lot of the sexy front end languages? Probably not because at the end of the day, guys, with JavaScript or PHP or any front end languages that you can really visually actually see the output on the screen. In a lot of cases, you can with MySQL, but you have to go through an extra hoop to be able to display that information to the end user. And as a database developer myself, I always recommend you guys to start with reporting and then start to learn how to update existing data via the application. And then start to work with adding new data. And then once you get comfortable with the other three, then you can start removing data or at least at the very minimum flagging in it as high from the application so that it could, you don't necessarily delete it, but the application can't see that particular data. And that's the way I teach in my seven step guide, but at the end of the day, guys, you have to find a way of learning that works right for you guys. So it's always better to walk before you crawl. That's my number two point. And just start with the selects, guys. Start with selects. I've done a ton of projects without updating or modifying anything. I just created a store procedure that's gonna pass data to an application or pass data to a report and then kind of go from there. A lot of you guys get called up and, hey, I gotta learn everything fast because I'm not technically a developer unless I know everything about a particular programming language or in this case, a MySQL language, that's not the case, guys. You can come in day one providing a ton of value in the reporting, the alerting, the displaying of certain data at the right time just by doing select statements, guys. I would probably say my first year, year and a half, I didn't do an update statement to a particular dataset because I relied on the application to do all the data updates. I just had to display data at the right time. Send alerts, really notify the end user or it's a lot of value being able to display data at the right time and actionable time where they can take action and really put them into position to be successful, guys. So it's so important that you guys get that graph, that concept. And then, obviously, you can get into the inserts and delete and new records as your comfort level gets better, guys. But at the end of the day, you have to be hungry and find those projects that you can leverage with MySQL. Do not, and I repeat, do not go in a company that leverages MSSQL or any other Oracle database that's not MySQL and start inputting MySQL databases in there, guys. Unless there's a project that makes sense to everybody, everybody's in agreement with it and it really gonna benefit the client. A lot of you guys think, hey, I learned one programming language, I learned MySQL, and I'm gonna apply that to every project that I do, which is not a good strategy, guys. Every company has a web stack or software stack currently in place already. We're in 2020, unless you're dealing with a brand new startup, they have existing legacy systems. You gotta determine, are they happy with those legacy systems? What their roadmap to upgrading those systems are going to a new stack? And then whatever their roadmap is, if MySQL's in that particular roadmap, then great. Then you can start inserting it. But if not, then you gotta see what database language they currently have and then you leverage that. The good news is SQL database syntax is pretty, if you know one, you can learn the other one pretty quickly. So if you know MySQL, you can learn MS SQL pretty fast. The concepts are good. The work is gonna be is learning a company's data model. What is the major elements that they need to know as far as just where the data is stored, how it's linked with multiple tables, how it links with different areas, different departments, what they wanna see from a accounting standpoint, from an HR, from a business, resource planning, recruiting, HR, is a lot of different data points, data stores, data sets that you have to know the model and be provide that relevant data at the right time, guys. So a lot of moving pieces, but at the end of the day, I want you to step back. And first of all, I'll say yes, you made the right choice learning MySQL. So let's get started.  And I want you in two weeks to be able to get yourself ready for small gigs using MySQL, maybe a report, maybe storing some data that they currently have in a physical location. You want to be able to store that data. Preferably if you can automate as much of it as possible, that'd be great. But if you have a form that they have to put that information in that is ready for them, that's just as good too, guys. So at the end of the day, you have to learn. You have to start from somewhere and then you got to take that knowledge and know where to apply it at the right time and do what's best for the client in the short term and the long term, guys. So I want to make sure I hit all these points correctly. I covered everything here. And the good news is, guys, I'm gonna have more of this type of content coming up as far as just which programming language to learn. But the difference between me and what everybody else thinks in my seven step guide below, if you haven't already signed up for it, I have premium courses down there that's gonna be a mentorship program. Also, you're gonna have premium courses if you already signed up for my seven step guide that's gonna help you identify your current skill set, what you need to learn and how do you get that first job a gig and then really take your career to the next level with a custom role map specifically for you. So links are below to all that. Go ahead, check that out, support the channel. We're gonna make sure we come up with a specific role map for you even if you're not ready to take all the action and go from end to end right now. We can just at least put it on the table so that you can be aware of it. You have your plan ready. So whenever you're ready to execute, it's already right there, guys. So, like, subscribe to the content, guys. Do you agree with me? Comment below. If you disagree with me, comment below and let's start a conversation so that we can make sure we're on the same page, find that right role map for you, really put you in a position to win at my sequel. So guys, like, subscribe to the content again. I got my link to my seven step guide here so go ahead and sign up for it. It's free and I'll see you guys in the next video. Peace.


Don't I don't mess around too much. You know, I do it very playfully of course like I'm very playful, dude but I'm also very dominant and very purposeful you know and I cut to the chase I don't like dancing So anyway, let me show you just Wow Go the old tactical or Jeffy.  It's old school Yeah, that's not coming. Yeah, cut right to the right to the chase Time management tool for me just like what we're going over right now So those are pattern drops somebody's talking about Something totally random about my how my X, you know, you should go on a tangent about our X or you know why You know knows why you guys should be friends or just I don't know, you know So anyway This is what I'm about essentially is what I'm so Come in with one of those those. Hey guys I want you to command the attention in that the smiling in a positive way. Okay. Hey guys. How's it going? It didn't it didn't really command my attention. It was a lot better. You guys agree. Yes. Yes Heaps better from like when it first started good. Let's uh just for time. Let's give him a round of applause real quick Good. Thank you. And let's mix it up. Let's mix it up All right, so we're gonna start at the full feminine Yeah, go good What's guys do is really well, so you don't need to get in that mode of Why am I so sad? You don't have to do that. You can just come Why guys have fun with hey guys, I saw you sit over here. I was like I had to meet you guys What's your names? Let's do it. I want full feminine Why is it full?  Why do I want that? Yeah, it's a it's a range of emotion I want because if you know if you can do the full feminine Then you know where you don't want to be and if it's like taking like kind of like You know the cliche the pill the blue pill or red pill whatever from matrix whatever It's like once you feel it and you feel how awful how awful did acting full feminine feel Yeah, you don't want to go back there I see repetitively a lot of guys doing this now full masculine. How did that feel? That felt better. It felt good. Yeah, at least you felt like you had respect for yourself.  Because that is not your role It's not who you are So full feminine. Let's hand it up. How are you doing tonight? Good, I like it good. Okay Let's do this. I just want to emphasize a little bit more So you guys don't even have to think about the word you're using let's just talk about rugs It is content you're relevant because what we're all responding to is just the emotion that he is feeling at the moment That's what you respond to that's what women respond to Okay, so just coming in the neutral rugs rugs all day, baby Guys get this my house just got re-carpeted and I got two free rugs with it. They match the ceilings It's awesome I'd like you to engage him a little bit more You know just not just engage me, but this is a group, you know I just got back from the rug store and they told me that there was a two-for-one special I got one brown rug for the upstairs. Good. Good. Good That is fantastic No, it was fantastic.   I mean I mean That's what it is. The fuck's up guys. You have no girls with you.  Let's let's let's talk about rugs Sorry Guys get this that's got the most badass rug the chick digs it. We banged on it eight times already How do you feel I feel like that was probably weird, but I like How did you feel inside doing it? I felt kind of good like yeah, I banged on the rug You felt now did you feel strong Yeah, yeah, this makes you feel strong. It makes you feel good now. How'd the first one feel? Man it hurts. Yeah, like it really hurts. How did it look the first time to you guys? No, no now Now the third one the full masculine did you Respect them Do you like them? Maybe no He had a little thing called relating. He's like, whoa, thanks. I'm growing the carpet. So Yeah, pay a little attention. I would actually need to make it even full more masculine I would be attacking the dude, you know because I do kind of want that, but don't worry. It's no worries It's a it was good and it's not always louder louder. It's just a byproduct of what you're feeling. Am I it's like Who are you? What are you doing? You might be taller I'm a little wrestlers online Yeah, it doesn't you know, it doesn't always have to be louder It's just the intensity emotion you're feeling and I have to watch out because I really get engaged in the stuff If you guys need some help on some of the stuff even like where I'm talking about There's a fantastic thing called Meisner technique acting and it's all about expressing emotions in the moment Come cheap boot camps even and it's great fantastic like emotional training and and it is kind of like You know almost like acting especially on these because you have to be able to turn on and off emotions like this And it's a big part of what I teach I keep up being full masculine man purpose You know the core fundamentals of confidence and like just really hammering the fundamentals game is 80% just in those fundamentals If you're working on all this stuff, then you know I can always tell where people are working any other part is just mastering your emotions And this is actually part of it because I'm teaching you how to feel good Master your emotion feeling good at all times the positive always game start acting this up. You start feeling good Start acting like a man leading You know unapologetic good tonality good body language strong eye contact All this stuff is all part of it


This study presents a new type of organic axray imaging scintillator that uses singlet fission for enhanced axray sensitivity and imaging resolution. This scintillator has been shown to have near-unity acetone utilization efficiency, resulting in significantly improved axray sensitivity and imaging resolution compared to other organic scintillators. This article was authored by GNXIN Wang, Jun Yin, Luis Gutierrez Arzillas, and others.


And welcome to my talk on OPSI, Fast OPRF, and Certified PSI from Vector OLE. This is work I did at my time at home of the University of Berlin, and joined work with Peter Rindow from Visa Research. So this talk is going to be about Private Set Intersection. So let's quickly introduce what that is. Private Set Intersection, or Short PSI, is a protocol between two parties as involved. And they each have some set of input elements. The goal for the parties is to learn the items they have in common, so in this case the blue triangle and the red circle. So if at the result of the protocol all the parties learn is their intersection of the sets and nothing beyond that, then we call that PSI protocol actually secure. So there are many variants of PSI protocols. In particular, we could have, for example, both parties have both parties receive the output or only have one party receive the output. We could have associated values with the inputs or we could have the output secretared, which allows us to subsequently perform a different secure computation on the secretared output without the parties learning the intermediate results. OK, so in the last couple of years, the most common approach to build private set intersection protocols was based on oblivious pseudorandom functions. What is an oblivious pseudorandom function, or OPRF for short? Well, it's the distributed equivalent of a PRF in the centralized setting. So Alice here has the key to the PRF and she's going to get that as a result of the OPRF protocol. Bob, on the other hand, only learns the output of the OPRF on certain input values that he chooses at the beginning. So here, for example, Bob chooses two input values and gets the corresponding output values. Alice, on the other hand, who has the key, can compute the PRF value on any input she chooses offline. So the main observation here is that Alice can compute F locally, whereas Bob only interactively and only on a fixed number of inputs. Now what do OPRF give us? So how can we use OPRFs to build PSI protocols? Well, the approach is actually quite simple. Bob simply inputs all his elements into the OPRF protocol and in turn gets the corresponding PRF values. Alice gets the OPRF key and now can locally compute the PRF values for all of her inputs. And now she's just going to send those over in the shuffled order to Bob, who can then compare each of them with the OPRF values he got for himself. And as soon as he has a match, he knows that the corresponding input was in the intersection. So that's a very simple PSI protocol. And the work I'm presenting here follows the same approach. So we're also going to build an OPRF function, but we're going to build one that's more efficient than previous work. And that is also going to give us more efficient PRF protocol in turn. So the basic protocol underlying our OPRF construction is called vector only. I'm also quickly going to introduce what that is. Vector only. So only here stands for oblivious linear evaluation is basically a correlation generator that again can be run between two parties. So the vector only generator outputs three vectors, A, B and C, and a scalar delta. So here Alice gets B and delta and Bob gets two vectors A and C. And all of these are pseudo random, but with the property that they are correlated. And the correlation is such that C equals A delta plus B. You can think of this as an additive sheet secret sharing of our vector scalar product. So A delta is the product, and then C and minus B are the secret shapes. Now there are several works that explore how to build vector only generators, and we're building on them to build our OPRF construction. Now how can we get from vector only to an OPRF? Now suppose for a minute that A, B and C are very long, in particular that they are exponentially long. That means they have as many elements as there are possible elements for OPSI protocol. Of course in practice that's not going to be possible, but assume we have that for a moment and then we're going to see how we can actually get a realistic OPRF. So if we had such a long vector only correlation, and if in addition Bob could choose one of the vectors A to be 0 at certain positions, we could have an OPRF by Bob choosing A to be 0 at all the positions that correspond to his input elements. So if A of X is 0 at all the positions of Bob's inputs, then at these B and C will be equal. So irrespective of Delta, which is still random. And now if we just put those into a random oracle, we immediately get a PRF, and it's one that Bob can evaluate at all of his inputs, and Alice can actually evaluate anywhere, because the key is going to be just Alice's vector B. Now observe that at positions where Bob doesn't program A to be 0, C and B will not be equal. And that means that the corresponding result of the OPRF will not be equal. So we still have the property that Bob can only evaluate the OPRF at positions he chose in the beginning. Now that sounds very simple, right? But of course there are several problems with this approach. First of all, with just a vector only generator, Bob cannot choose A since it's generated pseudo-randomly. Secondly, as I said, A, B, and C would have to be as large as the OPRF domain, and that's not realistically possible with any vector only generator. And thirdly, if Bob acts maliciously, he could just program A, so if he can program it at all, you can program A to be 0 in more than n positions, right? So you can program it actually to be 0 anywhere, and therefore learn Alice's key, and that makes the OPRF protocol not secure. So I'm now going to show you how to fix each of these issues, and at the end what we're going to get is an actual OPRF protocol from vector only. So for the first problem that Bob cannot choose A, we're going to use a standard construction that reduces the problem of a chosen input OLE correlation to a pseudo-random OLE correlation. So if Bob cannot choose A, but he can instead choose a different vector P, he can just send P plus A to Alice, and here A is going to act as a one-time pair to mask P. And now Alice's key just becomes B plus delta times A plus P, and this again satisfies the vector only correlation, so we still have correctness. But now Bob can actually choose this vector, and that allows him to program it in exactly the way we want it to. So OK, that was simple, and that's a non-construction, so nothing new. The second problem is somewhat more involved. So for this ideal vector only protocol, we would need A, B, and C to be as large as the full OPRF domain. Since we cannot have that, we're going to go a different approach instead, and we're going to assume we have a public exponentially large matrix M. So this matrix again is as large as the vectors we would ideally want to have, but it's not very wide. So it's very tall, but not very wide, and the number of columns is just slightly more than the number of inputs that Bob chooses. What Bob is now going to do is choose his vector P such that the product of this exponentially large matrix M and P is zero at the positions he wants it to be. And that then allows us to use a vector only correlation of only size M, and M is size of M, so it's quite small. Yeah, so let's see how that looks. Here on the left we have the matrix M. Again, it's very tall, and it cannot be represented anywhere in memory. But we can index it by the elements that we have in Bob's input set. So Bob can just select the rows that he wants from this matrix M. And we have a short vector P, and we want the product of M and P to be zero at exactly the positions that correspond to Bob's inputs. How can we achieve that? Well, it's rather simple. We just choose the rows of M that correspond to the inputs, and then solve the linear system M P equals zero. And we're going to see several approaches that make this linear system solving actually quite efficient. As for the third problem that a malicious Bob can make now M P zero in more than positions, well, we're not going to actually program zero there, but we can program any value we want. And in particular, we can program a random value that's derived from the input element. So here we're going to use a random oracle, and use the output of the random oracle as the value programmed for M times P. So here again, the only thing that changed to a previous image was that now M P has the hash of the corresponding row in its value. And the intuition why this solves the problem that we had before is that here if Bob was able to program P in a way that contains more than N positions, or more than N positions, then that would correspond to compressing a random oracle, since that's not possible information theoretically. That means that Bob cannot find a vector P that programs more than N positions. And so that ensures that he can only query the OPRF at N positions. So this gives security from that perspective. Now, okay, the question is, we want this large public matrix M that has the property that Bob can efficiently choose sub matrices of it. So can efficiently index into it and choose a row that corresponds to an input. And additionally, we want him to efficiently solve the linear system. So M at the chosen rows times P should be equal to the hash of the row index. Now, there are several storming approaches that we can take here. One would be to just take a pseudo random matrix. So each row of M will be defined by a pseudo random generator that is just a PRG of the input I of the index I. Now, that is still quite concise. So if we do that pseudo random over field F or over binary field, then we only need roughly OVN columns in this matrix for it to have a solution. But the problem is that now finding that solution takes cubic time, because the best we can do here is Gaussian elimination. So that's quite inefficient in terms of computation. Another approach that's also been cited in the literature quite often is a garbled bloom filter. So here we don't have completely pseudo random rows, but instead we have a binary matrix that is only one at very few positions. So here the number of positions is equivalent to the statistical security parameter of lambda. And that means we only have lambda nonzero elements at each row. So that means we can also we can solve the linear system in linear time since it is a sparse system. But the issue now is that we need a very large number of columns in the matrix to ensure there's a solution. And so that means the communication becomes quite inefficient since the size of the rows is also the size of the vector only correlation that we have to generate. So one approach that is both efficient in terms of computation and communication is what we call the Vandermonde's order. So here m is going to be the Vandermonde matrix. That is each row is going to contain all the powers of the row index from the 0th to the n minus first. So now multiplying a row times any vector v is the same as evaluating a polynomial with coefficients from v at the row index x. Now if our matrix has that structure, that means that solving the linear system, so taking the rows of m that corresponds to Bob inputs and solving mx times p equals to the hashes of x, that's the same as interpolating a polynomial where the coefficients are p. And the polynomial is over the rows in a row indices x. Then computing the inverse, so multiplying the matrix mx times any vector v is the same as multipoint polynomial evaluation. So here's an example of how a polynomial could look like. So at any point x, we want the polynomial to have the hash of x as the value. At any point that is not in Bob's input set, we don't care, we just care about the exact input that Bob has. So the nice thing is that the number of columns this matrix needs to have is exactly m. So it needs to have the powers from 0 to n minus 1, so that's n many of them. So that means communication-wise, we're as efficient as we can get. Computation-wise, we know that polynomial interpolation and multipoint interpolation can be done in time n log squared n. But ideally, we would like to get rid of that log square factor. So ideally, we would like to have something that's linear. And for that, we have a second approach that we also present in favor. And that's based on previous work, and in particular, called the Pax of Sova. So the Pax of Sova is nice because it has a linear time n coding and decoding algorithm. And also, the rows have size of n. So they are larger than n, but only by across them. So the idea of Pax is inspired by cuckoo hashing, and I'm not going to go too much into it, but I'm going to try to get a high-level integration. So in cuckoo hashing, we have two hash functions that map to a space of a fixed size, here n. And exactly the two points that correspond to these hash functions will have set one bits. Additionally, we will have all of lambda uniform bits for each row of our matrix. So if we construct the matrix in that way, then we can actually solve the linear system in time linear in n. And how that works is by observing that the left part, so the left part of this matrix that has only very few one bits, has in most cases very few cycle if you interpret it as a graph. So if you just take all the columns that are part of cycles together with the dense part on the right, and you solve that using Gaussian elimination, for example, then the remainder of this matrix can be solved very efficiently in linear time. And so that's the approach that was taken in this crypto 2020 paper. And that's basically the same thing we're going to use here. So now we have two approaches to generate this matrix M. One is a bit more communication efficient. That is the van der Montsover. And the other one is very efficient in terms of computation and also pretty efficient in terms of communication. That's the taxes. So how does the full OPRF protocol now look like? We start with a vector only generator. So Alice gets delta NB. Bob gets A and C, such that C equals A delta NB. Now Bob uses whichever solver he chooses, so either the van der Montt interpolation or the Paxos encoding. To encode a vector P is such that the matrix indexed by his elements equals to the hashes of the elements. He then masks the vector P with the output of the vector only generator and sends P prime over to Alice. Now Alice just adds delta times P prime to her output of the vector only correlation. And that's her key. And now you can see that both parties actually can compute locally the values of the OPRF. But the property here is that the values will only be equal for elements that Bob in the beginning programmed to be equivalent to the hash in the linear system solving case. So now that's the full OPRF protocol. And if we plug that into the PSI from OPRF construction, we actually get a secure PSI protocol. As said in the beginning, you might also want to have a variant of PSI where the output is square. So that is useful if, for example, the two parties want to perform a subsequent computations on the output without learning the intersection elements themselves, but only a function of the intersection elements. For example, the sum. So an approach to do that that was presented in 2019 is to make the OPRF programmable. That means that Alice can fix the value of the OPRF for her inputs wide to a certain value that she chooses. So if we have such a programmable OPRF, then we can use just cuckoo hashing and generic circuit-based PSI to the circuit-based MPC to obtain a circuit PSI protocol. And we're going to follow the same approach. And so for that, I'm going to show you how to make the OPRF that I just presented programmable. So here at the beginning, Alice has, in addition to her inputs wide, she also has the labels z. So she wants to program the OPRF in such a way that for y1, the output is z1. Now we start by just running the simple OPRF protocol that I showed you. And so Bob inputs his elements x1 to xn and in turn gets output PRF values of x1 to xn. Alice, on the other hand, gets the key and can now locally evaluate this PRF on all of her inputs. She does this and subtracts the result from her labels z. So observe that now this z prime is essentially pseudo-random if you don't know the corresponding y values. Now if we now have an encoding that maps these ubi values to these pseudo-random z values and that also hides the values y that Alice inputs, then we can send that over to Bob without revealing anything. So what we did in our paper was we analyzed the Paxil solver and saw that, in fact, it can be transformed into such an encoding. So in particular, at any point where in the linear system solving of the Paxil's encoding, where there is a choice between multiple options, if we just choose randomly, then this satisfies the condition. So as long as z prime is pseudo-random, nothing is revealed about y by this encoded vector p. And since z prime is masked with OPRF outputs, which by definition are pseudo-random, then this suffices here. So Alice can encode this vector p and send it over to Bob. And now both parties can locally decode the Paxil's encoded vector on their inputs and add the results to the OPRF values that they already computed. So this gives them the programming OPRF value. And if you do the computation, you will see that for x and y, so if x is part of Alice's input, then actually the output of f of x will be equal to the corresponding label z that has input into the computation. So we have correctness here. And as I said, since p doesn't reveal anything, since z prime is pseudo-random, this also ensures a privacy for Alice's input. So with that, let's evaluate the protocols that I just presented. So we implemented both the standard PSI protocol as well as the circuit PSI protocol. And for the standard PSI, we also have a semi-honest and malicious variant. So this now is the semi-honest variant of PSI for a rather small input set size. And we compare it with previous work, that is the Paxil's paper, then another work by Jason Miao from 2020, and then the classic KKRT PSI protocol. And we see that in the LAN, still KKRT is the fastest, even though our new protocol has the lowest communication. We also see that if we exclude a one-time setup phase that is only present in our protocol, then actually our protocol is the fastest in any setting that's not the one. If we include on the other hand, this one-time setup, then the protocol of Jason Miao is still faster. However, if we increase the input size, so if we now go to a million input elements, then we see that very bandwidth constrained settings, our protocol is the fastest, even if we include the one-time setting. And that becomes even more apparent if we go to 2224, so really large input sizes. So here in the LAN, still KKRT is the fastest, but in any bandwidth constrained setting, the fact that we have such a low communication in the whole PSI gives us an advantage in terms of computation times as well. In the malicious setting, we see a similar picture. So here I have all the three input sizes at once. And we'll see that only in the LAN, the protocol, the original Paxil's PSI protocol is faster than ours by a small margin, but then in bandwidth constrained settings, ours is faster. For circuit PSI, we actually have two choices in our implementation. And that comes due to the fact that the circuit PSI at the end has a generic circuit-based MPC protocol. So we implemented that using GMW, and for that we have a choice of OT implementation that we use. And here we can either use the standard IKNP OT extension or a more communication efficient one that is silent OT. And we implemented both of them and compared them. And we see that in fact, in bandwidth constrained settings, silent OT outperforms IKNP. Both of them in turn outperform the original circuit PSI protocol that ours is based on in terms of communication, and then at least one of them outperforms them in terms of total running time. So that concludes my talk. And I just want to quickly highlight two related works that have been presented at crypto this year, and that can also be used to improve the protocols that are presented here. So one of them is silver, which is a faster vector only generator. So we use one from CCS 2019. And what's nice about silver vector only is that it's both faster in terms of computation and communication than the one we use. So this will strictly improve the PSI protocol if you implemented a mold-based PSI with this silver ball. A second paper that appeared at crypto was about oblivious key value stores. And those are basically more efficient variants of taxes. And again, just like the original taxes, those can be used in both our PSI and circuit PSI construction. And so can significantly reduce the communication overhead of those. With that, I'm concluding my talk. And I would like to thank you all for your attention. And I'm happy to take any questions.


Everybody I'd like to introduce you to Taylor Kempel Taylor was one of the few people who sent multiple Pretty good talk suggestions to the program committee and we randomly selected this one But how did you randomly select it? So welcome to the entropic principle about dev random and dev you random I Don't actually know of a concept called the entropic principle I just thought it sounded funny when I was thinking of a title So I'd like to start by saying if you don't take anything else away from this talk Just know that When you're writing an application and you need to make a random choice use dev you random it's a safe thing to do it'll work anywhere and Even though you might have this notion that it is it is only a a false idol of randomness Or it's only pseudo-random not really random. That's actually not really right. It's it's it it'll work So dev random and dev you random our device nodes on pretty much any modern unique system They have the property that when you read anything from them when you read a bite from them Nobody can predict other than the kernel what that bite you will read is They also have the property that you can Influence what future reads will Yield by writing to them, but I'll I'll get that later about entropy sources Now they're different in that When you read from dev random rather than dev you random They're random will sometimes block now The usual explanation of what's going on there is that there's something about information theory and real randomness versus pseudo randomness and But really the real difference is that dev random sometimes blocks and dev you random never blocks And there is no shortage of Very confused verbiage on the internet about what the nature of the difference is but that's the real difference is dev random blocks dev you random doesn't so Why does it matter that it be unpredictable? Well, there are bad guys on the internet when you're writing any sort of Engineering system that talks to the internet. It is your responsibility to make sure that People don't eavesdrop on your conversations And they don't intercept your conversations and they will because there are there are there are people like This this character mr. James Clapper. Well, he doesn't do it personally but There's lots of nasty stuff on the internet and We need crypto in order to Avoid the nasty stuff and in order for crypto to work The parties involved in communicating over the internet need to have secrets that the bad guys cannot predict If the bad guys can can predict the secrets and the crypto doesn't work Here are some examples of where people used crypto and Failed to make sure that the secrets were actually unpredictable The There's a Taiwanese national identity database and it used a bunch of RSA keys That were generated by smart cards that are all thoroughly certified except that the well actually the certification process Didn't make sure that the random number generator actually worked. So a lot of the RSA keys had factors in common. Oops Sony used in Signature scheme for signing firmware updates Only they screwed up this the use of the signature scheme so that they accidentally revealed the signing key to the world and So anybody could sign PlayStation firmware updates Similar to the Taiwanese national identity database There was a project which you may have heard about factor ball net Just surveying machines on the internet with TLS SSL servers and found that a lot of them had Secrets that were entirely predictable and when the NSA and allegedly chose to Put a back door into a major US government crypto standard. They chose Allegedly the random regenerator. So this is obviously a very important part of ease dropping and interception Now whenever we're talking about a Security system In order to avoid The sort of voodoo that you encounter in discussions of lots of discussions of dev random and dev your random you have to have a An application in mind. What are you trying to accomplish with this system? You have to have a threat model who is trying to screw you up And you have to have a set of intended security properties. What are you trying to make sure the bad guys can't do? So in this case we are trying to Just generate bits with uniform random distribution There are several possible threat models who I consider Very easy one is that the attacker might be reading from dev random or dev you random on the same machine Now maybe not by running a process on that machine, but maybe by looking at the TLS Packets on some other conversation which reveals some output. That's usually directly from the application general regenerator Another threat model is that the attack you may try to influence dev you random by feeding in By feeding an entropy from either by like bang on your own keyboard or by sending network packet timings Which are where is to places where the operating system? Tries to Derive some of its random decisions another possible threat model is the attacker can totally compromise your machine and Get at the totally complete internal state of kernel memory now This is not a threat model that you can do all that much about but there is one thing that That that we that we can defend against with that which is about Making sure that if you have generated a key from dev random or dev you random in the past and somebody later Compromises your machine. You want to make sure that they still can't predict what your key was So these are three different threat models that are relevant in In discussion discussion of dev random and of you random and any time that you're worried about the security properties You need to consider the threat models that they the properties are relative to so we want to make sure that Whatever the attacker is They shouldn't be able to predict any output from dev random or dev you random that they haven't seen before Now if they get the total internal state they can predict future outputs because if your machine is rooted then you're hosed in the future but They shouldn't be able to predict any past ones. They shouldn't be able to figure out what PGP key you generated last week so in order to I Discuss what? Unpredictable to an attacker means we have to have some formalization of unpredictability And we're going to use the language of probability theory Very briefly in just a couple of slides to talk about that So a random variable is just a model for a physical system that you can imagine observing and you can imagine it taking on some particular value say little x 0 little x 1 whatever now and We have a probability theory notation for writing what the probability of observing one particular value of this Random variable of this physical system is Now given a random variable We need some way to measure how unpredictable it is because random variable here just means that there is some level of uncertainty In what you might observe But doesn't mean anything beyond that doesn't mean uniform random for example So the usual popular approach of measuring how unpredictable a Physical observation a physical system a random variable is is Shannon entropy and you've probably heard of information theory and Entropy in the past and this is the formal definition of it Roughly it gives the if you have in a physical system that has some number of bits of information Literally like it you have you consider you know a pair of coin flips that has two bits of information well two bits of output literally But if the probability of if for some reason you're gonna flip always heads For both of them or always tails for both of them and you're never gonna flip heads for one and tails for the other or tails for one heads for the other then the entropy in this physical process of flipping two coins is only one bit of actual entropy per bits of the random variable so the The rate of information is is one half bit of entropy per bit of output So that's the popular thing that you will encounter in in the information theory and especially in coding theory and Discussing you know care-correcting codes and communication channels and whatnot But it's actually not terribly useful for crypto because if we have some random variable big X say and there are a Lot of possibility possible observations for what X is and let's say maybe X is your choice of password And half the time you choose the password hunter to But all of the times you choose uniformly at random from the other possibilities The Shannon entropy makes it look like there's there's it looks like there's a lot of entropy in here That is it looks like there's if I wanted to if I as an attacker wanted to exhaustively Search the possibilities to looking for your password if I had some way to check the whether your whether my guess is correct Shannon entropy says that should take a long time right because if there are Well, you know if there are two to the 128 possibilities Then you have to search about half of those before you get the get the right one on average But in this case I have a pretty good guess what your password is if this is if this is the model that I have and This is how you know password crackers like John the Ripper work They have a you know the passwords are not chosen uniformly at random and John the Ripper will gas It's gonna guess password first I guess password one two three next probably and Hunter two is probably pretty high up there So instead in crypto we use a concept called min entropy which is a measure of Sort of the worst case here rather than the average case so in in the case of half the time your password is Hunter two and All the rest of the cases it's you know each each possibility has very low probability The min entropy of that is going to be one half And there's gonna be one there's only one bit of min entropy there which is Means very predictable Now if we're looking at a random variable with uniform distribution that is every possibility has the same probability For example a nice unbiased coin where the heads and tails both have one half probability Then the min entropy is just the number of Bits in of the possible outcomes if you if you have you know a one bit outcome in the min entropy of that is gonna be one If you have 128 bit string you're drawing randomly from those and with uniform distribution Then the min entropy of that is gonna be 128 and in crypto standard practice is to use if you're You know if you're making a very weak system Maybe 80 bits, but usually at least 128 or if you're a little more paranoid or worried about quantum computing then 256 bits of min entropy okay, so The colonel's job with dev random and dev u random is to make reading k bits from the device That is the physical process of reading k bits from the device that that should that should if you models a random variable have K bits of entropy So it is it is It's supposed to be very hard for an attacker to predict what the bits are and if you draw You know one bit then it's well the attacker has a small fifty-fifty chance of guessing right if you draw 128 bits The attacker has a very very very small chance of guessing right Now how does the colonel choose which bits to produce of course if the colonel is a nice single threaded Computer program that actually be determined as you know deterministic, but colonels have access to physical devices of course and they make various non-deterministic non-deterministic observations of the Physical devices that are attached to them for example the computers really have more than one clock in them and two clocks are never quite synchronized right So if you look at the skew between the two clocks That may be a little bit harder, you know a little hard to predict if you're not actually Observing the fox herself so if if you are an attacker on the other end of the ethernet cable It may be hard for you to observe the two oscillators inside The computer you're trying to attack other possibilities are the timings of network packets or Keyboard input, you know what how far apart my keystrokes are and which keys I'm hitting So if you run GPG dash dash gen key to produce a new key, it'll print out a message kind of like this Well, not literally this but Asking you to bang on the keyboard like a monkey until it has an f-entropy to generate the key So all of these Devices that the colonel observes are themselves random variables, but they don't have nice uniform distribution the Spacing between my keystrokes is very much non-uniform right now. I am not typing any keys at all So there's a very long gap, but if I were to go and type the URL to this presentation Then there would be a whole bunch of very short gaps. So it's not it's not uniform at all and sometimes these Sources of entropy are Under the influence of attackers so if you have a network attacker and you are using the time between network packets as a source of entropy As a source of unpredictability for dev random on your system then well Maybe the attacker can send packets on very regular intervals, you know Maybe every millisecond or something or every 10 milliseconds Or if the attacker is trying to log into yours Unlock your screen lock. Maybe your attacker can bang on the keyboard very Robotically rather than like a monkey and so that Yes, well or the the or the attacker can hold on to the space key until the screen locker crashes, but that's a separate issue so In order to do this the colonel uses some crypto magic called an entropy extractor and I'm not going to go into the details of all the all the crypto here And so but basically it pours all the entropy sources into a funnel and mixes them around so that they look a lot more uniform rather than very non-uniform like a bang on the keyboard like a robot or You know long gaps between keystrokes and followed by very short ones and then once the kernel has mixed all this into a big funnel and Produced a little output it will use that as the seed for a pseudo random number generator That is a deterministic program that expands a short unpredictable secret into a very long sequence of unpredictable secrets Now you notice I said This is the case for dev random and dev u-random. There's no difference between them here It's not that dev random usually spits out stuff directly from the Entropy funnel the entry pool here and dev u-random makes something up and then uses a deterministic Algorithm to spit out results. They both go through the same pseudo another generator They they they both go through the same deterministic process seeded by bits from the entropy sources now What if you don't have all that much entropy what if I've just booted up the machine I just hit the power button and I haven't typed any keystrokes and it's a fresh install of my operating system and SSHD starts up and auto-generates keys Then well if I did this twice There's a good chance I would get the same results or at the very least There's a fairly small collection of results that I might get that an attacker could easily cycle through similar to the Debian open SSL debacle several years ago where the open SSL userland PRNG Was using a seed that was much too small so that there was only a very small number of possible keys that it would ever produce so This would be bad and you want to prevent Anything from trying to use entropy when there when the system is actually predictable So how do we prevent this well? The naive answer is that we wait until I have banged on the keyboard like a monkey Wait until the disk has started spinning and we've observed the heads on the disk have taken some time to move around and Or we've observed some network packets and that's enough but and then well so traditionally Dev random Will block until the system has determined that enough of these events have happened I banged on the keyboard like enough of a monkey not enough of a robot enough of a monkey Or there have become enough network packets have come in So applications can use dev random as a sort of barrier to wait for entropy to become available So you could for example you could have just an in its script In your little embedded system that reads from dev random before it launches anything that needs entropy As soon as dev random returns the kernel has determined. I think that I'm unpredictable enough Dev you random in contrast never blocks so Even if you use it early at boot before you banged on the keyboard like a monkey It will not block it will just return data that well might be actually predictable So even if there's been nothing fed into the entropy pool the kernel will use I mean It might be all zeros as a key as a seed for the PRNG The trouble is With the obligatory Dilbert reference You can't actually tell from any particular state whether that state is unpredictable If I roll it, you know D 10 six times and get Nines out as a result. That's a perfectly valid Result even if the die is totally fair and you can't tell just from looking at the output whether I actually rolled the die to Produce the result or whether I just read Dilbert What you can do in which Dilbert doesn't really? address is assess whether the process that you are using to produce the output is Unpredictable, so if I tell you I'm gonna roll D 10 six times Then well, you have the 10 to the 6 1 in 10 to the 6th chance of guessing what the right it what the outcome will be Whereas If I tell you that I got 9 9 9 9 9 9 Then well the chance of that is was one so The trouble so yes, it's it's hard to for a kernel to determine whether it is currently unpredictable It can try to make some estimates by Using a deterministic algorithm to print to try to predict itself what the next output of the entry source will be or given two outputs It will try to assess If I knew the first output would the second output be a surprise to me And so there's some ad hoc logic in most kernels that will try to guess Do these look like they're does this look like is unpredictable given the first output? And if so, maybe I got one bit eventually maybe I got two bits of entropy and it will slowly add up the bits of entropy That it has counted using this ad hoc approach until it gets to a certain threshold but this isn't really a good solution because You can you could you could certainly imagine using a You know using a sequence of keystroke timings that You got from a pseudo number generator Seated by zero so The output of that will look indistinguishable to random as somebody who doesn't know the seed was zero But if you know the seed is zero, then you can predict exactly what the resulting output will be so It's not it's There's no real good answer here You just it's just it's a matter of system engineering to decide how You know how in your whole system you can determine whether there's enough entropy There's also this other concept of running out of entropy which you'll encounter in a lot of the man pages and documentation on the web and Discussions on the web and the interwebs and and an IRC and everywhere about how Sometimes if you use a lot of data from dev random, you'll deplete the entropy pool you'll run out of entropy like running out of gas when you're driving your car or something and then all of a sudden your car slows down and it can't produce secrets anymore and and That actually that doesn't really make sense the the only way that it conceivably Makes sense in the real world. No, not in the real in the theoretical world is that if an attacker witnessed the whole internal state of your kernel and Then walked away without doing anything with it and you got some more entropy Maybe then you would want to wait a little bit after they've Read your whole internal state before trying to read more from dev random But if the attacker has already witnessed the full internal state of your kernel There's a good chance. They can do lots of other nefarious things and you probably just don't want to use that machine anymore So Why would you know that that very Peculiar theoretical use case aside, why would you want to block in dev random long after boot? Well, there actually is a reason So if you're using dev random as a sort of unpredictability barrier that is as a way to ask the system, please Wait until you know, let me know when you've got enough entropy You would like to keep that code path exercised because if you run your application on your laptop Your development laptop, you'll always have enough entropy. So it'll never block You'll never actually use the you'll never actually see the code path where the blocking happens You'll see your application just snappily goes along and read stuff from dev random and it never blocks Until you write an application that someone else at some other company uses on an embedded device And they find that it causes all of their network to hang once they did an update to add your new code And that was because you started using dev random and Now all of their devices don't have enough entropy at boot and you never tested the blocking code path And did they just never get past boot because your application never launched because it couldn't get entropy from dev random All that said that's a fairly obscure use case and most applications are Are totally happy with just using dev you random So let me reiterate if you're writing an application that needs an unpredictable secret use dev you random Now what if there are no entropy sources like on such an embedded device where at boot? It just didn't have anything There's no disc. There's no mouse. You can move around. There's no keyboard You can bang on and even if you had a keyboard the monkey wouldn't help you So in that case the system the kernel and the whole system might be totally deterministic and it can't Provide anything from dev you random usefully that is anything it spits out of dev random or dev you random an attacker can predict because they can buy The same bit of device run the same soft run and get exactly the same outputs And this is presumably what happened with the Factorable net survey that would resulting in the mining your P's and Q's paper There were presumably a lot of embedded appliances that just had no entropy and they booted up and generated the keys and on two different Appliances, it was the same keys or at least one of the same factors because there wasn't much entropy just a little tiny bit So this is a real problem in practice and Well one thing you can do is when you install Your system when you flash the flash it with a OS image Which you maybe do from your laptop or from something else your laptop probably is in an unpredictable state so you can Takes mentor be from dev random on your laptop and just store it on the embedded device in A little non-volatile storage location takes only 32 bytes to be reliable as 356 bits and that's enough for many crypto and Then You might later also want to Save it again when you reboot the embedded device and so you can restore it when you start up again So that each boot will get different outputs, so it doesn't generate the same session keys over and over again And if you do this Then you don't need in your whole system The use of dev random is an unpredictability barrier because the whole system has ensured There's your whole process of flashing the device with entropy derived from your laptop or something So the whole system has ensured that The the the the system is is always in an unpretentious always unpredictable to an attacker Now I mentioned earlier that the the kernel will Draw from various different possible sources of entropy that is various possible different physical systems and Sometimes these physical systems are under the influence of an attacker You know the attacker can easily influence network packet timings Especially if they're on a LAN on the same LAN as you for example if you're in a coffee shop and and the attacker is on the same Wi-Fi network Sometimes you tackle good influence keystroke timings. I mean if you leave your laptop unattended and the attacker can just walk up and type at it Sometimes you might be worried about the attacker Compromising your CPU and this sounds really far-fetched But it is I see some people shaking their heads here because to them it is not far-fetched, but You might argue that if an attacker can compromise your CPU then what's the point of worrying about anything else? They've got your CPU and so that's your host.  You're done but it's very easy in theory to Modify the for example the read-rand instruction on Intel CPUs So that it has certain biases now The biases are going to be hard for you and I to predict or to even measure But for the dedicated attacker who put them there. Maybe there is a secret key that lets them Distinguish the bias or let let's them you know, let's let's them follow the biases through say a TLS session and The same very dedicated attacker who can make a little tiny change to your CPU that you're not going to detect even with a microscope There's a paper just last year What was it CHES I forget with that anyway about how you could modify the See the silicon so that you can't detect it with a CPU, but some bits are wired to zero inside or something So an attacker who maybe can do that. Maybe they don't want to More broadly compromise your CPU. Maybe they don't want to add a bunch more gates in it that will leak information somewhere else Maybe they don't want to Make it you know leave tracks that will make it clear that they did actually compromise your CPU so at this point I would like to mention that When I started looking into dev random and dev you end up in net BSD about a year and a half ago I found that on free BSD On Ivy Intel Ivy bridge systems, which were the first ones that supported the read-rand instruction Dev random and dev you random both sourced directly from the read-rand instruction That is there were no other entropy sources involved.  It was only from the CPU's random number generator I Talked to some free BSD. I talked to Colin Percival about this and and at the time he said well if they can compromise your CPUs And it's not much of an issue One year ago After some of mr. Snowden's disclosures free BSD reverted to using the read-rand as just one of several entropy sources so All right, so for the for the recorded audience you all just added that in there was a north bridge random number generator some time ago To which Intel applied a dye shrink and In doing so some of the diodes inside that were supposed to provide Noise that were supposed to provide entropy went away and stopped writing entropy So in addition to The the sort of mundane and not very uniform Entropy sources that I've discussed There are also various hardware random regener is hardware entropy sources on the market Now you can get PCI devices that you could add to your you know add to your workstation various systems on chip have Entropy sources on the dye And then there are CPU instructions like the Intel read-rand instruction or the via padlock instructions now I've never personally looked into how any of these physically work If you pay money for them you would hope that they work well to be unpredictable, but who knows I don't know So actually my favorite hardware entropy source you probably have in your pocket It is just a coin here And now if you are practiced you can make yourself reliably flip to heads or tails whichever you want But to all of you folks what I flip is pretty unpredictable and in fact, I'm not very good at I don't even know how to how to make it flip heads or tails myself so I Mentioned earlier you can write to have random and so you can act as your own little entropy source writing to have random Just provides entropy that goes into the entropy funnel and then is used to seed the PRNG and so if you if you want to generate a key that you're kind of paranoid about and you're confident There are no cameras looking at you So, you know maybe do it in your own bathroom at home or something and hope you haven't Tracked at the interest of a long-tentation state then just it takes I mean 128 flips if you know if you if you want a decent key If you're bored you can do 256 times. It's you know, it just takes a couple minutes And for a long-term key, you know if you want a key to last for 10 years without being compromised without being Guessed then you know maybe a couple minutes is worth that time so That's all about the Dev random and dev you random in general About a year and a half ago as I mentioned I started looking at the implementation in net BSD and Found a lot of things where I wanted to improve it So just a few little details of how it works in net BSD When you open dev random when you open dev you random You'll get your own per thread or per well your own per file descriptor state or per CPU state if you Just make small reads from dev you random, which is a little bit silly. I'm not sure that's the right thing, but So the point of this is that Dev random and of your end on net BSD scale You don't need to worry about Multi-processor issues that they're not you know if two processes reading from dev you random can do it on different core without interfering For generating key material for crypto Net BSD uses the NIST counter mode DRBG deterministic random bit generator synonym for PRNG pseudo random generator This is not the famous dual EC DRBG. This is one of the three totally reasonable Algorithms in the same standard Which it's not plausible to have been backdoored So it's it's just uses a block cipher in counter mode to generate some outputs and then reseed itself from the last output of the block cipher and we use AES 128 For non key material inside the kernel we use a much faster PRNG much faster a stream cipher cha-cha 8 This is only for Preventing an attacker from preemptively guessing what the output will be rather than retroactively guessing So it provides predictive resistance, but not backtracking resistance. So we don't use it for key material We use it only for like NMS transaction IDs Similarly the user land arc for random which Theo gave a talk about just an hour or two ago We're going to implement re-implement that soon with cha-cha 8 and Basically have it be More or less the same as the kernels fast PRNG Although I did some surveys and I I couldn't find any code that uses The arc for random API to generate key material If you know of such code, please let me know I would like it if there weren't such codes so we could just not penalize the code that doesn't need backtracking resistance But I would like to know if anybody really does use it for key material For key material as I said earlier if you want to generate a key use devu random I looked at open ssh and I don't recall what it uses to generate keys, but I'm okay I I had thoughts that open ssh used the open SSL PRNG, but maybe not. I don't remember. I'm not I'm not sure I see some people not shaking their heads so Yeah, so but the what? Yeah, so the question for the recorder audience is Well, doesn't open ssh use arc for random for session keys And york says it it does but only in the child process In the child process will have only one session Future child processes will be receded separately So you can't use their session keys or anything about them for total compromise of future child processes To guess the session keys of past child processes That's my that's what that's my guess right now, but I'm not sure about this so we can take this offline I discuss further so that's some That's it Use of your random any questions You mentioned the case of dev random blocking in the case when it has enough entropy How how does it know when to block and when to unblock in this case? so basically there is one of these little accounting trolls sitting inside the implementation of dev random and it Debits a little counter every time you read data from The entropy pool roughly is that traditionally works and once the entropy count goes down to a certain amount then it decides time to block This doesn't really have any physical significance. It's just the way it's traditionally done Personally, I would consider just having it flip a coin to decide whether to block Just so that your code paths get exercised and otherwise you're not led down a path of treating entropy like a Scarce resource like oil you can deplete So you recommend using dev you random what about the new sys call wasn't Yeah, so the trouble with the new system call or the new system calls or the new system calls with multiple flags or Which are different and different up the point is There are multiple proposals floating around right now one implemented an open BSD one implemented Linux net BSD has a sys cuddle node that you can use to Grab entropy and that's how Yeah, I've previously to that's how arc for random and libc seeds itself doesn't use dev you random That's all going good. But right now if you're running an application You can make it, you know like four lines of code to open dev you random and read from it rather than 60 lines of C preprocessor to detect what operating system you're on whether it has dev you random plus the autoconf stuff to decide we're whatever else so You know soon enough, maybe there will be a standard library call that we can all use for generating key material, but Right now I still say use dev you random just a comment There's a move to standardize arc for random or some similar variants in posix now. Oh, okay I had not heard about that I missed the oath talk. I'm afraid more questions So one of the big problems with death you random as you might know and to did mention that is that basically you can be in change route or Use Capsicum in free BSD which we use more and more now so Using global namespaces to actually locate the random device It is a bit problematic. So CTL is much better solution for now or some dedicated system call for that Yes Nevertheless, I think right now It is much easier for most applications to get by using dev you random and Is what what you said about four lines of code? I think it's much complex than that because sure you also have to Handle the case when when you cannot open the front of men what to do next well, then you fail which abort crash Not if you are in a library, so it does complicate. Well, what happens if the system system call fails It is much easier to make it impossible to fail or the system called to make it impossible to sure But understand the portability Argument of course. So yeah I mean, I think that it would be good if if we had a system called that we're simpler than a standard library routine That we're simpler than dev you random I think that sounds great, but right now that's not there yet and So Another question Because as far as I understand and from what I saw from some previous discussions When you guys designed all this is that you have two kinds of randomness Faster and let's say weaker and yeah, that was the the flow CTR dbg with a yes versus the fast judge, which which I also find a bit controversial because You pass the burden to the application writer to actually decide which to use and of course I think that the better move is to to remove such a burden from application writers because because Honestly most of them have no idea which one to use. Yeah, that's that's that's fair. I don't disagree So you should create one AP. Oh, yeah, this is this is these are just just within the kernel I So with for user land programs dev random and dev you random it's it's all that all goes through the AES CTR drbg that's all goes through the the slow one that's fit for key material Yeah, I agree that using the counter mode drbg is a much better idea But I have written applications that use millions of bits of entropy and a yes 128 bit CR CTR is very very slow when you're consuming millions of bits Yeah, that that so that's that was that motivated the choice of cha cha 8 which is very fast And even in very naïve C code and has a very low footprint just did you know a couple of cash lines? So you can distribute it across CPUs Thank you, and why cha cha and not cha cha 20. It's a lot faster And currently there cha cha 8 remains unbroken to the best of my knowledge So cha cha 8 you can compute 64 bytes of output in about 300 ivy bridge cycles on Using naïve C code Cha cha 20 takes a good deal more. So did you discuss with open bees the guys why they choose cha cha 20? Nope I will not repeat yogg's a pointed comment about open VST for the recorded audience Any more questions? Okay, thanks. Oh, thank you. Oh, yes, and there's a fun little entropy game on the website to As an instructive exercise in why you should not try to come up with your own passwords or flip a coin in your head So this is this is the password manager that I use