So, what the purpose and scope of our work, we mainly work on three blocks. It's Affiliate Recognition and De-Recognition process, which was done by one of the subcommittee. We are working on Affiliate Conflict Management, exactly my colleague Wojcik is from that subcommittee. We are trying to fix issues and resolve the problems in the affiliate. We are working on Affiliate Capacity Building, some work already done. For example, we prepared a bylaw development video and our resources for our affiliates, but many things need to be done and in the near future we'll present that too. And moment contribution, it's mainly that we are attending different conferences, original international, within our work and presenting the outcome work and helping the community to better understand our input. Starting with our subcommittee work, in recognition committee, the process is that when you are submitting the user group, our staff members are starting the criteria review process and if you are in line with all criteria, we are starting searching the thematic or geographically proposal of your affiliates and if you are crossing the lines in different affiliates, we are asking them to provide some feedback about you. And then if everything is good, the committee is starting to review that application and at the end we are wanting to recognize or not of your affiliates, but mainly we are recognizing all the affiliates. In chapters and thematic organization recognition process, it's more formal and it's some kind of different than user groups because, well, when you are becoming the chapter or thematic organization, it needs to be registered in your country and have a non-profit status within the country. There we are asking for you to provide bylaws of your organization for us and after that we are starting to checking up your bylaws and if it's in line with the Wikimedia values and in line with your country's policy, we are asking to provide for us criteria review and we are reviewing your criteria in line with criteria review by the staff and also by the AFCOM members. And at the end, we are preparing a resolution for the Board of Trustees of the Wikimedia Foundation. There is just to know that AFCOM is not recognizing the chapters or thematic organization, it's Board of Trustees of the Wikimedia Foundation recognizing that. Without conflicts, it's my colleague who will present. Yeah, unfortunately I'm the only conflict resolution team subcommittee member here. We have two people more, they are both, well, attending remotely, I hope, Benoit and Jeffrey. Also we have the rest of the recognitions committee here, that's Joy, that's Bashach and Suyosh, yeah, but conflicts resolution. When things don't go well in an affiliate or between affiliates, you turn to us. And that's where we are made aware that something is going wrong. Please note, AFCOM does not proactively investigate conflicts. Conflicts need to be submitted. Conflict situations need to be submitted to AFCOM with an ask with a request to act on it. We have an internal review of the incoming materials. We've had some help from the outside with building a case pack or ways to proceed. We're still learning this. We are all volunteers and we're not professionals in conflict resolution always. This is also where a case lead is assigned to a conflict. Someone who will be working with this particular case from the beginning to the end. We do our investigations. We do our investigations ourselves or we ask other teams at the foundation to assist us. We might work with trust and safety. We might work with legal. We might work with grants. This is where it all gets interconnected. How do we do investigations? Well, it does depend on the case. We might just do email correspondence. We might do interviews, meetings online, meetings in person. We try to reach a conclusion. At the end of the process, I'm sorry, we present our findings to the whole committee during our monthly meeting and the whole committee also gets a chance to comment on what we have found in our investigations. What next steps we propose, if any. At the end, we make an agreement. We communicate our decision, AFCOM's decision to whoever reported a conflict case. We like to follow up on stuff. I'm happy to say that things that I did in the past for AFCOM, I followed up on them, the conflict doesn't return, which is good, and I wanted to stay this way. Basically, I don't want to deal with any conflicts from the start, but hope there aren't any. This is the main workflow of the conflict intervention subcommittee, and I'll hand it back to Mehman, now to Dumisani. I'll hand it over to Dumisani, who is one of our two staff support people. The other is Manav, sitting over there. I'll hand it over to Dumisani to tell you about compliance monitoring. Thanks, Wojciech. I'll run through this one quickly. So you've heard about the recognition, you've heard about the conflicts, but what happens in between with AFCOM once you've been recognized as a group? Well, there's compliance monitoring, which is where you most likely have received an email from me, if you're an affiliate contact person saying, hey, your report is due in the next 30 days, or you have gone past your reporting due date. So how does that work? For user groups, which is the first side, you are going to get four notices from me in terms of the compliance for your report submission. At the end of the four notices, if you still haven't submitted your report, which means around six months after the date that your report was due for your affiliate, it gets into what we call an automatic day recognition. So your affiliate status lapses. And for you to get it back, you need to submit a new application. For chapters and thematic organizations, which is longer reports, financial audits, and so on, we give them up to nine months to comply from the date that their recognition was done. And again, for them as well, once they haven't submitted that report after nine months, they get into what we call a day recognition process, which is more conversations about what's going on into the chapter and is it remediable? If it is not remediable, you end up with that chapter losing its status as well. So that takes a little bit longer. Two updates on this. AFCOM has realized after the pandemic that happened and with the ongoing war between Russia and Ukraine that there are circumstances where affiliates will not be able to provide a report due to circumstances outside of their control. So we've introduced an additional status in the compliance, which we call a deferred status. Now that deferred status means you need to send us an email and say, hey, there's things happening in my country that's present, preventing me from being able to run activities or write a report. I do not want to lose the affiliation status, so I need an additional year to comply. And once that has been submitted, AFCOM reviews it and you'll get that deferred status. It does not mean that it's a pass, it's a free pass. At the end of the extension time you'll have given, you still need to tell us what you did during that time of the deferment status. The last update on the compliance is AFCOM has been asked many times, what's a model activities report looking like? And so they've been working on a standardized reporting format, which will then be shared with affiliates going forward. So you can understand how better to report the impacts of the work that your organization is doing. And that's me. Yeah, I just want to add here that to submit, like, to prepare a report, it's not so complicated. We recognize that different, like user groups and affiliates have different possibilities to have any activities. So just even if you are meeting online or doing some edit at online, it's also activity. So you can put that activities to your report and submit for us. And this is our internal workload management process. As an AFCOM, like committee, we have monthly meetings where participate all AFCOM members and plus staff and plus the board liaisons and even the guests if there is need. Plus we have officer's meeting. This meeting between AFCOM chair, vice chair, treasurer and secretary. Plus our advisors and board of trustees liaisons also taking part on this. We have two subcommittee meetings for recognition one and for day in hour one for conflict subcommittee, where we in detail way discussing all issues, what's exist or all activities, what we need to done. We have office hours because, well, for time zone or time management, some of the AFCOM members can attend maybe the monthly or subcommittee meetings. So for that, we are giving the possibilities to them, ask their questions or their needs to staff. And we have special meetings if there is request from affiliates or I don't know anyone can submit their request for us. On-demand meetings, yeah. Yeah, basically that's all from AFCOM. If you have any questions or if you want to meet us, you can send the email to AFCOM at wikimedia.org. You can see all information on the Metawiki on our page and you can follow us on social media, like Facebook for the most active one. That's all. Thank you. Yeah, questions. That's the most important thing. Questions are going to be taken by our colleagues. Yeah.  I think I want to ask, maybe it's a bit much to question for different division first for the recognition. Is there any specific criteria that user group can be formed and why it was rejected? Because there's an affiliate chapter in the region. Is there any specific criteria? Because there's some case that was accepted and there's some case that was rejected. Because still now I didn't know any specific criteria was rejected or was accepted because sometimes AFCOM just say that because our discussion, it is coincided with another chapter's region so we doesn't accept it that. And the second question is, is there any specific timeline to address a conflict that's happening in the affiliate? Because sometimes when we submit a problem, the problem has become bigger and bigger over time and there's no solution of this after AFCOM come to us. Thank you. Sorry about the question. Thank you. You want to address or? OK. OK. About recognition. Well, for recognition we have clear criteria which is listed on the meta-wiki for user groups, for chapters, for thematic organization. You need to follow these criteria and submit your application. And there is specific dates, like specific timeline because recognition is different than conflict because in conflict side there is no timeline because this is conflict. But for recognition we have timeline. It's around one or two months to become recognized by affiliation cause. If of course there is no any specific issues with your geographical scope or thematic scope, yeah, there is timeline. And regarding the crossing lines between the affiliates, we are trying to solve this issue with all affiliates. If, for example, there is some situation then we can meet between the affiliates and set a bridge between you so you can solve if that affiliates your issues. And if your application was denied, that's no problem. After six months you can reapply with more better situation. If I can add a clarification to that. When we have a new application for an affiliate, we always look at what's happening in your geographic region or your thematic region. Are there any organizations that are already operating there? And we always ask them, is it OK for you to have a new affiliate operating in your area? If they say yes, of course, the affiliate status is granted. If they say no, we try to search for ways to work with existing affiliates so as to prevent conflicts in the future. Because if, at the start, existing affiliates don't agree to a new affiliate being created, well, that's going to result in some nasty situations in the future. There is only one minute. Anyone? Oh. First, it's Adam. OK, very short, but not easy question. As Afghan members, what is your take on the MCDC propositions and the transformation into a global council for recognizing affiliations? Yeah, it's a widely questioned. So quickly, if I say, we are closely working with MCDC team. Like we have online meetings with them. We discuss our work, we present our workflow for them. And we acknowledge that they are prepared some ideas for us on MCDC. We also work with a board of trustees to prepare the affiliate strategy, which will be realized in coming months, I guess. So yeah, we are taking active steps with the MCDC and with the board of trustees on strategies and in the future. So that's a very quick question. Quick question? Well, most quick question, please. Hello, everyone. We are from Timoreste, and we are representative for Wikipedia tattoo in between Australia and Indonesia. Oh, we know. In the middle of East Timore. This is our first time in Wikimania. We would like to apply for the affiliation for the Wikipedia team at Timoreste. But some of us are new in the Wikipedia. There's not a lot editing. If it's possible, do we run the affiliation to be a user group? Yeah, sure. There is two ways. If you want to listen to us, you can reach out for any of our members from here during the conference days. Or you can reach out via email, afcomedwikmedia.org. And we can arrange a meeting. Or we will provide the more specific resources. But all resources, as I said, it's on Metawiki. You just need to search Affiliations Committee at the bottom. There is a template. And all resources by Afcom is there. So that's it. That's all. Thank you.


good afternoon everybody are we good to go what I would like to do is just make a general opening statement after that happy to take questions on the issue okay all right well this morning the CM the QPS received a copy of the CMC's taser evaluation report we welcome the report and we welcome the CMC's interest in this matter the report is an example of the ongoing collaboration between both of the agencies into taser usage policy training and deployment as acknowledged in the report itself the CMC could not have completed the report as comprehensively without the support and assistance of a range of QPS officers you would probably remember that in 2009 there was also a joint response by both of the agencies to emerging issues and that as a result of that collaboration we had a range of training and policy initiatives that were implemented throughout 2010 so in consultation with the CMC the QPS approved the implementation of a revised policy and training package that resumed mid 2010 and has been ongoing since then as a result of that the ratio of officers who have been trained has continued to grow but there was no accompanying increase in the number of weapons that were available for deployment so as a result the QPS has recently placed an order to purchase for the tasers this is to ensure that all taser trained officers have the opportunity to carry the weapon whilst operationally deployed we came to the view that the unavailability of the weapon to staff who were trained placed an unacceptable risk both to the community and to the safety of those officers both the chairman of the CMC and the state coroner were advised of our intention to purchase for the tasers so as a result we've ordered an additional 1,030 tasers 830 of those will be operationally deployed across the state based on a needs assessment and the other 200 will be used as part of our ongoing and enhanced training regime we consider taser to be a highly effective use of force option which has so far prevented 281 people from either committing suicide or serious self-harm and has significantly reduced the incidence of serious assault on police given that on about 76% of occasions the mere production of the weapon is sufficient to peacefully resolve a situation shows how effective they are in de-escalating potentially violent situations happy to take questions look that'll be there'll be well over a thousand deployed across Queensland the the most important statistic for us is that every time a trained operational crew is deployed frontline policing that one of those officers has access to and carries a taser look I haven't got the exact number but what we are confident is when we get these additional tasers into use that throughout Queensland our officers whenever they leave the station will have a weapon available if they've been appropriately trained and we think by doing that that is the best way that we can enhance the safety of the public and the safety of our officers Does it make us to the concerns that the tasers are being used against mentally ill and physically ill people which your response to that is a bit of that than guns? Well I think as I alluded earlier the fact that we have been able to stop I think it's 281 people from either committing suicide or very serious self-harm is something that we should recognize is a success factor as far as I'm concerned sadly it's often the case that when we have to deploy these weapons it is often in response to someone who's mentally ill seriously intoxicated or otherwise not in a reasonable state where we can talk rationally with them so it doesn't surprise me that often we have to use the weapon against that class of people and that's unfortunate but what I think would be more unfortunate is if we continue to go to those situations and not have the weapon to use because having the weapon in our view gives us the greatest chance of potentially ending the situation peacefully or if we can't end it without using the weapon we can certainly end it without having to use lethal force and I think everyone wants that. How do you explain that indigenous people are 7 times more likely to be involved in an incident with the taser than non-indigenous people have set out in the report? Well the stats show that indigenous people represent about 17% of the total number of deployments that we have and I would acknowledge that that's above their population base in the community but can I say that when we use this weapon we do a risk assessment based on the situation. Our assessments based on risk not on race. To us it's immaterial, the ethnicity of the person who's involved in an incident. What we're concerned about is does it meet the threshold requirement that we place on our officers that is there's a risk of serious injury to either the subject person, other members of the community or the police. Well if you look at some of the risk factors that we would that officers on the front line would consider their things like is the person, do they have a history of violence, are they armed, are they under the influence of liquor or a drug. Those sort of risk factors are what is in the mind of our operational officers before they make the decision to draw the taser. As I say the fact that the person who is on the other side of that risk factor happens to be an Indigenous person is to all intents and purposes are relevant for us. We're just dealing with the situation. It's about risk and not about race. It's exactly those concerns, those needs, the need for better education that our risk groups people have, I'll say heart disease or something like that but the officers need to know more about those sort of circumstances and how to deal with them effectively. Is that one reason why this could be happening? Well that's one of the recommendations that's in the report and whilst we've only received the report this morning we haven't had a chance to digest the implications of every single recommendation. Greater education for officers about the risk factors of some of those groups is certainly one of the recommendations and we'll very carefully consider all of those recommendations and I'm confident that we'll implement most if not all. Are you confident that every time a taser has been deployed that it's been used appropriately? What I can say is that every time an officer draws the weapon whether they actually shoot it or not is subject to a very strict reporting, accountability and oversight regime at the regional level. Those reports are then are over viewed at the region, sent to the ethical standards command and also over viewed by the CMC. There have been some instances where the review of those incidents have led to the officers getting managerial guidance or retraining but in no occasion has it led to any serious disciplinary issues. So yes I'm confident that they are being used appropriately and if they were not being used appropriately I'm confident that all of the accountability mechanisms are in place to pick that up. How many times has that happened where there's had to be a managerial retraining? Look it's a handful. I couldn't give you the exact number but it is literally a handful. How many cases are there on police tasering themselves or each other? Look we have an accidental discharge of the weapon in the station as part of the checking process before they go on duty. Probably one every couple of weeks I would guess around the state. It's just an ongoing training and familiarization issue for us. No one's been seriously hurt but it is something obviously we want to eradicate and I think as the officers become more familiar with the weapon and the procedure that we're less than over time. What happens is if the officer has to use the weapon and they have to use more than one cycle that's recorded on the taser usage form as a multiple deployment the officer in charge of the station downloads the electronic chip in the weapon and that is then sent off for review and analysis by the significant event review panel. So and then irrespective of that every six months each of the weapons are independently downloaded by the OICs of the stations to ensure that there have been no deployments that have not been reported. So I think we have a fairly robust accountability process. One of the concerns from the CMC that you know multiple uses or prolonged uses? Well obviously it's not something that anyone wants to see. We don't want to see our officers have to use the weapon and certainly we don't want to have to see them use it with multiple cycles. Sometimes that's unavoidable because of the operational circumstances but ideally we would like the mere presentation of the weapon to be sufficient where we have to use it one cycle only wherever possible and that is the overwhelming majority. If there is a multiple deployment that's very carefully considered in all of the circumstances when it's reviewed by the significant event review panel. When you heard to respond to the public about review and implementation? Look I can't give you a firm timeframe given that we only got the report mid-morning this morning but I can give you the undertaking that as soon as possible we will review and be able to put a position back to the CMC and the public about our response to the report. Any other question? Some examples cited in the report in relation to multiple uses. I think the maximum was 13 to one person. Can you detail any more circumstances around that? No I'm not familiar with that specific case but as I indicated earlier every single deployment singular or multiple is examined by the significant event review panel that then comes to the ESC and reviewed by the CMC so that circumstance would have been examined as a use of force option as is every other time the weapon is withdrawn from the holster. Is it the same for the person shot in the head? Beg your pardon? One person was shot in the head? Shot in the head? Well I'm sure without knowing the circumstances of the case that was probably an unintended consequence because that's not the training they get so I'd say if a person was shot in the head it would have been an accidental discharge in that regard rather than aiming for the body massage with what they're taught.


Thomas in secret how from told me by Chugga YouTube. Oh, yeah, smash the like button Why did I run out of coal again, huh? I didn't even smoke on the way out. Well, maybe I'm glitching Thomas be smoking on that coal again, bro. Here we go This is real. I'm really stuck here for a long time What am I supposed to do here hardly anyone uses this old road whoa, what do we have here? Little Toby Good little Toby, man Hey, Toby. What are you doing here? I? Went to Great Waterton to pick up my old stuff, and I'm on my way back. I got a voice I'm on my way to the nearest repair depot. I've got a little problem You got a problem you got a problem. I got a real problem, and what's your problem? I'm falling apart.   I have a real problem What's your problem Thomas go cold, you know cold I don't know why it's burning so fast It's never happened before I've got a long way to go, and I'm standing here like you know I'm so sorry. Is there anything I can do to help you?  What kind of water you made up? I don't remember exactly Hmm, but I think it's ok. Oh Yes, ok, that's right. Hmm. Oh would you say oh as far as I know it burns well Okay, try to push me forward if you're my loyal friend you want to help me of course No, bro. What is Thomas doing, man? I'm looking might take advantage of Toby Toby my faithful friend.  It's not pushing you're too heavy.  I'm stuck here forever Why don't I ask for help? I'll go quickly and ask for help. Have you seen yourself?  I Have a plan and be a little nice. I need your boards Toby. What no no no I don't even think about it. We'll make you new boards Toby. Just give me yours for a couple hours No, no, I'll tell Gordon about it. I still want to live. I don't think you'll have time to tell Gordon about this Guys take the boards off of him Wait, what I told you guys he was gonna take advantage of dude Poor Toby man Just left in there This might be one of the wildest Thomas Target YouTube videos I've ever seen and I repeat Toby man All right, so we're back to cancer being youtubers channel and he did remake his video Thomas the tank engine last episode the scrap DVD or episode whatever you don't want to call it He did remake it recently. So let's go ahead and watch this remastered version Trucker dude. That kind of caught me a little bit Okay, Thomas the tank engine and friends Kind of like this like the little dark Scary background the blood is just spilling All right, it's pretty cool. Oh you can see Tom. I mean now that's a James, right? Kind of like this intro Thomas, how are you doing this night? I'm feeling great person the fact controller said I should go to the scrap yard to get some old metal Well, Thomas I need to deliver some trucks to the cooling yard and deliver the mail train at 3 o'clock Sounds great. I need to go now Percy Thomas looks a little weird like this color I'm going oh SCP music Can the original one they actually cut his face off at the chainsaw, which it didn't show here Oh, they're Percy. I got some bad news Thomas was going to get some on the way in the scrap yard, but he didn't come So it's up to you to check and see if Thomas is alright and I confused it for Percy This is not funny animal face. Where are you Thomas? I'm Scott Thomas is gone, bro And this is where it gets pretty gruesome But wait, there's more More Percy man. Oh here comes the chainsaw part here I like the tinky-winky screen man. I just makes it more creepier a lot of blood at the scrap yard Pretty sad. Oh the cries when you're to find that fact controller and teach him a lesson, bro You always be messing with our without trains Christ All right, well that is the end of Thomas tank last episode Scrap right ladies and gentlemen well shout out to Chugga YouTube the can to be a new tuber further on some videos And thank you all for watching and I'll see you guys in the next one


The title of this work is FEG-based wood stripping with the designate proven non-interactive zero knowledge. I am Rotem and this is a joint work with Svicka Borkersky and Sandram Galko. So let me first describe the model we're working on. So we have two parties, a proven and a verifier and there is some NP-relation R and we want to have a non-interactive zero knowledge protocol with respect to this relation. So the syntax is as follows. There is a setup algorithm that takes this relation R and then it generates two values. The first value is a common reference string, a CRS and it is accessible to both the proven and the verifier. And the second value is a secret key and we have this additional value because we are in the designated proven model. So this secret key is designated for the proven. So now assume that the proven has a pair of a statement X and a witness W in a way that X and W are authorized by the relation R. So the proven can generate a proof. It takes as input the pair of X and W and in addition uses this secret key SK and it generates a proof pi. And then the verifier given the pair of the statement X and the proof pi can verify that indeed X is in the language that is defined by R and you can do it without seeing neither the witness W or the secret key that only the proven has. So this is the syntax. And now given such protocol, we want it to satisfy three properties. So I'm not being very formal here but I will describe the intuition about what we want. So for completeness, we want that if X and W are indeed in the relation so the proof that was generated by the proven will be accepted by the verifier. And now the two other properties concern the security. One is the security that the proven cares about and the other one is the security that the verifier cares about. So the proven cares about zero knowledge which means that it doesn't want to leak any information about the witness W that used in order to generate the proof. So we use the standard zero knowledge definition with a simulation but I will not go through the definition here. And for the verifier, we want the soundness property which means that statements that are not true cannot be proved by the proven. So if there is an X that is not in the language which means that there is no witness for which R accepts X and W then there is also no proof that will cause the verifier to accept the proof with respect to the statement X. Okay, so I want to point out that because we are in the designated proven model the proven gets a secret key and the security guarantee that the proven cares about is the zero knowledge which means that if the verifier get to see some information about the secret key it might violate the zero knowledge but it has no effect on the soundness because the soundness is guaranteed to the verifier and the secret key should remain hidden from the verifier. One can think of other model, other models. So of course there is standard non-interactive zero knowledge in which there is only the CRS and no secret key and there is the designated proven model where the proven gets a secret key. In addition, there is a designated verifier model where the verifier gets a secret key and then the secret key guarantees the soundness and there is the additional model of the most generalized one which is the music with pre-post thing where both of them get designated keys. So the proven has his own secret key and the verifier has another secret key of his own. Okay. So in the way that it is described now on the slide the proven can only generate a single proof. So indeed in this setting we call such a scheme a single statement, the designated proven is X but we would also like to consider the stronger model where the proven can generate multiple proofs. So if he has multiple pairs of statement X and the weakness W he can generate multiple proofs using the same CRS and the same secret key and still we want those three properties to hold. So we will focus on the problem of bootstrapping a scheme that is secure with respect to a single statement to one that is secure with respect to multiple statements. So again point out that if the proven generates more than a single proof then what potentially can break the security is that he uses the same secret key multiple times and then some information about the secret key might leak and it might violate the zero knowledge. So when you're going from a single statement to a multi-statement the thing that can break down is the zero knowledge. So let me talk a bit more about this action of bootstrapping a single statement to multi-statement. So this idea first was suggested in the famous FLS paper where they showed that if we have a standard music and non-designated one then we can go from a single statement to multi-statement in a generic way. And recently it was shown that the similar technique can be used in the designated verifier model but it was also pointed out that the similar technique doesn't seem to work when we're in designated proven model. So Kim and Wu showed that it is not possible to have this generic bootstrapping but they showed how to directly construct deep music as Kim using something that is called homomorphic signatures. Okay, so here is our contribution. We show another construction of designated proven music but instead of using homomorphic signatures we use a fully homomorphic encryption, F-A-G. And more specifically we take two steps. So in the first one we show a generic bootstrapping assuming that the single statement deep music that we start from satisfies some succinctness property that we'll define later. So we say that given a succinct single statement deep music we can generically bootstrap it to a multi-statement one. And then to complete the picture we show that it is possible to construct a single statement deep music with succinctness given any fully homomorphic encryption skills. So that will be the main part of our work but in addition we also show a two-way equivalent between designated proven music and something that is called attribute-based signatures but I will not go into that in this talk. So the main technical part will be about constructing this deep music from F-A-G. Okay, so the high-level structure of our construction is as follows. We have an F-A-G scheme. We then construct from it a succinct single statement deep music and then we show how to bootstrap it to a multi-statement deep music. So again as I pointed out earlier single statement means that the zero knowledge guarantee holds as long as the poover only uses the secret key once in order to generate the proof. And now what I mean by succinctness is that the set up algorithm which generates the CRS and the secret key is of complexity that is independent of the relation R. So it's running time and its output is of size that is independent of R. Okay, so before I show how to construct succinct single statement deep music from F-A-G I want to point out that if we don't care about the succinctness we only want a single statement deep music then it is actually possible to get it from a new one-way function which also explains why generic bootstraping with high probability does not exist. So the idea is to allow the pover to encrypt the witness with some symmetric encryption. So in the set up algorithm we begin with sampling a symmetric key and then we use the following circuit. So we have the circuit that verifies the relation R, it takes as input some statement X and in addition it takes as input an encryption of a witness. So this circuit will take the encrypted witness, we'll decrypt it and then we'll verify it with respect to R according to the input X that it received. So we look at this circuit and now we compute garbelling of it the garbell circuit of the circuit that we just defined and eventually we compute commitments to all of the input labels of the garbell circuit. So all of that will be the CRS of the construction and we can assume without loss of generality that the secret key is all of the randomness of the set up algorithm. So we assume that now that the verifier so that the pover can get to see the secret key and all of the randomness that was used for the garbelling and all of the randomness that was used for the commitments. Okay, so now we have the pover and he has his statement X and some witness W and he doesn't want to reveal W. So he uses the secret key in order to encrypt W, he gets this W tilt then encrypted version of W and now he looks at this pair of X and encrypt W and provides labels of the garbell circuit according to this input and also the commitments to the corresponding labels. So the verifier now can verify the commitment in order to know that he indeed got valid labels and then he can execute the circuit and to verify that I'll accept this X with respect to some W. So the reason that this construction satisfies zero knowledge only with respect to a single proof is because the pover reveals some of the labels of the garbell circuits and we know that garbell circuit is secure only as long as the adversary gets to see only a set of labels for a single input. And this construction uses only one way function because we use a symmetric encryption and garbell circuit and commitments which all of them can be realized from one way functions. Now we have this construction but we want to add to it the succinctness property and in order to compromise for that we now allow to use a fullyomorphic encryption instead of one way function. So just to remind you by succinctness we mean that the complexity of the setup algorithm should be independent of the relation of. So what you see now on the slide is still the construction that we saw from one way function and we can see now that the setup algorithm complexity goes with R because we need to compute a garbell circuit that depends on this R. So the idea here is to postpone the computation that depends on R in a way that it will be performed by the pover and the verifier independently instead of doing the setup. So we do it as follows. So first, instead of sampling the standard symmetric key we sample a secret key of a homomorphic encryption scheme and then instead of garbling the circuit so that the creeps, the witness and the executes R we garble a circuit that only takes homomorphic encryption in ciphertexts and decrypt it with the secret key that we sampled. Okay, so now how can we still guarantee that this protocol will be with respect to the relation R? So we postpone the computation of R to the pover and the verifier. So after the pover computes an encryption of W now it is a homomorphic encryption of W then you can homomorphically compute the circuit that has the statement X encoded in it and it verifies it with respect to R and the encrypted witness. So after he performs this homomorphic encryption he will get a ciphertext city which encrypts a single bit either 0 or 1 which denotes whether the relation accepted this witness or not. So given the ciphertext he can then do the same as before which is to provide the labels of the garbled circuit that correspond to the ciphertext along with their decommitments. So now the verifier gets to see the statement X and the homomorphically encrypted version of the witness which is W till. So we can locally also compute the exact same ciphertext you will also compute this homomorphic evaluation of R with respect to X and encrypted witness. You will end up with the same ciphertext and then you can do as before which is to verify the decommitments with respect to the labels that he got and then to execute the garbled circuit and see whether their output is 0 or 1. Okay, so now assume that we have a single statement deep in music and we want to convert it to one that can support multiple statements. So a name solution would be to generate exponentially many instances of a single statement deep in music and then every time the prover wants to generate a new proof then he can randomly sample one of those instances and hope that he never uses the same one twice and then given this randomly sampled instance he will generate a proof with respect to it. So the idea is take this solution which is non-efficient because it runs in exponential time and to somehow convert it to a more efficient one. So the high level idea is to postpone the generation of these instances to be on the fly. So only on demand one wants the prover wants to generate a new proof. So we consider this conceptual tree structure of all of the instances of the single statement deep in music. So we have a binary tree of depth security parameter and then we think of each node as an independent instance of a single statement deep in music. And eventually we would have two to the security parameter leaves of the tree and each of the leaves can be used to prove an independent statement in the multi-statement construction. So now we want to generate the tree root to actually generate in the real setup algorithm of the multi-statement construction and then to allow the prover and the verifier to parallelly generate the same intermediate instances of the tree. Okay, so now the question is which relation will be associated with each of the instances of the single statement deep in music. So we said that for the leaves, we want them to be used to actually prove statements in the multi-statement protocol. So we will associate them with the relation for which we generated the multi-statement construction. And now for each level of the tree, we will need to define some relation. So for the highest level, we will define the relation R, I. And now the question is how to define this relation. So we want each tree node to provide a proof that its two children were generated honestly because the security of the single statement relies on the fact that the CRS was generated honestly. And if we let the prover just generate them the way that he wants, then he can generate a bad CRS and then he can move false statements. So in order to prevent the prover from generating an arbitrary CRS, we use every tree node to prove that it's two children who are generated honestly with respect to a valid CRS. So we want the relation in the highest level, the R, I, to verify that nodes of the I plus one level were generated with respect to the relation R, I plus one. So we define the relations recursively. We start from the leaves node which is associated with the real relation R and then we go up in the tree until we get to the tree roots which is described by R zero. So a bit more formally, the relation R, I, will take two CRS values that correspond to two children nodes. And in addition, some random string R and then it will authorize this pair as long as the two CRS values were indeed generated by a setup algorithm with respect to the relation R, I plus one with the randomness R. So R works as the witness in this relation. So the verifier doesn't get to see the witness because of the zero knowledge property. So you cannot learn anything that you shouldn't learn because the CRS is public. So it is okay for him to learn CRS one and CRS two. Now, because we want the soundness to hold, we need this randomness R to be truly random which means that also R the witness cannot be sampled by the prover. So we'll actually choose this R at the very beginning of the scheme when we generate the tree root. We'll choose truly random R and this R should be used in all of the nodes of the tree. So now there is another problem because if we use the same R in the setup algorithm so we end up with the exact same instance of the single statement construction and then it is like proving multiple statements with respect to the same instance. So now we violate the zero knowledge. So we will not use simply R but we will explore it with the value that comes from a PRF. So the PRF seed will be known only to the prover and to the eyes of the verifier, those values will look truly random. So the pseudo randomness of the PRF is for the zero knowledge to hold and the real randomness of the R value is for the soundness to hold. And it turns out that if we saw those two values for every node and we can guarantee simultaneously both the soundness and the zero knowledge. So there are some details that I'm not getting into here but this is the high level idea. And I want to point out that if you look at the complexity of R i then it is at least twice as the complexity of the setup algorithm with respect to R i plus one. So this is why we need the succinctness. If we didn't have the succinctness then the setup algorithm with respect to R i plus one will run in time that is proportional to R i plus one. And then the complexity of R i will be at least twice and because we have a security parameter levels of the tree who will end up with an exponential blow up in the running time and in the description of those relations. So this is why the succinctness is required. So if we take the succinct DPNZ for single statement from FIG and combine it with the bootstraping technique that we just saw we end up with a new DPNZ construction from FIG. So I want to compare it with previously known constructions. So first recall that I said earlier that there is the construction by Kim and Wu from homomorphic signatures. And then we can combine it with the homomorphic signature construction from LWE by GBW. If we compare it to our work when FIG is instantiated from LWE we actually get better parameters with our technique. And this is because in FIG it is known how to do bootstraping and I'm completely overloading the notation here but in the context of FIG bootstraping means that we can generate a secret key of size that is independent of the circuit to be computed. And in the homomorphic signatures construction we don't know how to do this kind of bootstraping. So there we end up with parameters that go with the depth of the circuit. Another construction is the NISIC from FIG by Kaneti et al. And this is incomparable because on one hand they get the stronger notion of NISIC which doesn't require the designated approval setting. But on the other hand, their assumption is stronger because they assume that the FIG satisfies the circular security. Another construction is the NISIC directly from LWE by Kaneti et al. So again, this is incomparable because we have this generic assumption of FIG but on the other hand they get the stronger notion of NISIC without designated approval. And lastly, there are other constructions that rely on completely different kind of assumptions of assumptions on group with Bayesian error maps. So to sum up their results, we show a generic bootstraping theorem for succinct to deep NISIC from single statement to multi statement. We show how to construct this succinct single statement deep NISIC using any fully homomorphic encryption. And we show an equivalence between deep NISIC and attribute-based signatures which are also known to be equivalent to homomorphic signatures. This correlation is we get a new construction of deep NISIC from fully homomorphic encryption and also new constructions of attribute-based signatures and homomorphic signatures also from homomorphic encryption.


I think technology is going to play a very important role in a lot of key objectives for higher ed in the future. The one thing we've really not made an adjustment to in a serious way is the power of the network. So we've got all of our campuses connected together by amazing bandwidth. And with the federal stimulus program over the last couple of years, Internet2 is expanding to a network of just unimaginable proportions. But yet, we're not really using it to do anything substantial. We'll send some email, perhaps there's some class lectures online. But we've not really thought seriously about using that network where so many things for information technology, they scale. It costs not a lot more to run a thousand servers than it does a hundred. But yet, we're still doing so much of it, department by department, campus by campus. I think the network and using it wisely is going to be one of the biggest things for higher education. But the key thing in the way of using the network right now is just my campus as an island thinking. We've gone through several decades where when we think about collaboration, what we're really thinking about is, oh, what did your campus do? Maybe I'll do that too. Oh, my campus did this. Let me share it with you. It's all my campus as an island. I don't think that's going to serve us well for this decade. The economics are fundamentally different. We've got to start thinking more about above-campus solutions where the solution itself is available and everyone participates in it. Everyone helps pay a little bit for it, but it's not one-off campus by campus.