for their talk about high assurance crypto software. Thank you. So why is high assurance crypto software a thing? Why do we worry about the correctness of software or the quality of software? So just some recent news results about, well, crypto getting broken so badly that the private keys leak. These are just reports from October and November. And this one nicely adds upon saying timing is everything. So these were some timing attacks which completely broke elliptic curve-based cryptography so badly that the private keys came out. Timing attacks are not a new thing. So back in the days when you're logging into a server and that is looking at your password, it might be doing a character by character check. So for instance, you're starting by, well, let's find out what the first character is. So you're sending AAA, well, BBB, CBCC. Now, of course, none of this will actually work. It will be very surprising if this was the right password. But you do observe the time it takes to say this password is wrong. And then you notice that CCC takes a little more time to fail. Then you try to CAA, CBB, CCC. And it still fails in the old tape about the same time until you're getting to C2O. Until the moment when it takes a little longer time to fail the check. And in the end, you get a password in Congress. It was 1974 when this exploit was developed by Al-Nam-Bell. And you could log in, and it would be just doing this character by character check. So time would make it a way to log into your privacy, or basically have enough time to do time. But, of course, things are getting more into the CCC. When you come to the world of cryptography, it's a more subtle moment of timing of attack, of time.  But remember there was a square in multiplier algorithm which tells you, OK, you look at the limits of the exponent, and you see I'm going for the end of the stage of D in bits. And then I start by initializing your message in RSA, and then for each step you're squaring, and each bit is set, you're doing it in this one square, while the foot height is a bit till all the way to zero. So this is the end, so this is the end. And then you output the psychotech. Now, there are some problems with this. So if you're an attacker and you know that there is a D-denture, and you also have a friend that gives you some information on the length of the bits, this L was defined as, well, how it is, it's D. And that's not the case where this D looks much shorter. This is much shorter than N. It's much shorter than N, it's much shorter than N. And this is an unusual D, and this is a short one, and also here we have a branch. And this bit is one, and not one. So to pick out the length of a fine-grained axis, somebody could even see where I'm going for all the two more on the next squaring. In the worst case, I've been looking at all the pattern patterns by just knowing that I'm going on the next cycle.  Now, I think that from something similar, it's not an expansion for RSA, it's a lot to curve scalar multiplication. This is probably the biggest TPM fail. And there was a hororities to dodge the total not a lot of curves in scalar multiplication, so you've done for this square amount of time. Now, if you have some leading zero bits, it's much faster, and if not, because your D is very sparse, it could be just one and a whole bunch of things, and then another one that would also be as fast as possible. And if you have some leading zero bits, it's much faster, it could be just one and a whole bunch of things, and then another one that would also be as fast as possible. That would also be as fast as something which is a few bits shorter than the other ones. So you don't know exactly whether it was short and then it was fast or whether it was sparse, so few multiplications, and therefore fast. But it's not too easy. It's not too easy. And therefore, you don't have multiplications there, so if you're very fast, you're very short. So there's strong dependency on the length and there's very strong dependency on the length and also on the density. I was surprised that in this article, that this example, when you go through this bit with a bit, and when it's very precious time, and you want to divide these things into more than 19, we're going to use the multiplication, using the window, 36.3. You want to save time on the number of multiplications and then you would be grabbing two bits at once. You would be grabbing two bits at once. You would compute a few values, you would compute your C, and then compute this exponentiation, you kind of doing this first one, you do a few things at once. The first one, you can skip, because it's both zeros, and then you start in one cube, so we start in a C here, so it's nice enough if you compute it. Now, we're moving on by two bits, so instead of squaring one, we get twice. So that's why we're coming here next position is one, next position is two, C coming into fourth power by C squared. So we're moving in fourth degree. Everything is like in the previous loop, except for doing it with it at a time. And so instead of saying, oh, if the next bit is said, we do a multiplication, we look at the value of the next bit and then the sum of the square to C squared to C squared to C squared to C squared to C squared to C squared, and multiplication, and this way we only take four. It does change a number of squares. And now, we're doing four This one smoothened out the space of having a sparse integer, because, well, as long as there's a single one everywhere, well, on the window here, we just want to put them on the page, whereas normally it would be, so to speak, and you may be able to trace it, but it's going to be in boxes, where there's some things in the beginning or not, because we take four bits at a time, and there are 15 cases out of 16 where you have to do multiplication. There are also 50 cases out of 60 where you don't need a multiplication, or you don't need a multiplication. There's also a problem with the length. I mean, how much does these few bits do? Of course, you don't think you see how it's an exponent, you don't want to think you have an effect. Of course, you don't want to read it, you would be able to not even notice it, you know. I mean, it's actually more extremely sparse to actually read it. Worse, if you're having obstacles, trying to read it, you're going to lose. If you're using the Chinese theorem of obstacles, a few years ago, a few years ago, a few years ago, there was an article about how you can collect some information of D-model Q, D-model Q, D-model P, and collect them together, and you can find even more information. If you're using DSA signatures or ENC DSA, and this is such a thing that you want to get a multiplication only one time. So you're going to generate a number, you pick a random number, you do an exponentization, you do something else with this number. And then you do something else with this random number. These one-time exponents, these one-time exponents, these numbers, for instance, if you know that the top four bits or the top four bits or the top four bits are the first bits, then that's it. So you know the secret key. It's a very common system, and it was exploited in the two pages. It was exploited in the previous articles, TPM Fail, for example. And in TPM Fail, they showed that you can use the implementations of TPM for typical implementations in your TPM cryptography in your computer, and then you can get the keys out of the TPM. And then you can get the keys out of the TPM. The other article I haven't seen in the paper yet, but they have a very nice and informative web page, Jan Ganga, Peter Svendor, and Vladimir Steadlach, but they didn't see it for smart cards. So this is a really bad attack, and it's something really bad. Both the TPM and the smart cards for the signatures, they have been tested for this before, but the smart cards had to be tested before they were used for the signatures, and such a huge effect. There are more to it, so this is basically a system of all timing, so there's already lots of libraries out there. Do you think what TPM and smart cards are on the side if you have hyper-trading, if you have time attacks on Cache, if you're doing the look-up for the TPM before something, then depending on this entry, which is in Cache or that entry, if you're learning this or not in Cache, you can even restore an increase in these leaks. This should be a constructive talk. Let's see how you'll fix this. So one thing is, for all our crypto-inventations, we actually know kind of an upper bound. We know that our RSA keys, or know a bound on the end, people pick the 0.8 or 0.9, so we have a good upper bound on the top of this D will be. Why not just use that? We use the length of this cycle regardless of the length of our key. Before we start initializing the message with the same thing, then we can do a new message. Let's initialize it one. If you initialize it one, you'll see it's the same thing. You can do the same with other bits that are in D. We can add padding to the length. We can do a cycle with a constant length. And we do the same thing except we don't have this if-else. I mentioned cache-timing attacks and in general, we're not thinking how many bits there are, and you might be more depending on how many bits there are. And so what we're going to do is we get up on a bit of performance, we do a bit of computation, and we do a bit of multiplication not just to get 0, which of the two to take, the one which we just computed, the H here, with multiplication, but for those who don't need multiplication and don't want anything else. Because the attacker can look at this whole thing and understand what's going on. If the bit is 0, then I'm getting 0, so I'm getting 1 minus 0, and then this bit is 0, and then this bit is 0, so for 0 bit, I'm getting m, I'm getting m, and for bit 1, we're getting H. 1 minus 1 minus 1 is 0 times m, and it turns out to be just H. This small modification to the code comes at a bit of cost, because it's always at the length, so I'll do something about it. Because our cycle has become much more, and we do multiplication for each bit, not just for 0 bit. I've been saying elliptic curves and I've been saying that elliptic curves, and when you do RSA or when you do Diffie-Hellman, you multiply by a generator. So that's cool. Now let's see how it works with elliptic curves. You were here five years ago at 31 C3, then I'll be giving a talk about the previous years. I've told you about the X-chopper curve in which there's an additional point of infinity that can be very useful. We don't have any cool formula to say that there's this exact point as an exception. So we can't distinguish the curves from the Diffie-Hellman curves. There's sometimes a curve with advertising Edward's curves and Montgomery curves, so I'm just going to tell you about this nice, stylish shape and you have this pointed 12 o'clock and you can just do it. So for Edward's curves, everything is nice. For example, there's a popular curve 255.19 which is used by your browser and so on. They use one doubling and a folding. It was a joke about mathematics. There's an addition and a doubling. You use additional doubling instead of one folding. The reason why 255.19 uses Montgomery curves and Montgomery curves is because it's constant time and it's done pretty fast and it's not with constant time. There's additional privilege of using algorithms with constant time because some things you will not enter an infinite loop because you can't do what you recently said. So now we've had bug, bug, bug in Windows and I can't believe that yeah, okay, it's time to get back to the loop and sometimes people do believe like OpenSSL, they've got a few subroutines which are late in the business and time code. It's not pervasive by any means but some people say they're trying to do something with time and is that true? I mean people make claims about crypto all the time, I don't know if it was to do something that's bad crypto it is bad crypto and it's been treated with a claim that it's great crypto. RC4 is a crypto you want to use and so if you want to use it we're going to try and carry it but eventually it was leaked and then everybody had RC4 and it's gone forever and it's gone forever and it's a great IPO and it's very interesting it's not a good site for you don't use RC4, it's a bad SC4 so this example actually uses RC4 I'm going to maybe look at it so let me first look at what this code does and say what the algorithm is doing. I'm going to sort of the start of the secret crypt using RC4 and when you do it you see it's running around there's some maybe a key and maybe you want to use it for memory and so on 32 is a reason for future and then the amount of key will be ignored if there's no key then at the end of this thing we're going to be free so this maybe a work in progress program but okay there's some space for a key and then it's based on their key extension to what OpenSSL calls this RC4 key and then there's supposed to be a structure that's what RC4 key but this program is still something you can compile and the compiler would not allow the compiler to add some optimizations and pushcodes and you don't realize that this program is doing nothing you think it's doing nothing but I don't know crashing your system and the compiler compilator will call this function and then you use this program under Valgrindom and run SanitizerPameter to find memory leaks and you can see in the previous presentation about fuzzing if you don't dive into compiling you don't need to compile anything you can just run Valgrindom and it'll run this program and then it'll call the RC4 key and it'll bring all these functions and it'll do that and when it's going to do it it's going to follow since the malloc is setting aside this data space because it's not supposed to be available after that and Valgrindom is trying to keep track of what your pointers are pointing to and that is you're going to have to do that and one of the things you have to do is suppose that you have some uninitialized data and that is are you using this in a better condition or a better condition if you're using other problems Valgrindom will give you the malloc uninitialized key and Valgrindom will follow this inside RC4 key and then it'll complain that you have to use this tool and then it'll say it's on use of uninitialized value and you've been doing some array access access to the object and that's what it means it makes sense that Valgrindom would say oh I don't want to continue trying to it's trying to figure out if you're accessing some wrong spot in memory and if I is uninitialized then Valgrindom will say no and then it'll produce what not exactly and then it'll produce what not exactly uninitialized data and I think that's exactly what you need to do to check that you're using constant time code to check if it is anything derived from the key is that being used for a branch or is it being used for which could be so if Valgrind says there's a problem with by throwing way RC4 or and if Valgrind says there's no problem and if Valgrind says there's no problem then it's a happy talk after all so we have constant time explanation scale modification and a few other conditions so one of the things is to be able to I mean in the end you have to implement your computations on the elliptic curve or you implement your arithmetic model or RSA modulus and you have to do it and then again check that Valgrind will use it's going to follow through so Valgrind awesome tool Valgrind is a great question and one of the things that Valgrind can do is to have a processor because the processor that I'm going to do division I'm going to do division I do this in one single clock cycle but he can say oh I can do this for one clock because I can do it faster and it's possible for one addition it's like optimization it's all normal but what about other processors for example ARM Cortex M3 and we wanted to implement cryptography or elliptic curves and on 64 bit outputs twice more than the size of the register and it's possible to take from 3 to 7 cycles depending on the size of the register and it means that it's possible to take up to 7 cycles depending on different values and so on and so he came up with a certain block scheme that shows how many cycles it will take between this block scheme it tells you how many cycles it will take depending on if there are special operands or more or less 16 bits and so on and it's just a situation with other architecture with other processors we decided to do constructive presentation and then we talked about it and realized that it's all broken and it's not just that the tools don't do what we want them to do it's not just that the tools don't do what we want them to do it's not just that there's all these vulnerabilities to timing attacks and period attacks and suddenly there's more CVs which not just timing is going on it's not only timing let me explain this CryptoMemCamp CryptoMemCamp it's not just a function it's going to be very bad if it's going to be a check in the open association and they made a constant time function which is probably a constant time comparison especially for this and the implementation of architecture and risk in this function there was a problem that it was effectively reduced to just one bit in every byte because on PA risk someone in the room used PA risk in the room and I see at least 10 hands in the room it's not the most popular processor in the world but it exists and you can write a code on the assembler you can even find such machines it's not crazy that openSSL does assembly code it's all good but in other case people can also share let's look at the importance of this it allows to change the communication which is let's see you have a message you have 16 bytes and you have something at the end of this message and you have this function and it checks what's coming in from the tag and then we try we try to use this function to compare 128 bits we can compare 1024 with the other 1024 byte and it compares 16 bits instead of a 2 to the minus 128 instead of a 2 to the minus 16 128 we lose security it's slower it's slower it's much less secure classic British explanation let's focus on Intel I don't think anybody is trying to preserve I don't think anybody is trying to preserve but Intel made a new instruction and at some point Intel made this instruction and using AVX2 there's an implementation of 1024 bits and the code from July 2013 was discovered in 2013 which was a bug in this bug what's the consequence of this bug let me guess they say attacks against DH-1024 are considered 1024 bits now it's more likely and the questions are as much time as you can or as much as much hardware it means a year on a cluster or it can be done on a home computer they say it's not specified in the advisory they don't answer the question they use DH-8 and they also use the same sub-routine and then they use the same sub-routine against where I say 1024 as a result of this bug would be very difficult to perform and are not believed likely they don't say there's a bug and there's a bug that you can't do and I mean this notion of wrong it's a different crypto system it's a new crypto system slightly different or a different RSA 1024 I don't know maybe it's secure and they say has anybody really looked at this? normally if we have a new crypto system if we have a new crypto system we go through a lot of reviews it's a long review it's a long review or a good review it should be much bigger mostly much better but if people were using RSA 1024 if people used 1024 RSA RSA should be there there should be some problems results if someone looked at the radiation and we turn the system and if they can't do anything and we figured it out If you can't break it, everything will be OK. And a few weeks ago, there was another bug, another advisory, CVE-211. We didn't think we would talk about it, we just didn't want to laugh at it. We don't know what's going on with these bugs. We just don't know the consequences of these bugs. Here's an example of a piece of patch for this bug. Yeah, the code before already has it. Is this correct? The patch adds some lines saying correct. Well, that's clear enough. Yeah, this patch adds just correct. You know, you've got these top hundreds of cryptographers around the world fighting against them. You've got a lot of cryptographers who are fighting against these quantum threats. They'll protect you from the threat of quantum computers and everything will be OK. There's Falcon, post-quantum cryptography, post-quantum cryptography. And this one, there was an announcement in September which said from the author of Falcon that the consequences of this bug will also make the servers have to do the correct software with the right signatures, but all of the importations will be in the private keys that were released, the same bug. And we had the same test bug. They all worked in parts. They were doing the same thing. They had the same test vectors and they used the same algorithms. Which presumably has lower security and then are we going to have less security? Less security, and the author also commented that the fact that the traditional development methodology being super careful has failed. Everything broke down pretty bad, the traditional methodology. What can we take from here? We can make some conclusions. If you think about elliptical curves, special points that you need to think about, those make your software more complex. And it makes the software much more complicated. If it's a new system, and it hasn't been used for so long, there are some things that are long such as RSC and so on, such as SIDGE, Rishito and so on. What you want is to remove the leak by entering the arithmetic code. We don't want the code that has the arithmetic instruction to be more complicated. So, such on counterpoint, if the bit is 1, do this, if the bit is 0, don't do anything. If the bit is 0, then in case of arithmetic, it's much more complicated. People were trying to make the comparison so that they didn't leak the value of data. We have less studies on how to implement security. After Falcon, they weren't familiar with these problems. Another problem is that we have this drive for speed. We also have problems that we want to have a drive. So, we have to be careful. Very small code. We have to be very careful because there is a code that is performed very often. We really want to optimize it completely so that it's much faster. We want to squeeze it here. So, that means more error-prone as well. It's more compact. But the problem is that it will make a lot of mistakes. You may have different processes with or without AVX2 and for each processor for which you write the implementation, not only the reference code you have to take it into account. For Kitchak, Kitchak only exists for like new platforms. They still have a new platform in the library. But they also made more than 20 implementations for different architectures. So, if you have a Kitchak code, it might have just encoders A7 rather than the ones that have AS support. If you have a cheap smartphone, then most likely you have and that's why you may have some problems. Without the hardware support it would drain your battery. So, I would keep a roundabout of things specified by the NSA, the specCypher and they put it on them to make the thing that was satisfying the speed requirements. And then this, which after some public outcry in particular Jason Donfeld did a lot of work. They did something better to get an implementation to have a recently designed combination with the next Chacha. So, they did a lot of coaching to get a lot of video with us. Maybe it's probably one of the most complicated implementations of all this complicated math. Maybe that's a complicated math. That seems to help. So, that's a comment from down here from 1910 that was from the book from 1910. We'll follow after we've defined addition that one plus one equals two. And this is on page 379 of this book. But when it comes to me, I don't know if one plus two equals three. That sounds more complicated. But I think one plus two equals two. All these details. It looks like a code for math. People have worked on this over the last several years. And they actually recommend there's fans of this who say that you should go through this pain. You should spend time in our community to write through 300 pages and understand that everything is correct. Not just to convince yourself and some friends, but you should make sure that everything is really, really correct. And it's just a computer that does some automatic checks. And it's the right thing why you have to carefully define that, specify your information, and really prove that everything is correct. If it's checked, then everything should be fine. These tools, they didn't work, but there's something just to give some context. There's something that mathematicians don't like these tools because they're such a pain to use. Nevertheless, they have enough fans that some amazing people use. This is something that's like evercrypt. And they have a crypto library which has implementations of all the cryptos that they have as long as they don't have any of those nested verbs or many of those implementations. Well, here's the thing you support. It's got the list of what they're using, some symmetric code and some encryption and so on. It's probably enough to use HTTPS and yes, you need some kind of AS support process, but maybe something else. And there's proofs. People have actually done the evidence that they took some tools and made some tools for analysis of this P.O. Which is like, okay, that's a serious guarantee that the positive side of this is that any code that we see for cryptography, that it's really saying, yes, and you can see right here that the whole compute the right output for every input exactly what is specified. So you can see that the specification is correct, that we get a specific input and it's likely to be correct. But it also should be a separate question how you check the processors, how you check the compilers and so on. The only problem is that it's very difficult to do. It's just pain. And the more architecture, the more for every implementation it's much more work. An example of how difficult it is you can look at the list of what they use for Intel chips some fast implementations of some of the functions. But it's not something that's passed to some of the owners or to some of the owners say big laptop. Then no, EverCrypt doesn't give you fast implementations. It doesn't have some big bugs, but it's going to be very easy to do these operations on old smartphones because it will take a lot of hours to prove it on new platforms. Of course, you check all these things. We've already spent an entire hour on how many people here ever had this feeling of oh, it's a pity I could have done much more tests. I see pretty much everybody in the audience. And now, how many people ever had this feeling of oh, it's just many tests. I see, okay, maybe there are thousands of applications. Sorry? Who is in both camps? People who thought they tested too much and too little? Yeah. Of course, testing is fantastic. You should test every thing. You have to really do these tests to make sure you have too much cohesion. You should be trying to model your code to cover these tests. Then you will be able to see when you have tests, then you have code. It's a very bad function. But let's take, for example, CryptoMemCamp and see what do the bottom bits match. That's the thing which gives the wrong results for one out of two to the 16 inputs. Just random inputs will give the wrong results. So if you're trying to do just random inputs and try to do this the whole buzzing philosophy says let's try to smartly choose what you can and try to try and try to figure it out. And then there are very quickly finding the CryptoMemCamp out of the process. I need to try to figure it out as quickly as possible. This was actually implemented in the Super CryptoCamp in the first set of tests. That's just well the group that opened the cell. That framework so while we didn't catch the bug but it's like we almost could have better organized testing effort. If we would have better organized testing we would have found this bug. If you find yourself thinking how can I make tests how can I make some automatic test to catch this bug to your regression test suite and make sure it never happens again and then it's returned to the test suite and it's sure enough that they didn't happen to anybody again. And that's well the main thing about strong testing is that you're not the problem with testing is that you're not testing all the time and millions of security goals which are the entire group which you never thought of testing for. You never thought that you would be not by fuzzing and it's not hard to catch them with fuzzing. There are some secret inputs that you can say, I can do this, I can do that and some very special things. How do you deal with this? How do you fight this? This is very effective for example, in November of the year 2019 we were asked for a curve 448. There's a bug that randomly happens with probability 1 out of 2 264. There are a lot of tests that take a lot of effort to set that up and it takes a lot of time and effort to get could an attacker find those inputs? Well, it's here some inputs which make this operation fail inside the target and the attacker can find inputs to the whole crypto should there be more analysis of how damaging this bug is? Or should we just get rid of this bug and that's it? Since it's a very small probability no one can find this and so they say you have to prove correctness. You need to prove correctness of your algorithm it's not so simple. You can find real bugs or make this approach which is much more complicated than just a method. Here's an example on the left side here we'll look at how it audits not like on the test. On the left side here there's an Intel crypto function MAMCAMP you can see maybe you can't because it's too small but you read and at some point you see there are some calculations which are only for a certain length of the operands for each length you see what this code does we compare X, X0, Y0 XOR to X0, Y0 X1, Y1 and so on and we have three bytes XOR and why do we do everything as OR and if everything is in 0 it will result in 0 and if there's a difference in these bytes then we convert we convert it to UN64 we do matrices we move through some logic and you can see everything is correct you can look at the assembly and look at the graph that everything shows how the input is and then you analyze this graph and you say, yes, yes, yes this code works correctly and you do this for each graph there are some tools that make it much easier let me tell you about ANGER it starts from the binary and then builds a lot of extra and then builds a lot of extra what ANGER does is that ANGER does a lot of extra work it does that for you automatically it's your binary and after the instruction you learn what I did for your input arrays XOR is a graph from this is your code because you don't have to deal with a complex assembly and so on there's no jumps it's just completely no memory there's a lot more simple instructions, there's no jumps there is a branch which is that if you have a glitch if you have a glitch that if there's two possibilities if you have a bitfilling I don't know what to do and say well you can cut it into several pieces and say that they are the same probability but this is what we need maybe we have some loops maybe we have some cycles which are based on public information ANGER we want to protect from timing attacks and it gives you the unrolled code very quickly sometimes ANGER even checks the correctness of this code and says that it works there's only 9 minutes left so I'll try to quickly tell you this is a simple call to CryptoMemcAMP which you determine all your inputs X and Y X, Y Z and the compiler doesn't throw out this code maybe you need Z and so on maybe it's going to do something with it so the CryptoMemcAMP will be called and as ANGER works we take this binary pass through this ANGER but instead of having X, Y let's replace these places in memory that's going to be something else a variable we don't know what it is and then you run the program and then you calculate what's happening in the last lines here after ANGER's run through the code you can just ask it do you think it's possible to possibly happen and there's some automated tools called Cryptosolvers which can sometimes answer this question they might be able to answer this but they don't necessarily need a lot of time and the last line here what are what are things we're trying this approach working on you can always do it you have constant time code another tool which will do this for you which I haven't used personally but Manticore that I've worked with ANGER works just fine although it has this cool GUI called ANGER management ANGER it'll always convert your code to something else and then all of the interesting problem at that point is if the SMT solvers aren't smart enough to see that a lot of code works and if the resultant code works they'll need to look at new tools that will look at your reference code which you've reviewed and you sure it works and then you want to see and you want to see these implementations do the same and you want to put them together yeah, yeah, yeah that's why they're here and the whole thing is you need to do a certain tool for this I'll give you a quick example of how you can do this for example sorting code when you're sorting massive but you can do three times faster than Intel's integrated for Intel's library where they were sorting and it's optimized for Intel three times faster and it was proven that it's coming out right and we missed it was passed through ANGER and then you should say yes, yes, yes, nobody's claim that it's verified which is most crypto code you can just take random crypto code and pass it and check if it's right if it was stated that it's coming out all the time or not, we take we take we put it in our ANGER which is doing the same computation and see what's going on and we compare with reference code which is written on the scripting we'll do that matching for you, it'll tell you how much crypto computation is done but it's actually fun that's a great thing to do compared to all the other ways of doing it it's followed by analyzing the DAGs it's fun, it's actually a fun way to analyze at this point we'll be happy to take questions so thank you for your attention thank you we'll do a very high speed Q&A we'll do a very quick Q&A questions not comments just questions, please first question I think it's a very short question is constant time really the only standard time is the only mitigation against attacks? it's a mandatory thing you can do more you can do randomization but you want to have independent data which you can do second question thank you for the report any approaches from real-time operating systems operating systems they work real-time says you want to say that some operations are done for a certain amount of time but the attack before the end of the calculation you can get some data that can be useful in the real-time context but if you have constant time then it's much better thanks for this amazing talk I just have a question you said that the Q&A was slower than the Q&A it's slower than the Q&A with my knowledge the Q&A 255 is one of the biggest on ARM it's slower on Intel it's it's faster than the ARM alright internet for formal verification of evercrypt it's actually constructed it's actually constructed it's actually constructed it's actually constructed thanks for the question you said compiler bugs do you think that the bug in anger can close your bug? in the situation of testing you have an original code you have a framework for tests you want independent tests and in the end if everything is proved you can imagine that this code is correct and all of python needs a lot of Python code and some other time and so on but there are bugs in anger but there are bugs in some risk you reduce the risk of mistakes in your cryptocode the question is internet there is progress what's the final check if it's random? that's enough of an answer thank you microphone number what's the status of pairing friendly arithmetic compared to other curves? it's a little more complicated it's much more difficult if you look at tpmfail there are the same issues there inside tpmfail there was a code that should have been tested but it's a little bit like an explanation the same tricks will work and obviously this code wasn't constant time last question what about scooper scaler processes it doesn't break your algorithms or some distance doesn't have any effect you want to have some isolated data some isolated data which is copied out of that and you want to make sure that nothing was copied from this environment safe environment but if you have a scaler then you have it's not based on the data that you have if the processor is not based on the data the instructions will be launched then it's fine if it's different then you can get this data inside this safe environment thank you very much for the wonderful report


Fellow citizens, the rallying cry by with the same Nigerian group Galvanized Nigerians in January 2012 at Ghanifami Park or Jota was kill corruption and not Nigerians. This was a cry when we made it evident that our fight was not against the removal of the first subsidy but against the corruption in the system. This was a fight when amid the threats to my life and family right there at Ojota and live on national and international television, I called out by name those individual and corporate entities who are the allegedly ravaged nation. Mr. President, given the complexity of the Nigerian economy, we are not thoroughly convinced that your palliatives will be sufficient to cushion the effect of your policies on the Nigerian citizens. What we do know, however, is that on May 29, 2023, you swore an oath to be faithful and bear true allegiance to the Federal Republic of Nigeria and to preserve, protect and defend the constitution of the Federal Republic of Nigeria. May I remind you, Mr. President, that Chapter 2, Section 14, Subsection 2, Subsection B of the constitution states that the security and welfare of the people shall be the primary purpose of government. Therefore, in compliance with your oath of office and in accordance with the constitution of the Federal Republic of Nigeria, our demand on you, the current and its just current, the current occupant of the office of the President, our demand on you is the same demand that we made 11 years ago. Mr. President, kill corruption and non-Nigerians. The West African states echo words to violate an ancient principle of diplomacy that is recognized even in the holy book that you must offer peace before declaring war. By placing military invasion on the table from the very start, before subsequently exploring diplomatic options with the coup plotters in the Republic of Nigeria, Mr. President, to number once again put the cap before the horse, thus placing Nigeria and the Subregion in a precarious situation. Truly, those that are loudest in their threats are weakest in the execution of them. Any foreign invasion to succeed in the long term, the support of the locals is essential. From the spillover effect of subsidy removal to the effect of sanctions, local support for Nigeria and our leaders among Nigerians is at an all-time low. It is therefore counterintuitive to engage in what could be a protracted conflict. This month the Sinombu let echo us all to have land from the aftermath of America's invasion of Iraq in 2003. While we condemn the spate of co-details in West Africa, we recognize that the situation calls for deep introspection on the part of African leaders and makes even more urgent the case for good governance. The call upon Nigeria this time is not so much to compel submission in the Subregion through the force of mind, but to command alignment through exemplary governance. Well, that's how we chose to begin of the first day. When you talk about talking through to power, that's one of the things that I think Tunde Bakery just said, Pastor Tunde Bakery said. It made headlines almost all the dailies carried it. In the Guardian it was Tinobu's reforms will fail without economic justice ending corruption says Bakery. And you also find a headline in Daily Independence which reads that Tinobu has plunged Nigeria into chaos. And some of the things that were highlighted by the pastor are the reasons he is saying that he has plunged Nigeria into chaos. Another headline said 66 days of the APC administration and Nigeria has gone down. That was according to Labour Party. But we are not concentrating on the Labour Party here. Apart from all the headlines that we have seen, this is like the most exclusive that happened on the pulpit. Because if our pastors, if our clerics cannot speak through to power, then who can? Because everybody is having a place of refuge as it were. So the people are powerful enough. So let them talk, let them speak through to power and Tinobu Bakery said that. Yes, and one of the things he said, one of the takeaways there which is probably on the lips of almost all Nigerians is kill corruption and not Nigerians. He also said go after those who looted the oil subsidy money. Instead of getting Nigerians to suffer the way we are suffering by the removal of the subsidy, who are those who ate the subsidy money? And he was one of those. We were saying what happened in 2012, this president who is now removing the subsidy and who is saying subsidy has to go. It was a corruption. It was something that corrupt Nigerians used to enrich themselves. Few corrupt Nigerians used to enrich themselves. He was against it in 2012 when former president Jonathan Godlak Jonathan wanted to remove it. And Tinobu Bakery was among those who occupied Nigeria then, kicking against the former president Jonathan. And many Nigerians are already asking where are those people who occupied Nigeria then, who kicked against it? And he did say that even at that time he mentioned some names of those people who probably are part of the Cabal which means that the list of these people is there. Of course it's not secret. So how come these people are going scot-free and then Nigerians are the ones who are suffering during the brunt of what evil some people, some mean people committed. It doesn't make sense to me. Did you not see that interview by former, I think he was a former governor who talked about how his friend, him and his friends, they were all involved in receiving the subsidy money. Yes and he said it was too much. They were tired of eating money. And so it's not, it's an open secret really. Anyone who has the political will to prosecute those who benefited from this corruption scandal, failed subsidy scandal has enough information I believe to do the needful. So it is the Nigerian people that are now suffering for their crimes. People, the crimes of people that are known. Someone will use the common money, the common wealth and get tired of eating it. And you don't say anything. There's sometimes that they said that oh, if we open our mouths to say some things and mention some names, we know the people who are sponsoring Boko Haram. Till date we've not seen that list. Then someone came out and said he influenced the wife to make some judgments in the court and in favor of some politicians. We heard it. We know him. We know his name. Nothing is being done about that. And we are saying we are fighting corruption. We are going to be a better country and all that. Political will goes beyond just pronouncements. I think showing working as we say in Nigeria is what we need right now. Who are those people? Name and shame them. Even if you don't prosecute them. No, no, no.  Let us know them. But we don't even know them. They're going to be prosecuted. If you're going to do anything about it, there's going to be a deterrence. Because corruption has become so endemic. Look, it's destroyed everything about this country. And even the continent.  If I know someone. To show that you mean business. If I know someone. Those who are because look, so many people are deeply into corruption in this country. And that is why. And look, corruption fights back and it fights dirty. So if you're going to cleanse the stable, you just have to start by prosecuting. But you know, if I know the person who did this to me and my family because everybody should take it personally because we are all suffering it. At least next time he's coming to stand for election, I will know what to say to him. Now we don't even know them. They could be among us. They could be people that we are saying are saints. And then they are the ones that plunge Nigeria into this. So prosecution is there. Let us know them. So they could even say that prosecuting them, but they will not name them. You know, it happens sometimes. We are. So first of all, let me know them. And then we will. By the way, let us inform our viewers that sorry. Our guests will not be joining us and all the press as we had earlier. You know, Teased. He's unavoidably absent. So it's Minyamgol and you. So let's let's let's let's judge y'all. Some who we already know to be corrupt came out. They have either been elected, re-elected or appointed into public offices as we speak. It's not in my place to begin to mention their names. So I'm saying until prosecution takes place and we see it happening. Nobody is going to take anything seriously in our so-called quest of fight against corruption. What is even the prosecution that we are looking for? We know some ex-governors, for instance, that were prosecuted, taken to Kuja prison. And then just given the pardon. And then clad of everything. And now tomorrow they could become senators, they could become everything. We know people who have been in court, some are still in court.  We see a lot of them in the National Assembly. And some have gotten perpetual injunctions. Yes. They want to be questioned, arrested and investigated. I really don't know why the courts grant that. If you're innocent, then prove it. Why would you go to court and say, I'm getting a perpetual injunction.   So I don't know why this is allowed. Maybe someday a lawyer will tell us something about it. Why would someone come to you and say, okay, they say I'm corrupt. Make them not investigate me. Doesn't that even tell you that that person could be guilty? We are special breed of people. Oh dear. Yeah, we are. Let's look at some of the headlines on the Guardian. CBN's fiscal irresponsibility act. Fiscal irresponsibility act. That's how it's tagged. Let's investigate a probe's CBN staff, consultant's names, NSPMC. Find details of that on page six. So much came out recently about the CBN, the money they are owning JP Morgan and Goldman Sachs and how much billions they spent on their own vehicles and a lot of things going on in that. Yeah, I'm just trying to compare the money they spent on their vehicles and the one that the National Assembly right now, which is probing them, is spending or is trying to spend like 110 billion or so. The syrup guy will be talking with us later on that. So much racket. So much racket. Talk about the black market, the brood change and all of that goes on. You'd be amazed how the dollars were being given and how they were being gotten in. And look, a lot is going on. There's just so much. Sometimes I think there's bleach in not knowing because sometimes when you know some of these things happening, it just sets your mind on, I don't know, you get so angry all the time. Okay, but at least something good on the headlines. Niger military succumbed to dialogue, say Ku in Nigeria's interest. I don't want to talk about the second part which says it's in Nigeria's interest. But I love the fact that they are now going to negotiate. Even though I know that maybe they'll say, okay, the president cannot come back. Give us time for transition, blah, blah, blah. We'll now have the transition period. They will transit into civilian government that someone else takes the reins of leadership and the circle just goes on and on. Maybe ten years later, another junta springs up. I don't know, but we should find permanent solutions and dialogue should be the first thing. Like Bakare said, dialogue is the first thing. You don't declare war before you come back to say. That process, we've gone past that stage now. It's already, we've gone past that stage. The threat for war has already been given before the dialogues. But I understand that the coupists are now coming down and saying, okay, they are ready to discuss. War does no one any good. It does no one any good. As Tunde Bakare has said, it calls for introspection. Let African leaders begin to think and begin to talk to themselves about how they are caring about the responsibility of leadership that has been given to them. Well, but sometimes we know that we vilify, we condemn when the military people come to take over. It is not right. People should select their own leaders and all that. But they threw up some things that even if they cannot act on, whoever is a civilian president should look at it. Because most times our civilian presidents are such that they seem to be looking for validation from the west. And so they enslave us to the west so that the west can validate us or validate them as individuals. And we become slaves that we should not be. So they raised one of those questions there all, one of those concerns that Niger is unevenly yoked with France. Which, if you ask me, is true. How can a sovereign nation have a central bank in another country that regulates the kind of money they spend in a country? So what level of, how independent are they really? That is not independent. And this validation that some of our so-called leaders seek from the west. You begin to wonder why. How long will they suffer from this colonialism mentality? When would they, just as the late Netanyahu Mali said, emancipate yourself from mental slavery. When will they do that? Because if you are not free, you are not free. Yeah, so I don't know. Even us in Nigeria, we are part of the commonwealth. I don't know how really that commonwealth is beneficial to us if we cannot stand on our own. UK or rather Britain has the population of about 60 million. We have 200 million. The market is here. The natural resources are here. What do they produce? What do they have? Natural resources and other things in UK. They don't have that much if they have at all. Everything comes from this commonwealth including Nigeria. And we are looking at this and we are seeing it. But we are not doing anything about it. We are not doing anything deliberately to remove ourselves from the shackles. So now, anything that wants to happen in Nigeria and we will say, for instance, it didn't take up to two months or six months after Abacha made a pronouncement. He may not be a very good leader, but he said, this dependence on the west has become too much. It has to stop. He used the words enough is enough. A few months later, he ate an apple, as we say. So anytime anybody wants to talk about the true independence of Africa, something happens. Tomosankara was at the vanguard of freedom for Africa. See what happened. You go to Bamangatafi, the same thing. See what happened and all that. And we are allowing this. Is it that they are afraid of paying the supreme price or that they just want to be selfish because they are gaining. And we are not gaining. Are we not the Nigerians? You know, I watched the Blood Diamond movie again. I don't know if you've seen that movie. Yes, I've watched it. That movie reminds you of a lot of the realities that we're talking about and we've been talking about and questions about how we have led ourselves and comparing the leadership that Africa has seen from their colonial masters and the leadership that Africans have seen governing themselves, leading their own affairs. And so many things are just not so beautiful about the continent. It's a terrible thing. When are we going to see that change? We don't know. Can I travel to South Africa without a visa? Can I travel to Congo? Don't even mention South Africa. Even within some of the countries in the West African sub-region, they will be looking at you even though it is legal to travel there without a visa and all that, but they'll still be looking at you somehow.  And you can't find that within the UK, for instance. You can't find that within the EU, for instance. But Africans, we cannot travel, we cannot interact, we cannot treat, we cannot do anything as brothers and trust ourselves. It just doesn't make sense to me. Okay, let's look at some other headlines on... Daily independence, for instance. And so we go to daily independence and it leads with CBN, NiraFloat may crash in a short while, experts warn. The writers there say in Nigeria not ripe to operate currency float and devaluation affecting productivity, manufacturing. You know, when this NiraFloat was the policy came up back then a few weeks ago. One of the first questions, because initially I didn't quite understand it, that's the truth. But one of the first questions I asked was is this going to add value to our currency or is it going to devaluate? That was the first question I asked, because for me that was important. It will rub off on everything. And sadly, this is what we're seeing. It's like removing subsidy from everything. Now, if you were able to get it from the official window for less and black marketers were doing what they're doing at least they were still seeing that if we take it too high people may not patronize us. They could just decide to be patient enough to get it from the official window. Now there's nothing like that. Nira is angling towards 1,000 Nira per dollar. Nira is on a free fall. And it's scary. It's like for nine something at least a few weeks ago or a few days ago even and if it can be that close to 1,000 then before December who knows what will happen? They keep telling us that the policy is good. Removal of fuel subsidy is good. See what we are facing. The Nira float is good. See what we are facing. Did they not think it through? Now the experts are talking that it might crash before the policy came on or a few people just sat together and said we have to do this to show that we are hitting the ground running. For president Boilati Nubu he said to be an economist and so I don't know I don't know but what we do know is that Do you trust accountants? But one thing I know about accountants is that they are stingy. That's what he said about them generally. I don't know anything else about them but these economic reforms we have been told those who are pro-it are saying be patient give it time eventually everything is going to balance out but some are just some projections are just not looking and what we are feeling right now those of us that are not economists that do not have any where he is going to land in the near future we are apprehensive a bit we are worried because the cost of things are just hitting the roof everything is hitting the roof you can't flight tickets foreign flight tickets I discussed that on Tuesday last week it's about 1.5 to the UK what is 1.5? it's gone up to the US it was 2.5 2.4 like 3 weeks ago I don't know how much it is right now although this is peak of summer the prices go higher but obviously influenced by the devaluation of our currency and the fact that the funds of foreign airlines are still trapped in this country matter of fact you understand Nigeria has the highest highest of foreign airlines funds being trapped anywhere in the world if you go to Benin for instance to take that same flight it will cost you like 300% less or even 400% less over 600% the papers had it last week less than what we are experiencing in the giant of Africa we are not economists we need timelines if you tell us that things are going to get better give us a timeline and say maybe in the next 3 months or in the next 4 months in the next even 6 months we know how to plan but this one you just leave it is by Russia now the second coming of Jesus Christ that has not happened now everybody is still waiting we shouldn't be left in the dark like that so if the Naira will appreciate because of this policy if the Lord Jesus did not leave us in the dark he told us the signs to see about his second coming so it can't be compared to Nigerians I understand some Nigerians now have to go to Ghana they travel to other states other Africans to travel because it's cheaper to travel from those countries than traveling from Nigeria alright so this thing you talked about aviation college outreach over missing 4.750 billion Naira 2 trainee helicopters yeah it's just like they fuel subsidy that they say people were taking and then we don't know the people how can 2 trainee helicopters just disappear okay the rector 4.750 billion Naira yes that's the cause senators are querying the rector and they are petitioning the national assembly and all that but helicopters were duly auctioned those were the words of rector of the college so if they were duly auctioned where did the money go to billion not million where did the money go to money just fly left right and center why didn't you know they near your side or my side I want to make heaven a big I want to make heaven okay well that's the much you can take enough of the press this Monday morning we'll be right back to give you our first hot topic stay with us is the breakfast the mindset edition on plus tv africa


My favorite holiday of the year is coming up Christmas falls on December 25th and if you're not sure what to sell on your e-commerce stores then do not go anywhere because in this video I'm going to show you the best products to sell to really make a killing this Christmas. So if this is your first Christmas you couldn't choose a better time to start your e-commerce business and if you've been here before, prepare because this year you're about to break new records. The top Christmas products coming right up in this video. Quick intro and let's go. Welcome back I'm Liran from AutoDS and as you know in this video you're about to learn about the top products to sell this Christmas and we're not just going to go over 10 products like we usually do. In this video it's a very very special holiday, it's a very special event and that's why we're going to go over the top 25 products to sell this Christmas. We've been gathering this information from years and years of experience and our full database of many trending products that we've accumulated over the years. We know what's been selling hot, we know what's going to trend and I'm going to share with you that information in this video. One second before I get started if you haven't done so yet do not forget to subscribe to our YouTube channel to always learn about the next step in your e-commerce business. We've got case studies, product finding, full step by step tutorials, live Q&As and so much more. Head over to youtube.com slash autoDS and click subscribe. Now everything that I'm going over in this video you can also read about it in the blog article which I'll leave a link to right below this video. But do keep in mind I always like to throw in some extra additional bonus value into these videos so if you're the type that likes to watch do not go anywhere. Let's go ahead and get started. What are the top products to sell on Christmas? Now remember Christmas falls on December 25th. You want to get your stores ready at least a month and a half in advance to give your store time to sell the Christmas products, profit from them and deliver them to your customers before Christmas arrives. Okay so let's get started. What are the best products that are going to sell this Christmas? Starting with number one artificial Christmas wreaths. These have been selling every year, every Christmas and it's going to keep selling and some even sell in medium and high ticket price ranges. So you can make some great profit selling Christmas wreaths and let me just show you an example by searching any one of the suppliers. If you're wondering what suppliers to use to get these products simply head over to Autodesk.com and click on suppliers on the top. Here you have a list over over 25 suppliers that you can work with and you can get these products or even get product ideas from these suppliers and import them to your stores. So in this example I'm just going to head over to Amazon. Now this is just one example you can use any supplier that you want. It can be a wholesale supplier, it can be a retail supplier. Retail suppliers usually require a little bit of more knowledge before you get started with them but wholesale suppliers are mostly very much dropshipping friendly. So check out these Christmas wreaths and you can see that there are a whole bunch of different variations of them so there is really a bunch of them for you to sell. And these always trend a lot right before Christmas. One more important thing to know here is that when you're adding these products that I'm giving you in these videos you should add at least 20 of them to your store. So this means if I'm telling you to add Christmas wreaths then you should be adding about 20 of them to your store even more if you can. You want to be able to analyze the market correctly and you won't be able to do that with just one product or two products. So add 20 product ideas from each one of these so that you can really test it correctly. Use the tagging feature if you're an Autodesk member. Tag it as Christmas products so that you can see what Christmas products sold best for you. You'll be able to really analyze Christmas sales really well once Christmas is over and be even more ready next year with the products that are proven to be best sellers for you while continuing to test the market for more. Number two on our list Christmas window clings and stickers. This is one of those decor products that you simply have to have for Christmas. So Christmas window clings and stickers you can simply take them, copy it from our blog article and paste it on your supplier search engine and here you will see that product. Now granted some suppliers may not have so much to offer. If using Amazon for example you'll pretty much always have something to sell. But of course there are many other suppliers that you can use like Aliexpress, CJ Dropshipping, Wayfair, Costway and we'll also have private suppliers soon at Autodesk. More on that on our YouTube channel and on our blog page at autodesk.com slash blog. So now let's search for Christmas window clings and stickers just to give you an idea just to show you that you can find it from many different suppliers. Now let's say I want to add this product to my store. It's really easy. When you have dropshipping automation like Autodesk simply head over to platform.autodesk.com or just log into your Autodesk account. And on the left side you want to click on add products. Then you can go with single product and then you can take the URL of that product. So let's say we want to go for these stickers. That's the product that we're looking for anyway. So what I'm going to do now is I'm going to copy the URL. Head to Autodesk when I clicked on add products and single product. I'm simply going to paste that URL right here and the system can already see that it's coming from Aliexpress. The region is China. Then I'm going to click on edit now quick. Now what's happening is Autodesk is grabbing all of the information from the supplier's website and in just a couple of seconds as you can see here it's already added to the draft section of my store. So here I can optimize the product like the title, the tags, the location, stock monitoring, price monitoring, automatic orders, the product's description with a rich text editor, the product's variation. So all of the variations that we have right here you can also see them right here on your store and all of the product's images. So of course you don't have to download and upload them one by one and the item specifications. So everything here was very much automated for me and all that I have to do is optimize it a little bit if I want or I can import it directly to my store and optimize it later. That's completely up to you how you want to run your business but this is how quick it is to add products to your store and that's just a single product importer. Let's go back to that product list. Number two we talked about Christmas window clings and stickers. Number three on our list we've got Christmas snow globe lanterns. That is exactly what it sounds like. So we're going to copy this and let's see this product on another supplier. So let's this time let's go with CJ dropshipping and as you see we've got one right here, we've got another one right here, another one right here. They don't have that much but they do have some and that is one good reason to add these because maybe not too many other dropshippers have added them yet but on the other hand that's why I said that you always need to work with multiple suppliers. Some suppliers may not have the same amount of results that you're looking for and that's why you're going to get them from different suppliers, from other ones. Number four on our list Christmas floor runners and this time we're going to use AliExpress. So as you see here they've also got table runners and they've also got rugs, carpets like we were looking for but mainly table runners. So that is why once again you want to use multiple suppliers. So back to Amazon, here you're going to find a huge variety of Christmas floor runners. The fifth Christmas product that you need to sell this year are Christmas pillow covers. I've also recommended this last year, it sold really really well and I cannot leave it out if it's going to keep selling this year. So add Christmas pillow covers. One of the things that I like about Christmas pillow covers is that first of all there's a whole bunch of variations. The manufacturers, the suppliers finished creating them, finished manufacturing them and now they're starting to sell them. So now I'm using Walmart and as you can see here we've got many different types of pillow covers. Now this can come in a one pack, a two pack, a four pack so it's good to take advantage of this and you want to be able to increase your average order value. So of course it's better to sell a product that costs $50 or $100 than to sell a product that costs $10 to $20 in terms of profiting. And once again as you can see there are many types of Christmas pillow covers that you can start purchasing that you can start adding to your store right now. And if you would come here in the beginning of the year or in the middle of the year you won't find that many Christmas pillow covers because they're not starting to trend yet. Now is the time, now you want to start adding them to your stores. Number six, Christmas throw blankets. Another product that we use year by year. So Christmas throw blankets, this pretty much goes with Christmas pillow covers. It goes with Christmas floor runners. It's another great Christmas item that people like to have in their homes right before Christmas and of course during. Now let me show you something before I continue.  So you already know how to add one product to your store, how to do it really quickly from the method that I showed you a couple minutes ago. But let's say you want to add a whole page worth of Christmas floor runners. This is exactly how you're going to do that. So I just searched for Christmas floor runner and what I want to do is download and install the AutoDS Helper extension. So if you don't have that, simply search for AutoDS Helper on Google, go to the first search result and you'll get to this extension page. Add the AutoDS Helper. Of course, it's absolutely free and this will help you do many things. One of them is to import products in bulk. This is how we're going to do that. So as you see right here, the circle, this is the AutoDS extension icon. Now what I'm going to do is I'm going to search on my supplier's website for what I want to add to my store. In this case, Christmas floor runner. So I search for that and this whole page is filled with Christmas floor runners. Now I want to add all of them to my store and not do it one by one. So what I'm going to do is I'm going to click on the extension. Then I'm going to click on extract. Now all of the 144 products that we have on this page got extracted into the small extension. Now I can continue going to the next page and also adding all of these Christmas floor runners. So I'm going to click extract again. Now I've got 266 products. So we've already got a whole bunch of floor runners that we can add to our stores. But what I'm going to do now is click on export as CSV. And as you see a CSV file was just downloaded onto my computer. Now I'm going to head to the AutoDS platform. I'm going to click on add products only this time instead of single. I'm going to go for multiple products. And one way to do it is to add the product IDs here. So let's say I would take one products URL from here, add it here. Go to another product URL, add it here. Go to another product URL, add it here. That's another way of adding multiple products to your store. But let's check out the bulk feature that we just started. So here we're going to click on upload CSV. And here we're going to drag and drop that CSV file that was just exported onto our computers, processing CSV. Now, as soon as I click on add as a draft, it's going to add all of those almost 256 Christmas floor runners to the draft section of our store where we can optimize it or import it directly to our store before or after we optimize it and start selling. So that's how easy it is to add tens, hundreds or even thousands of products to your store in just a couple of clicks and just a couple of minutes instead of it having to take hours and days. And that way you'll never be able to invest your time on what's really important, which is growing your drop shipping business and not getting stuck on tedious tasks like importing products and hoping that the prices and the stocks at your supplier's websites do not change. So with automation, we're solving all of those problems. We're saving our time so that we can invest it in growing our business, opening more stores, working harder on product research and more. Things that will really help us grow our businesses and not get stuck in the same tasks, in the same growth or not even growing at all. Product number seven, Christmas party decorations. Now, this is a broad one. So you just simply wanna search your supplier for Christmas party decorations and here you'll get a whole bunch of results that can help your customers decorate their houses for Christmas. So here, as you can see, you've got a whole bunch of variations that you can resell on your e-commerce store. There is more than enough to come around and this pretty much comes together with those Christmas stickers that we talked about, but these are natural party favors. So it's not just a decor product. It's not just a way to say, hey, we're also celebrating Christmas here, but we're also throwing a party and you are invited. And do not forget this tip to tag your products. When you tag your products and you can see that example right here. So we've got the white snowflake Christmas wall stickers that we added to the draft section of our store. So here you can see the products tags. So AutoDS automatically added to the home and garden, home decor and wall stickers tags, but I'm also going to create a tag called Christmas. Okay, and I'm gonna add it to that tag. And now every time I add a Christmas product, I'm gonna keep adding it to the Christmas tag. And that way, once Christmas is over, I'll simply head over to the product section of my store and then I can add a filter saying I want you to show me all of the products that have a tag called Christmas. And when you have too many tags, you can simply search for it. So right here, Christmas, then I'm gonna click on done. Now it's gonna show me all of the products that have that tag. Now in this example, I don't have any because I just added only one and it's in the draft section of my store so we cannot see it yet. But that is how you'll be able to analyze what products sold really well this Christmas and keep those products for next year so that once again, you can make the same killing next year, but even more by adding more products that are similar to those that sold for you the year before. And of course, staying in tune with us to learn about what products to sell and more than that, continue doing product research. So after Christmas party decorations, now to number eight, Santa Claus Christmas figurine. This one is pretty self-explanatory. I'm not gonna show it to you on suppliers' websites but many people like to buy figurines right before Christmas and the Santa Claus Christmas figurine is one of them. Now it doesn't have to be just Santa Claus that's just one of the main trends from the figurine's niche but you can also search for Christmas figurine. For example, let's do, let's make this search, let's make it on Walmart this time. Just jumping back and forth from some of the multiple suppliers but of course you can continue searching other suppliers. So as you can see here, we've also got this nativity scene with Jesus and Mary and you've got other ones.  So there are other figurines that are not just Santa Claus. That brings us to number nine. This one should go without saying but guys, Christmas trees, everybody's buying them right before Christmas. Not everybody but whoever's celebrating Christmas which is more than enough and just to kind of get you guys to understand how many people are purchasing Halloween products right before Halloween. You can see right here, holiday e-commerce sales in the United States achieved over $186 billion just last year in 2021 and in the holiday sales we're talking about the Q4 holidays. We've got Halloween, we've got Christmas, New Year's, Black Friday, Thanksgiving but this is the time to make sales. This is the time when most online shoppers are purchasing products online. So if you wanna join the fun, once again, now is the time to do so. So Christmas trees come in all different types of variations. Some Christmas trees can come decorated, some do not, some require some work and some do not. So it really depends on what you're going for. But what you wanna do on your store once again is to add at least 20 different types of Christmas trees. Make sure that one variation is not an exact duplicate of another that you already have on your store. But if you check out, for example, this one right here, this variation is pre-lit. So here you can say, okay, I can check the pre-lit Christmas trees and I can also check the regular ones right here like this one, it's not pre-lit and it's just a regular six foot Christmas tree. Then you can go on and try selling pink Christmas trees like this one right here. This one is seven and a half feet and it sells for $72. You can sell this one for $130, $120. It will sell, people will buy it. And another one right here that comes as a four pack in different sizes. So as you can see, there are many different types of Christmas trees that you can sell, that you can resell on your store and this is the way to do it. Christmas trees number nine on our list, this brings us to number 10, Christmas tree accessories. If you're purchasing those Christmas trees that don't have any decoration on them or even if you're not adding Christmas trees that have decor or don't have decorations on them, even if you just wanna sell the accessories that's completely fine, even if your buyers are not gonna buy the Christmas trees from you, they definitely can and will buy the Christmas tree accessories from your store. And when adding accessories, these are most likely not going to be expensive products. For example, this snowflake tree topper. Okay, some of them can sell for a medium price ticket range like $40, $50, but some of them are going to be relatively low and cheap. You've also got Christmas ball ornaments. This is once again, a micro niche of the regular Christmas tree accessories niche. Then you've got Christmas tree lights and you've also got elf Christmas tree skirts, another nice accessory, another nice addition to Christmas trees. Then you've got Christmas tree storage bags. After Christmas, people are gonna look for a place to store their Christmas trees and keep them there for next year. Many dropshippers miss out on Christmas tree storage bags. They only think about Christmas, not just dropshippers, but e-commerce store owners inventory and whatnot. They forget about what comes the day after Christmas. They think only about Christmas and only about what's gonna sell then, but what about the day after Christmas? Who's gonna make those sales, if not you, with these Christmas product ideas? Number 11 on our list, Christmas tree earrings. Christmas tree earrings are another way to get into the whole Christmas vibe and that is another great selling product on Christmas. Number 12, Christmas tree rhinestone brooches. That's what you're looking at right here, another decor item. This actually belongs to the Christmas tree decorative items.  Number 13, outdoor color changing Christmas lights. Now this is a beautiful, beautiful product that simply brings out the beauty in Christmas. Let's search for this one and this time search on Walmart. Outdoor color changing Christmas lights. And here we go, we've got the red and green right here, we've got a red right here. Here is a perfect example. Okay, this Christmas wreath that already comes with Christmas LED lights. And this one right here, color changing fairy lights for your Christmas tree. And you've got more and more as I continue scrolling down. Number 14, inflatable Santa Claus. So here I search on Amazon for inflatable Santa Claus's and check out the variety. What I like about this is that it is a medium to high ticket price range product, meaning you're gonna make some great profit from every time you make a sale from this specific niche. So search for inflatable Santa Claus, but also search for inflatable Christmas. Okay, then you'll get the broad range of the inflatables that you can sell for Christmas like this dinosaur right here with the Christmas hat, eight feet tall, selling at $54. Number 15, candy cane balloons. So right here in Aliexpress, you can see that there are other types of candy, Christmas candy balloons like this one right here, Christmas balloons. And here you can see that candy cane balloon. That is another great seller right before Christmas. Number 16, Christmas garland with lights. So this product is very similar to the Christmas wreaths that we talked about. Only it's not a perfect circle. It comes in all of these different types of shapes and forms. And this is gonna be another hot seller for Christmas. Number 17, Christmas wrapping paper rolls. So back to Amazon that usually has great results, check out these Christmas wrapping paper rolls. So you've got a whole different bunch of variations to work with here. And you wanna do what I told you, add at least 20 of them in your store and you will see that some of them will start to sell. Notice the ones that sold, see what didn't sell, learn from what sold, learn from what didn't sell and continue scaling your way up from there. Number 18, knitted Christmas stockings set. Everybody's buying Christmas stockings for Christmas. So there's no reason not to buy from you as long as you have enough of them on your store and find the actual one that they were looking for. So you can see that some of them come in one color. Some of them come in multiple colors. Some of them are six packs. Some of them are two packs. Some of them are four packs.  You can add a product, okay? Like let's say this one right here, add this Christmas stocking. And you can see that it comes with all of these different types of variations. But what if you want a different variation inside that product page? Okay, let's say you want this variation inside, like this is a variation that's on the outside. It's not a part of the product that I just showed you and it doesn't have any variations itself. But let's say you want to add this as a variation to the Christmas stockings that I just showed you. The way to do that is to go to the product page for the product that you want to add, copy the URL only this time instead of adding the products to AutoDS, you're going to go to a product that you already have. Okay, let's say this is the Christmas stockings that I added to my store. Then I want to add another variation for another Christmas stocking that wasn't a part of that product page. So what I'm going to do is right here in the Variance section, I'm going to click on Add Variant and I'm going to paste the URL right here. Now I'm going to click on Add Variant. And what's going to happen is that variation is going to be added to this product. Now in this case, it's not really relevant because we don't really want to add the variation to this product, but you can do that. You can add different variations from even from different suppliers and from different regions to the same product page that you just created. Moving on to number 19, Ugly Christmas Sweaters. So you're going to search for Ugly Christmas Sweaters and that is what you're going to get. So you got this guy right here, Meadwee Christmas. It is an Ugly Sweater, another more Ugly Sweaters, more Ugly Christmas Sweaters. And to be honest, I'm not sure why they're calling it Ugly because they're not, but it's trending and this is what people are buying. Number 20 on our list, Matching Family Christmas Pyjamas Set. I love this product because I am a father, I have a family and this is another hot seller right before Christmas. So I'm going to search for it this time on AliExpress and to be honest, we've got a very nice amount of Christmas Pyjamas Family Sets through AliExpress and I'm sure that if you'll check other suppliers, you'll also find different variations there. What's important when selling products like these is to be able to offer all types of sizes. So as you see here, we've got a whole bunch of different variations and each one is for a different person. So you got one for mom, mom, small, mom, medium, mom, large, mom, extra large, mom, two extra large and the same for dad. And then you've got the kid sizes too. So make it very clear what you're selling and also add a size chart. It's really important to have size charts so that your buyers will know exactly what size they need to purchase. And as I'm scrolling down right here, you can see that this seller added a size chart to his product page. So those are the top 25 plus products. I went through 20, but there was all the micro niches inside the regular niches. So of course we went over 25 products here and these are going to be some of the best sellers this Christmas. Here are a few extra tips to make more sales. Enhance your store visuals. Make your store have a Christmas theme. If you're using AutoDS, you can get free Christmas themes like the one you're looking at right here. You don't have to pay extra for this. It's included inside your AutoDS subscription. And this way your store will already have a Christmas theme, a Christmas vibe. And you can also create free logos on websites like Hatchful, all right? You have the link in the blog article below this video. And you can also go to freelancer websites like Fiverr.com or Upwork.com and hire a freelancer to create a good looking template for your store starting at $5. Next, you wanna utilize effective marketing strategies. Now, this depends of course on what selling channel you're using. If you're drop shipping on eBay, you can take advantage of promoted listing standard, promoted listings advance and more things like sending offers, volume pricing and more. Next, you wanna be able to provide excellent customer support when your buyers reach out to you, whether it's a problem that they're having, whether they just wanna get some extra information about a product. We wanna answer all of our customers' requests and disputes. It's just a part of it. So don't get mad if your customers are complaining, learn from it and improve your store from there. Provide the best customer service that you can even if it has to set you back a few bucks. It is definitely worth it in the long run.  And that is where AutoDS comes in with price and stock monitoring meaning every time the prices or the stock changes on our supplier's website, it'll also change on our stores accordingly. Quick product importing, I showed you some of those strategies in this video. Automatic orders to fulfill your orders automatically as soon as they come in. A great customer service platform where you can handle all of your customers' requests under one screen if you are drop shipping on eBay. And of course, all of these automation settings for eBay, Shopify, Facebook Marketplace, Facebook shops and more coming up. That wraps up this video on how to prepare your stores for Christmas this year. I hope that you're gonna have excellent sales, excellent profits. I cannot wait for you to come back after Christmas and leave me a comment below. Let me know how it went for you and do not forget to subscribe to our YouTube channel to always stay one step ahead of the game. Thank you for watching and I'll see you after Christmas.


Ukraine plans to buy Polish coastal defence system. Ukraine is negotiating the purchase of the naval strike missile coastal defence system from Poland according to Defence 24. The Polish defence magazine reported that Poland is holding preliminary talks with Ukraine on supplying elements of the naval missile unit armed naval strike missile system. Ukraine is considering purchasing a battery of Polish missile systems or a division. The purchase is expected at Ukraine's expense or with European Union military assistance funding. The system uses naval strike missiles in conjunction with a command and weapon control system similar to the renowned Nassams air defence system used by four NATO countries including the US. The system can be closely integrated and adapted to the country's adjacent weapons and command and control systems. This expands the defended area and enhances the total fighting capability of the force. The naval strike missile has unique capabilities compared to legacy anti-ship cruise missiles. The missile has been designed to ensure a high probability of hit in the current and anticipated future challenging naval scenarios.