Our third lecture series is by Kristen Lauder from Facebook Research, and she will be telling us about a field that she's done a great deal of important work in super singular isogenic graphs in cryptography. Thank you, Kristen. Great. Well, thank you so much. Thank you all for joining. I'd like to start by introducing Yana Sotakova, who's the TA for the course, who's prepared excellent exercises and a lot of kind of supplementary content, which will be hopefully very useful and a lot of fun for you to engage with. So let me start right away, because I definitely have more than 50 minutes of content, so I might need to be cut off at some point if I'm going too long, but I will try to compress it. So in order to talk about super singular isogenic graphs in cryptography, there's a lot of words there to specify and get into more detail. And I'm going to start at the end. I'm going to start a little bit about cryptography and then explain about the graphs and the in particular, super singular isogenic graphs. So just so that everyone is on the same page, I'm sure some of you already know quite a bit about cryptography, but this is the motivation for the topic. So I thought it would be silly to start without giving the motivation. So in general, the cryptography is the science of keeping secrets, but it's more than that. It's also used for besides confidentiality. It's also used to assure authenticity. And the main tools besides encryption, decryption, which is probably the main thing that you know about are digital signatures and key exchange and digital signatures and key exchange are right now the topic of an ongoing NIST competition. So NIST is the National Institute of Standards and Technology Government Agency in the US, but they run international competitions to select cryptographic primitives and often these the standards that they establish are used around the world and the NIST is currently running a five year post quantum cryptography competition and they are focused on choosing new key exchange primitives and new digital signature primitives. And so what I wanted to make sure that you all kind of know the context here and that is that that these main building blocks key exchange is really just to a protocol for two parties to agree upon a common secret using only publicly exchanged information. Signatures allow parties to authenticate themselves and obviously encryption allows you to preserve the confidentiality of data. So the common public key crypto systems in use around the world today in industry and in you know all kinds of systems on the internet are RSA, Diffie Hellman, Elliptic Curve, Diffie Hellman digital signatures, which is DSA and Elliptic Curve DSA. So you may be familiar with this already, but if not, I mean, you're using these systems every day in your in your daily life, starting from, you know, secure browser sessions whenever you want to buy something online, which is governed by the standards for the HTTPS standards for secure socket layer SSL or the modernized version of that, which is TLS, there are standards which define how to do encrypted signed encrypted email, which is Esmime. Unfortunately, Esmime is not very widely used. So most people are generally not using signed encrypted email, although maybe that's changing a little bit. Virtual private networking is governed by standards for IP SAC and authentication of messages and content is generally done via certificates, which in the US is governed by the ITU section of the UN ITU X509 certificates. So what you can hope I know that was like a lot of a lot of random names if you're not familiar with cryptographic standards, but the point that you should get out of this slide is that the way that mathematics ends up getting into use in practice is through a complicated interaction of government agencies, academic researchers, researchers in government and researchers in industry working together. And in the case of these systems that I've mentioned, all of this has happened over the last three or four decades to make sure that these systems, RSA and EC elliptic curve based systems are used. But so so far I haven't really said, sorry, I'm going to exchange the order of these two slides. The way that the mathematics is used here is that the security of these crypto systems is based on hard problems in mathematics, such as factoring large integers. So the RSA system is based on the difficulty of factoring large integers. Diffie-Hellman systems are usually based, they have to be based on some kind of essentially a cyclic abelian group. So you can use the discrete logarithm problem in Z mod PZ star. I haven't said what the discrete logarithm problem is. I'll say that in just a minute. There is another cyclic abelian group that we can use for the discrete logarithm problem, and that is elliptic curve groups. And I'll tell you about that in just a second. And then there's another thing which we don't talk about as much. It's more recent and it's not as widely deployed. And that is pairing based systems, which are using the vay pairing on elliptic curves or variants of the of the vay pairing. So since one of the main objectives in this lecture is to talk about graphs that involve elliptic curves and a lot of the exercise that Yana have prepared involve elliptic curves. I wanted to at least just kind of present the basics here. So I'm sure that many of you do already know a lot about elliptic curves. But if you don't, I'm just presenting just just one slide. This is not a whole, you know, graduate course in elliptic curves. But so you can have kind of the basics. And this is honestly the way that cryptographers really think about elliptic curves.  And I don't think I ever saw an equation for a curve ever. But in fact, in the in the industry and, you know, especially computer scientists using mathematical objects such as elliptic curves and mathematicians that work at the interface of computer science, you can simply think of an elliptic curve as being defined by an equation. So what you first do is you specify your underlying base field. And for cryptography, it's always going to be a finite field. In general, for elliptic curve cryptography, it's going to be a large prime field. So we're going to specify a large prime P. I've tried to put the mathematical notion in a notation in green here and to italicize it. And the large prime is going to define the base base field Fp. So I'm sorry, my PowerPoint skills did not include being able to put a bar over an Fp. So Fp bar is mean means the algebraic closure of Fp. And so an elliptic curve over Fp or Fp bar, when P is very large and in other words, greater than three, like if P is not equal to two or three, then you can convert the general virus stress equation for an elliptic curve into a short virus stress equation. So it's just given by two coefficients, these constants, A and B, which come from the base field and y squared equals x cube plus Ax plus B defines the curve and the points on the curve are just the x comma y, which satisfy this equation. Now, this is just an affine equation for the curve. And it does not tell you the whole picture. What you should really do is think of like a homogenized version of this equation in projective space. So you would add a variable Z and homogenize this. And then you could see that there's also a point at infinity. And there's a group law on this on this curve. And again, I'm because I don't have a lot of time and the group law is not as important for the application I'm going to talk about. I'm not showing you the usual picture of the cord cord and tangent method, which is how you can see the group law on this algebraic curve. So the nice thing about the elliptic curves is that they have both this geometric aspect, which is they're given by an equation and they have the algebraic side, which is that they have a group law and you couldn't do cryptography on these objects if you didn't have the group law. So like I said, the group law is just, you know, this cord and tangent method, which takes two points on the curve and passes a line through it and looks for the third point of intersection. And the basically in more fancy language, you could say that in the divisor class group, the divisor of this line is the these three points of intersection. And so that is zero in the divisor class group. So that means that the sum of the two points must be minus the third point. So now we have these elliptic curves, they're given by an equation. They have a group. They have a group law. So there's two other things that I would like you to know about elliptic curves for the purpose of this lecture and this the focus of this kind of short course. And that is that elliptic curves are very convenient for cryptography because they have a very nice compact label, which is called the J invariant. So the J invariant is simply a rational function in the coefficients that define the curve. So you can see A and B. So it's 1728 times 4A cubed in the numerator and 4A cubed plus 27B squared in the denominator. And this is actually in an isomorphism invariant of elliptic curves over Fp bar. So just a little just a little note here. I noticed something in the exercises that Yana prepared. And so I was just going to give you a little heads up or a little highlight a fact. And that is is that so two elliptic curves will have the same J invariant if they're isomorphic over Fp bar. And it can be the case you can have two elliptic curves defined over Fp and they're not isomorphic over Fp. So but they could have the same they could be isomorphic over Fp bar. So that's because you're allowing isomorphism that are defined over the larger field. So another thing I wanted to call out is that super singular elliptic curves. A lot of times I'll be using the word super singular. And the funny thing is, is that in the applications in in the cryptographic world these days with super singular isogenic graphs, a lot of people are able to implement and work on these graphs without even ever knowing what the word super singular means, because actually once the graphs are there and the elliptic curves are there, you kind of don't need to really think about it. But all of the mathematics behind these graphs depends on the fact that we're going to be thinking about super singular elliptic curves. So if you read Silverman's beautiful text on elliptic curves, you'll see, you know, multiple definitions of super singular and shows the equivalence between different definitions. I'm just going to give you one, which is the kind of the easiest to state is, is that elliptic curve modulo p like over some finite field of characteristic p, it is super singular if there are no p torsion points, not all not over the field of definition, nor over any extension field. So no, no p torsion. And so another fact that we kind of need is, is that the isomorphism class and the fp bar isomorphism class of any super singular elliptic curve contains a representative, which is defined over fp or fp squared. So that means that in shorthand, you may hear me say like super singular elliptic curves are defined over fp or fp bar that that's not exactly right. What it means is, is that every super singular elliptic curve has an equivalent, you know, has a representative in its equivalence class, which is defined over fp or fp or fp squared. And then finally, the last fact, which we're going to use, and this is what we'll get into more in the second and third lectures is that the endomorphism ring of a super singular elliptic curve is actually isomorphic to a maximum order in a definite quaternion algebra and we'll talk about that more in subsequent lectures. So endomorphism ring just means the set of basically rational maps on the elliptic curve and elliptic curves because they have a group law are very nice. They have multiplication by an integer. So Z, the integers is automatically in the endomorphism ring of an elliptic curve because you can take any integer, you know, just let's take the integer three, you can multiply a point by three, that just means adding the point to itself three times p plus p, p plus p. And there's also the notion of negation. You can see that even geometrically. So you've got the integers in the endomorphism ring. And over a finite field, you always have Frobenius. So if I call Frobenius pi, Frobenius is just the map that takes the coordinate, coordinate Ys, X comma Y goes to X to the p comma Y to the p. So you always have the Frobenius map for elliptic curves. But in addition, if it's super singular, you have extra automorphisms that turns this into a rank for a Z module. And like I said, we'll get into that a little bit more later. OK, so there's one other notion that I really wanted to talk about before introducing super singular isogenic graphs and some of the hard problems here.  I just throw these words out there, hard mathematical problems. Yeah, so what does that mean? Well, I realized after giving this kind of lecture for a while that a lot of very famous mathematicians actually really had no idea what I meant by that. And that's because in mathematics, a lot of times we think, what does it mean to be a hard mathematical problem? Well, we think that it means that there's a conjecture that no one has proved yet. That's what people generally mean by hard mathematical problem. That's not at all what we mean by hard mathematical problem in cryptography. So I realized that would be very important to specify this. What we mean by hard mathematical problem is that you set up some system and you specify how many bits does it take you to represent elements in this system. So let's say your input is represented by n m bits. I've got the m in green here, little m. So that as an example, in the previous system, I just talked about elliptic curve cryptography. A and B were from a finite field Fp. And both p and a and b can be represented in roughly log p bits. So that would be m would be log p in that case. Down at the bottom of this slide, you see from the RSA system where you have a large, large integer little n, which is actually the product of two primes, p and q. All the elements in your system are integers, modulo n, and they all take you m bits to represent where m is log n. So then what we mean by hard mathematical problem is that the best known attack on the system runs in exponential time. So to compare, I've written, sorry, the sentence doesn't make a lot of sense the way it is. The best known attacks should run in exponential time, but I've also written here, what does it mean to run in exponential time? What does it mean to run in sub exponential time or polynomial time? So exponential time basically means it's o of some power of m, like some exponential function in m, like 2 to the m. The o notation, if you're not familiar with it, it just means that whatever the actual running time is, it's proportional to the time that I've got written in the parentheses here. And so sub exponential, so polynomial should be pretty clear. That means that the running time of the best known attack is polynomial in m. And so the middle case here, the sub exponential formula is a little bit more complicated to write down, but it's basically the exponent is just like a fractional power of m, where the fraction is between 0 and 1. So exponential time is like 2 to the m. And what we're trying to get is this asymmetry between the number of bits that it takes you to write stuff down and communicate. And the amount of time it takes an attacker to attack you. So that's what we're trying to capture with this notation, exponential time. And that's because basically, people want privacy and security, but they don't want to pay for it. They don't want to pay for it in time that they wait for a system to give them the outcome that they're looking for. And they don't want to pay for it in overhead, in bandwidth, in compute cost, all of these things. And the time and compute cost and bandwidth are all proportional to the size of the inputs. So you want your input size to be small and you want your running time for your attacker to be large. So that's why we quantify it. So that's what we mean by hard mathematical problem. We don't mean that you have to prove the Riemann hypothesis. OK, so at the risk of going over time, let's see, so I've been talking for about 20 minutes, I'm going to very briefly talk about the context of quantum computers and quantum algorithms. So the issue for all of these systems that I've mentioned, these public key crypto systems that are in use around the world today, is that they will all be broken once we have a full-scale quantum computer that it can be realized and do computation at scale. So the reason for that is that in the mid-90s, Shor introduced an algorithm for factoring that runs on a quantum computer. So we call them quantum algorithms. And this quantum algorithm is polynomial time for factoring. So it's a quantum polynomial time algorithm. And for an M bit input, so if M is log N and N is the modulus for RSA, it runs in roughly 4M cubed time and it requires 2M qubits. So the point is that in today's classical world, minimum size for, I'll just pause for one second. Does anybody know the minimum size for RSA, module I, that are used today in practice? You don't have to say anything because I don't know if anybody wants to unmute. But I just wanted to give you a time to think about it. If you know, if you've never heard it, then you probably don't know. But it's a trick question because it is on the second part of my slide here on the bottom where it says RSA M equals 2048. So roughly 2,000 bits. That's the minimum size that's in use today. So that means that we're going to need a more than 4,000 bit quantum computer that can handle more than 4,000 qubits in order to break this. But once we have that, it'll be kind of a trivial running time. 4 times M cubed is very small. And same thing for elliptic curve cryptography. So an elliptic curve cryptography will require roughly 6M qubits and roughly 360 times M cubed time. But if you look down on the very bottom of the slide, elliptic curve cryptography uses smaller bit size like M equals 256 or now 384 with the newer guidance. Because for RSA, we do know some classical sub-exponential attacks, whereas for elliptic curve crypto, we only have in the classical world, we only have exponential attacks. And that's why we have a smaller bit size for elliptic curve cryptography. So moving on, the result of this quantum kind of threat is that we need to figure out new systems, kind of new hard problems, mathematical problems to use as a basis of crypto systems for the future when we have quantum computers at scale. So the timing, and this kind of spans my career. I was at Microsoft Research for 22 years. And I worked for my first five years on getting elliptic curve cryptography deployed in Microsoft products. And they started being deployed roughly in 2006 around the time when US government started requiring it for all US government contractors. The Suite B requirements came out and required the use of elliptic curve cryptography and set the bit lengths to be used. Roughly 10 years later, the CNSA document came out and increased the required minimum bit length for ECC from 256 to 384 with no explanation. But we could assume that it had something to do with the progress on building quantum computers. But they also discontinued the mandatory adoption of ECC. And in 2017, and this launched the international competition to select new candidates. So very quickly, I'd love to tell you about all these different new directions for in the NIST PQC competition. But I don't have time given that we want to focus on the super singular isogenic graph. So I'll just mention the different streams, the different areas of mathematics that have been proposed and are being considered actively in this competition. So code-based cryptography was first introduced by McLeese in 1978 based on the hardness of decoding random linear codes. Multivariate cryptosystems first introduced by Matsumoto and MI in 1988, based on the hardness of solving systems of multivariate equations, nonlinear systems. Obviously, otherwise, it would just be linear algebra. Lattice-based cryptography was first introduced by Hoffstein-Pyfer and Silverman in 96 and when they launched the Entrue company based on the hardness of finding short vectors in large dimensional lattices. And then super singular isogenic graphs, which is what I'm going to spend the rest of the time talking about here today, were introduced by myself with Charles and Gorin in 2005 actually at the NIST hash function competition in 2005. So but for all of you thinking about areas to go into for your thesis, there's a lot of material here and there's a lot of urgency too. All of these problems need to be addressed because we have to see first, if there are classical algorithms to attack these things and then whether there are quantum algorithms. So it's kind of double the work. So I highly encourage all of you to look at any or more of these problems that you might be interested in. OK, so now I'd like to shift over for the last basically 25 minutes to super singular isogenic graphs. So the new hard problem that we introduced into cryptography for the NIST hash function competition in 2005 is basically finding paths in these graphs. So think about a graph. A graph just means a set of vertices and edges. So the vertices are connected by edges. And in all in this whole talk and everything I'll be talking about to me, these edges are undirected. That just kind of makes it easy, easier. It just means an edge is something that connects to vertices. But you'll see in the definition that they look to begin with to have a direction, but we can kind of make our graphs undirected with some extra conditions. We also for our proposal of the hash function, we also assume that we're dealing with k regular graphs. So k regular just means that every vertex has k edges coming out of it. And we're also interested in graphs with kind of optimal expansion properties. So that's related to the Ramanujan properties of these graphs. So I'll say a little bit about that in a minute. But as you can see that if you want to use this problem of finding paths in the graph as a hard problem for cryptography, the underlying assumption is that finding those paths is hard, or in other words, there's no known efficient routing algorithm. So I actually I love to just pause and give this little story. At one time, I heard a lovely talk by Ron Graham about graphs that have efficient routing algorithms. And I forgot the formulation of exactly what he was saying. But it's basically saying that graphs that have some kind of an isometry to the hypercube are graphs where you have a good routing algorithm. So when you think of that, so I also I'd like to give the example of a hypercube. I'm not sure if I don't think I have it in my slides here. So I'll just say it. So the hypercube, what is the hypercube when you think of it as a graph? So let's fix some bit length. Let's just say n, you've got n bits, zeros and ones. And every vertex in the graph is a bit string of length n. So those are the vertices. And what are the edges? Well, two vertices are connected if they just differ by one bit. So if you can just take the bit string and flip one bit and then the next bit string that you get, that's connected by an edge. If you have to flip two bits, then it's not connected to that one. So that's the hypergraph. And so now I'm going to give you two bit strings, two random bit strings, zeros and ones. And how do you find a path from one to the other? Well, it's very easy. You just go through bit by bit. If it matches, you don't do anything. If it doesn't match, then you flip that bit. And that's one step in your graph because that's an edge, just flipping one bit. And so now you quickly have a path between these two things. You've just flipped the bits that needed to be flipped so that they would match. Well, then the one thing that you could probably see is that you could have flipped those bits where they differed in any order. So there's actually a lot of different paths in that graph and you can find them easily. So this is a terrible idea for a cryptographic system, right? So you would not want to take the hypercube. So what instead we're doing is we're trying to come up with some nice mathematical construction of a graph where it's easy to write down what the graph is or like what the elements of, you don't want to have to write down the whole graph because it's of exponential size, it's really large. But you want to be able to specify vertices and edges in your graph really easily but still have it really hard to find paths between two random vertices. Okay, so hopefully that gives you the idea of what type of graph we want to use for crypto applications. So now I'm going to tell you about the hash function that we proposed, the CGL hash function is, so first of all, let me tell you what a hash function is. All of those protocols that I mentioned in the beginning that are cryptographic protocols for key exchange, for secure browser sessions, for assigned encrypted email, for certificates, everything, all cryptographic protocols use hash functions. So it's an incredibly important building block in cryptography and they're usually modeled as a random oracle, which kind of means like they're magic, like they magically give you some random value and there's no correlation. And so here a hash function maps bit strings of some finite length to bit strings of some other finite length. Very typical will be where little n here is much, much bigger than little m. Sorry, I've used little n and little m in other places in the slides for other meanings here, just two random sizes. And if n is way bigger than little m, then it'll be very, it'll be like efficient or good from the point of view of compressing. Like, so if you've got a large video file and you want some hash of it to be like a little bit of a, oh, I forgot what they call it, a tag or something for the movie, m would be very small, typically like 256 bits, whereas n could be extremely large. So as you can see, if n is extremely large and m is small, then of course there's going to be, it's not gonna be injective, right? There's gonna be a lot of, there are potentially a lot of collisions. And so what you want for a cryptographic hash function is that the function h is public, easy to compute, it's unkeyed, doesn't require a secret key to compute it, but also collision resistant, which doesn't mean that there are no collisions. Like I just said, if n is much larger than m, then definitely there's tons of collisions. It's just that it's really hard to find them. So another thing is, is that you don't really want the output to be biased in these m bits. So that's why it's nice to have a uniformly distributed output. It's not necessarily a cryptographic requirement, but if there is bias, then there will be ways to take advantage of it to compromise the system. So the definition of collision resistance is just that, if it's computationally infeasible to find two inputs, which hash to the same output. So two inputs x and y, such that h of x equals h of y, and a hash function is pre-image resistant. If given any output of the hash function, it's hard to find an input, which hashes to that output. So this cryptographic hash function that we defined based on, in general, based on expander graphs, but in a minute we'll see, in particular on super singular isogenic graphs, is you take a k regular graph, and you have to assume also that every vertex in the graph has a label. You're gonna need labels for your system. And what you do is you take the input to the hash function, it's a long bit string, like I said, of length n, and you divide it into blocks. Each block is used to determine the next step in a walk around the graph. So you'll have some starting point specified, some initial vertex that's specified, and then you read off your bit string, which is the input to the hash function block by block. Each block is used to determine which edge to follow at your next step. And very importantly, no backtracking is allowed. So you're not allowed to take a step, and then your next step go back to the vertex where you were. That's called backtracking, and that's never allowed. So those are the rules for kind of walking around the graph starting at your first initial point. And then when you finish your walk, like when you finish going through the whole bit string, which was the input, then the output of the hash function is the label for the last vertex that you landed on. So that's the definition, a hash function in general. That's the cryptographic hash function from expander graphs. So there's a couple of things to specify here. Or to think about, and that is, so what does it mean to be collision resistant in this? So I'm just drew a little piece of one of these graphs here.  But as you're walking along, I have shown you some arrows here, and I don't mean that this is a directed graph. I'm sorry if that's confusing. I just mean that this is the direction that I'm walking in. So I'm gonna start up here and let's say it's a three regular graph and that undirected. And that as we walk along this, as we take this input, you see this input up at the top one, one, zero, that's the input to the hash function. You read the hash function off bit by bit for a three regular graph. Why? Because no backtracking is allowed, other than the very first step is a little bit of an issue, but no backtracking is allowed. So that means you can never go back to where you came from. So at every point, you only have two choices for where to go. And two choices is specified by one bit. So as you go through the input to the hash function, you just go through it bit by bit. So the blocks are size one here. So for example, for the first bit, it's a one. So we're gonna go along the edge labeled one. The second bit is a one. So we're gonna go along the next edge labeled one and then the third bit is a zero. And then the output would be the label of this final vertex. So that's how the hash function works. And so then what does it mean to have a collision? A collision would mean that there were two paths that kind of ended up at the same endpoint. And so if you had, and this is undirected, what that would mean is that if they weren't the same path, then that means that there would be some cycle. You would have found a cycle in this graph. So the other thing, I think I've kind of covered this slide already and I only have, yeah, 10 minutes left. So I guess I still wanna, I just wanna comment. This idea of taking a random walk around an expander graph is a very standard idea in computer science. This is not an idea that we introduced. It's an idea that's used throughout computer science for randomized algorithms. And the only thing that's really different here and also which leads us to consider super singularisogenic graphs is that we want to have the extra property that it's hard to invert these walks. So the walks, random walks themselves on expander graphs are a well-known way to generate a roughly uniformly distributed output. So because of time, I had to skip all of my slides about expander graphs, but expander graphs are basically, just think of them as being like k regular undirected graphs where there's an expansion constant C that means that whenever you take any subset of the graph, which is like up to half of the vertices of the graph and you look at all of its neighbors that are not already in the subset, that the number of new neighbors that you get will be proportional to like C times the size of the graph. So you get some constant factor of expansion from every set. So expander graphs, there's a lot of beautiful theorems about their behavior and how they're related to like the adjacency matrix for the expander graph, which I might mention later in the number theoretic context. But here, the main thing that's different from the general philosophy in computer science of using random walks on expander graphs is that we want expander graphs where routing is hard, finding collisions and finding paths is hard. So we're monitoring graphs or graphs that we have beautiful constructions from number theory four and that are optimal expander graphs in some kind of asymptotic sense. So I'm not sure if we'll have time to come back to the actual definition there, but the, I'm gonna just skip over, I already kind of told you about collisions, but this brings us to a construction of the Rondigian graphs from number theory, which is very beautiful and which is the kind of foundation for our crypto system. So these graphs are often attributed to either Pizer or Mestra, depending on what kind of number theory you like. Pizer introduced them in the context of quaternion algebras, Mestra, in the context of modular forms. There's beautiful connections to both of those areas. So hopefully it won't be a fight over whose name you should associate. So the vertices of the graphs that we proposed, so now I'm finally getting to explain my title, super singular isogenic graphs. The vertices are going to be isomorphism classes of super singular elliptic curves, mod P, meaning like over FP bar. And as I said, there's a theorem which assures that each isomorphism class will have a representative defined over FP or FP squared. And so that means that when you take the J invariant, all the J invariants will either be an FP or an FP squared. So they take what basically log P or two log P bits to represent. And that's important because you have to actually implement these systems. And so you want to have like a finite, you had one to know how many computer words you need in order to represent your labels for your vertices. Okay, so secondly, the edge, the isogenes are gonna be the edges. So the vertices are isomorphism classes of super singular elliptic curves and the edges are gonna be isogenes. So what is an isogenic? So isogenes are basically birational maps between these elliptic curves, but I'm gonna cheat a little bit and I'm going to kind of flip over to the algebraic side here. So an elliptic curve in addition to being a geometric object, it's also just, it's a group. It's the group of points on the elliptic curve or an abelian group. So if you wanna take an abelian group and map to another abelian group, one way to do that is to just take a subgroup and quotient by that subgroup. So isogenes are basically, you should just think of them as taking the group of points and quotienting by some subgroup. Now, if P is super large, P is the prime field here and the degree, so the degree of your isogeny is basically gonna be the size of that subgroup that you've quotient by. And if the degree is co-prime to P, if L is gonna be the degree and let's say L is gonna be very small for efficiency reasons like L is equal to two or three. And again, P is very large. If L is co-prime to P, which is always gonna be the situation for us in the crypto applications, then we actually can think of, all the isogenes are separable and we can think of them as being entirely determined by their kernel. So all of these are theorems that are proved like in Silverman's book, if you wanna go and read the theorems and the proofs. But what it means in practice is that even though these birational maps between these algebraic objects, algebraic geometric objects might seem very complicated. In fact, in practice in the applications, all you're gonna be doing is quotienting by a subgroup and it's a small subgroup. And so I'm going to show you the formulas for the subgroup. And again, I'm rushing a little bit because I'm running out of time but I'll make these slides available as well is that the, for example, if you take just a two-torsion point on the elliptic curve, which in a large characteristic is just given by a point Q with X coordinate equal to R and the Y coordinate will be zero because that's what makes it a two-torsion point. And if you take that as the group generated by it is just itself and the identity. And if you take the elliptic curve given by this equation Y squared equals XQ plus AX plus B and you quotient by this point Q by this subgroup generated by Q, you will get the elliptic curve E2 that I've written the formula there for. So you can see how simple it is. You can see how the coefficients of the new curve depend on the coefficients of the previous curve in terms of A and B and then involving R as well, the X coordinate of the two-torsion point. And then you can see what the actual maps are. And these are called Vailou's formulas. I'm not sure if I have the general, no, I don't have the general formula for Vailou because it looks a little complicated in if it's not a two-torsion point but this is Vailou's formulas just for two-torsion points. So in the exercises, I think Yana will have you working on some super singular isogenic graphs for small primes and taking walks around the graph using two-torsion points. So you basically just be using these formulas to kind of compute the new elliptic curve, compute the J invariant of the new elliptic curve, et cetera. And you can see how easy it is to do, like even like on pencil and paper, you'd be able to do this yourself. But in particular, there are, you know, the computer algebra systems, magma and sage have a lot of these functions implemented in them already. And so you can use those functions, those native functions. So hopefully you'll get some experience doing that. So I just wanna end with kind of talking about the properties of these beautiful super singular isogenic graphs. So just to go back to this slide here, there's a couple of things that we assumed in our original paper in 2005. And that is that if you assume that P is congruent to one mod 12, then what happens is that there's no extra automorphisms for any of the elliptic curves. And think of an automorphism in the graph as being kind of a self-loop. It's like an extra little self-loop, which is, you know, kind of annoying when you're talking about regularity and stuff. So if you don't have any of these extra little self-loops, if P is one mod 12, then what you can do is you can collapse edges. So you've got isogenic is quotienting by a subgroup. So it's going out. So it starts at one elliptic curve and it really seems like it's directional, it goes out. But isogenes also have a dual isogenic. And what we can do is we can associate the dual isogenic with the original isogenic and collapse them into one edge. And that's what makes it an undirected graph. So that's kind of always how I think of it. So that's what we mean also when we say L. So L plus one regular. So after you've kind of collapsed these edges, an isogenic with its dual, every one of these elliptic curves, when L is coprime to P, you've got the L torsion is isomorphic to the abelian group Z mod L cross Z mod L. And if L is prime, there are L plus one distinct subgroups of order L of Z mod L cross Z mod L. So that makes this an L plus one regular graph. So for example, if L is equal to two, going back to the example I gave earlier of the hash function, if L is two, this is a three regular graph and you can read off the input bits bit by bit for walking around the graph. So that's what you should always have in mind. Very large P, very small L, in other words, L equals two. The Ramanujan property, we're probably gonna have to talk about some other time. So I'd like to just leave you with this picture. So this is an article that was published in Science Magazine in 2008, so 13 years ago now. And it was written by Dana McKenzie. He heard me talk about these hash functions at one of the AMS joint mathematical meetings. And he wrote this article about the ongoing hash function competition and about our proposal to make hash functions from these super singular isogenic graphs. And so we created, with my co-authors, Dennis Charles and Yael Goren, we created this picture, which is now shown a lot by cryptographers in the area. And so if you didn't pay attention to anything else I was saying about super singular isogenic graphs and you just wanted to keep a picture in your mind, you could keep this picture. So why this picture? So look at, there's a lot of, all the circles here are supposed to be vertices. And I think I took the prime to be like something like 25, 21, 2,521. You can check, make sure that that is actually prime, if I'm remembering it right. And what I didn't get into yet is the fact that the size of the graph for a given prime is given by the Eichler class number and it's roughly P over 12. There's the exact formula in silver minutes, greatest integer part of P over 12 plus either zero or one or two. And so if you divide 25, 21 by 12, you get that's a little bit more than 200 vertices. So what you're looking at here is about 200 vertices and all of these lines are the edges and the overwhelming experience that you're supposed to have here as looking at this is that it should look very jumbled. So in other words, it doesn't look like it has any orientation or any pattern or any structure to it. So if you take two random vertices, so I think in this one, we took the vertex one and the vertex like 24. In order to find a path between them, you've got this blue path that kind of goes all over the place, starting from the vertex one, you really, there's no orientation. You wouldn't know what direction to go in to find this other vertex 24. And then the red thing is a cycle. So suppose you wanna find a cycle in the graph, you don't have any real way of going, knowing which direction to go in to find a cycle. And so that is consistent with the property of optimal expander graphs or remodeling graphs. The theorems that we have there say that for expander graphs, as you walk around, if you take some minimum number of steps that is roughly log P, that you should quickly approximate the uniform distribution on the graph. So you don't really have any notion of kind of a better way to go to get to some other random vertex. So I think that my time is up and I will end with that and we'll keep going on the rest of the slides on the next lecture. I'd be happy to make the slides available to, I'll find out from the conference organizers, how to share them with all of you so you can see them. So thanks everybody. Okay, let's thank Kristin for that nice talk. Are there any questions? I have a question. Near the end, you said something about choosing P to be one month 12 in order to make the graph undirected. Could you say something about why it matters that it's one month 12? Yeah, so if you have, if it's, if P is one month 12, then you won't have any extra automorphisms on any of the super singular elliptic curves mod P and an extra automorphism is like a little loop that's like an extra kind of edge in the graph in a sense that you don't really want to be there. So it turns out that like if you look at Pizer's original paper, Ramanuj and graphs from basically like Eichler orders in quaternion algebras, he assumes that P is one month 12. And for this reason, like we also thought it was important and nice, easy way to make the graph undirected, all of that. But in, I didn't get to the key exchange part of this talk, but these days for the psych super singular isogenic key exchange, they're often using primes that are not one month 12. And so I worried a little bit. I was like, well, wait a minute, wouldn't there be extra edges around? And well, you know, could that mess up the system? And Yana actually did some experiments. I mean, she can tell you more about it, but there's very little reason to worry actually, even if you don't have P is one month 12. There might still be some kind of weird attack that we could come up with, but it only affects very small number of the vertices. So if you look at really special super singular elliptic curves like where J equals zero or J equals 1728. So one of them is a curve that you'll be looking at in one of the exercises just like Y squared equals X cubed plus X. You have kind of extra automorphisms there. And, but if you ignore these very few, very small number of vertices where there's an extra automorphism, it seems like it doesn't really matter that they're using, that they're not imposing the condition P is congruent to one month 12 for the key exchange. Okay, there are a couple of other questions in the chat, but it looks like they've been answered by Yana. Any other questions for Kristen? So could I ask again one other question about those automorphism when P is not equal to one month 12? Because if I understand correctly, an automorphism will be an isogenic of degree one. So how are they going to appear on the L isogenic graph? Oh, I'm sorry, you're right. It doesn't appear, but what it does is if you compose it with one of the edges, it'll look like it's different than what it is without being composed with it. So it'll make the graph look like it has double edges. You see what I mean? Yes, it's okay, it would be like a very short circle. Exactly. Thank you. In general, thanks for asking again. So in general, in our original paper, we actually imposed, not just P is covered to one month 12, we proposed that we put many more congruence conditions on P, which will make it impossible to have really short cycles. And that's because if you have a cycle of length two or length three, it corresponds to certain elements with a certain trace and norm. And it will basically ensure that you have a specific imaginary quadratic field embedded into that quaternion algebra. And if you put conditions on P that basically disallow such embeddings, then it means that you cannot have those short cycles for that L and that P. And so this is an example, like we put P congruence to one month 12 and that means no two cycles and then et cetera, et cetera. Unfortunately, the congruence conditions, if you wanna disallow three cycles, four cycles, five cycles, all that, it makes the congruence condition pushes the size of the prime up and up and up very quickly. Okay, if there are no other questions, let's thank Kristin again for her lecture. Thanks everyone, see you Wednesday.


Hey, is anyone else super irritated at how far left Joe Biden is? I mean, he's essentially a communist at this point, right? Look, I don't understand DC discourse. I think that everyone who's in DC, to at least a certain extent, has brain rot. Because over the course of the last two, maybe three days, we've had two different prominent reporters complain about how far to the left Biden is. Now, of course, zero examples here, but it happened when Peter Ducey asked Biden himself why he's so far left. And then Morning Joe or Joe Scarborough, host of Morning Joe. We can call him Morning Joe or Moronic Joe. I prefer Moronic Joe. But anyways, Joe Scarborough asked Ron Klain why Joe Biden is so far to the left, and if him being such a huge lefty is what's turning off folks like Kirsten Sinema and Joe Manchin. But then Joe Scarborough will contradict himself.  But I think that most people have to at least acknowledge that this is so disingenuous, so wrong that it's laughable. But here we are where we have individuals asking this question with a straight face. So first, let's look at the clip with Peter Ducey and see how Joe Biden responds. Why are you trying so hard in your first year to pull the country so far to the left? Well, I'm not. I don't know what you consider to be too far to the left, if in fact we're talking about making sure that we had the money for COVID, making sure we had the money to put together the bipartisan infrastructure, making sure we were able to provide for those things that in fact would significantly reduce the burden on working class people, but make them have to continue to work hard. I don't know how that is pointed to the left. If you may recall, you guys have been trying to convince me that I am Bernie Sanders. I'm not. I like him, but I'm not Bernie Sanders. I'm not a socialist. I'm a mainstream Democrat, and I have been. And mainstream Democrats have overwhelmed me. If you notice, the 48 of the 50 Democrats supported me in the Senate. I'm virtually everything I've asked. So first and foremost, Joe, keep Bernie's name out of your mouth. Second of all, I think that his response to just laugh, that's the only response that you can have. Because these right-wingers who try to claim that Joe Biden is a far leftist and he's trying to move the country to the left, I don't even think it's worth entertaining.  And we don't have to entertain it because there's no substance there. As you'll see with the Joe Scarborough clip, same as the case with the Peter Ducey clip, they don't provide any examples as to why Joe Biden is a far leftist. Perhaps over the last couple of decades, you can argue that the Democratic Party has shifted left on social issues. But with regard to the actual left in America, they are nowhere near representative of what we want. I would know as a leftist. But let's get to the Joe Scarborough clip because he should know better. I mean, he's still a conservative, but in some ways he should know better. But look at what he says here and try to keep it together because watching this almost made my head explode. So it may be the former Republican to be asking this question, but I look at Joe Biden and I see a guy that was elected as the one moderate standing up on the debate stage while others were promising to return America to busing and to give free healthcare to illegal immigrants. President Biden struck a moderate tone. You should look at Eric Adams up in New York, the same thing. The moderation is selling in the Democratic Party. So why is it that it seems time and time again the president is overreached, moved too far left and has not been able to bring those final two senators home? Well, first of all, I think the president is right in the middle of where the country is. You look at what's in our Build Back Better Plan. Bringing down the cost of childcare. I think that's a very moderate thing for families. Reducing the cost of prescription drugs saying you shouldn't have to pay more than 35 bucks for insulin. I think that's an all-American mainstream proposal. Are you all going to split that up? Because you're right, every one of those bills would be really hard for Republicans to oppose. So are you all considering this next year splitting that up? I have to say to the former Republican in you, somehow Republicans are opposing them.  He's that uninformed. I don't know if he is dishonest or disingenuous.   He just says it and expects it to be, you know, a fact. But that doesn't make it a fact. And first of all, he says, moderation is selling in the Democratic Party. No, moderation is not selling in the Democratic Party as much as you think it is. Certainly there are moderates in the Democratic Party, but what really sells in the Democratic Party is fear mongering. Joe Biden essentially was elected by Democrats because he was told by individuals like you, Joe Scarborough, that he was the most electable. But when you look at exit polls from the 2020 Democratic Party primary, voters by and large sided with Bernie Sanders. They supported Medicare for all, but they go with Democrats who they think are the safest bet against Donald Trump because you scared them into thinking that socialism bad being far left bad and that's why they vote the way that they do. But he says here that, you know, perhaps the reason why mansion and cinema aren't on board with Biden's agenda is because he's too far to the left. First of all, to say that while not even mentioning the elephant in the room, that is their corporate donors. I mean, this is political malpractice. You should not be a political commentator if you don't point this out. Second of all, you can't just keep saying that Biden is far left without providing us with any evidence. And I said that and it's a little bit redundant. I'll probably keep saying that, but it's important, right? I have evidence to the contrary. I have evidence, at least anecdotes that suggest he shifted to the right since he's been in office. And I say this because he campaigned on cancelling $10,000 worth of student debt. He hasn't done that yet. He campaigned not on Medicare for all, but on a public option. And we've heard nothing about any sort of healthcare reform to say that Joe Biden has shifted to the left. It's laughable. Now notice how Joe contradicted himself here. So Ron Klain pointed out specific provisions within Build Back Better, which are good, albeit still incremental, but good nonetheless. And then Joe Scarborough said, well, it'd be hard for Republicans to oppose these things. Wait, oppose the policies that the president supports that you claim are far left? So by your own standards, wouldn't the Republicans who go along with this because they just can't reject this, wouldn't they be far left? I mean, I just, I don't understand the criteria that he uses to gauge the ideologies of lawmakers. I don't know. There's no metric that he's using. He's just saying things, even if they are patently false. But because Joe Scarborough has DC brain rot, he can't even fathom the idea that something as incremental as a Medicare expansion or just marginal improvements, means tested policies wouldn't be too far left. Anything that's just not right is too far left to Joe Scarborough. But I've got news for him. Even something that he would deem far left like Medicare for All, that's not actually, functionally, a far left policy. I would actually argue that Medicare for All is the compromise because we're not doing away with private hospitals. We're just basically having the government be the single pair. But the reason why even something like Medicare for All isn't far left is because every other developed country has their own version of some sort of a universal healthcare system. So would Joe Scarborough maintain that the conservative party in Canada and the Tories in the UK are too far left because they at least rhetorically support their versions of universal healthcare? Would he say that? He'd look like a fool if he did say that. But he wouldn't say that. It's because the Overton window in the United States is so far to the right that anything that isn't right wing just looks far left. See, the actual problem is not that people in America are too far left. It's that we're so far to the right that common sense policies like Medicare for All that save lives are viewed as extreme. And when we have Republican voters storming the capital and elected GOP officials antagonizing toward a civil war and state GOP officials passing policies that give them the power to subvert the will of voters, you're detached from reality if your concern is the far left in this country. Your concern should be the far right in this country. But because Joe Scarborough has a broken brain, he thinks that it's the far left that's the issue. No more on it's the far right that's the issue. I mean, to even for a second be concerned with the far left or that our neoliberal conservative president is too far left. It just goes to show you how skewed to the right American politics is. Now, to be clear, I do believe that it's changing. I think that the rise of progressives like Bernie Sanders and the squad that is changing things. It's making a difference, right?   I'm sorry, but it's just it's that bad.  Do better for fuck's sake.


Yeah, welcome to Think Tech. I'm Jay Fidel. This is Community Matters. We're going to talk about children today, our children who are abducted and missing. And this is a particularly poignant subject given the fact that Russia has kidnapped, abducted thousands of children from Ukraine, which have not been returned, which are being retrained and reprogrammed in Russia. And of course, because of the hostages in Israel, in Hamas, Gaza, which have been abducted, and which are still being held hostage, including very small children. It's so painful for their parents and such a tragedy. And the tragedy is not yet over. These tragedies don't go away quickly. So we have two people on the show, Sharon Young, who experienced an abduction back what, 30-some-odd years ago. It's just very interesting to hear about, as the mother of how many children, two or three children? Three. Three. And Amanda Leonard, who is with the Missing Child Center here in Hawaii, which is connected with the Attorney General's Office. But as she mentioned before the show, she doesn't practice as a Deputy Attorney General. She practices with the Missing Children Center to find missing children. You know, and actually it's enviable to think of the good work that you do in bringing children back to their parents. Anyway, so let's start. Welcome to the show, Sharon. Welcome, Amanda. Thank you. Thank you, Jay, for having us. Start with you, Sharon. Talk about your experience in 1990 or so with your three children. How did that work? August 1st, 1991, my ex-husband came to our home, and while I was at work, he abducted our three children. They didn't really know what was going to happen to them, but he enticed them with gifts and got them. He said, oh, we're going on a secret adventure.  He was a very abusive man. And my son was able to escape about three years after he was abducted. How old were they when they were abducted? 13, 11, and 9.  He was the one who was 13 at the time? No, he was the middle one. He was 11. And when he came back to Hawaii, he turned 14 a couple months later, but he was 13 years old when he escaped. And the other two? They're now in the United States. Both of them are on the East Coast. I continue to try to reach out to them and see if I can connect, but I can't always find them. And a couple years ago, my oldest daughter reached out to me out of the blue and said, oh, I want to do a counseling session, has to be on this particular day at this time. And I was not going to be in Hawaii. I was going to be off island. And I asked if we could change it to a couple of days before or later. I never heard from her again. These kids are now at least in their 40s. 40s. Yeah. They're emancipated. 40, wow, wow, wow. 46, 43, and one will be 42 December 31st. So they've been brainwashed.  Their father told him I was a practicing witch and I could cast spells on him.  This is psychological abuse or physical abuse? Physical and psychological. So what about your husband? Did he have to account for this? The only way I was able to get him to account for it was to take him back to court. The state of Hawaii dismissed the felony warrants against him after about 10 years. They didn't believe he'd leave Mexico, but he was just waiting for them to get rid of the felony warrants. And then he immediately came back into the United States. He hates Mexico, actually. And so anyway, I was searching for my youngest daughter. I found out she was living with her father. I called the missing child center and they said they couldn't find any felony warrants. So the only thing I had left was the back child support, which he never paid. He told me if I ever left him, he would never pay any child support. And on top of that, he would abduct the kids and take them into Mexico. And I'd never see them again. So I was, I stayed with him much longer than I should have because I knew what kind of person he was. And I didn't take his threats lightly. Sounds like our relationships, your relationships, each one of these kids has been adversely affected by what your husband did. Am I right? Oh, yeah. And that's why even 30, 25 plus years after the abduction, I took him back to court. In Virginia, I moved the case from Hawaii to Virginia because Hawaii's child support enforcement agency is actually pretty horrible. And the Virginia child support enforcement agency is much better. And I beat him in court in 2013. So finally, after 20, 30 years, he's finally paying back child support. And I'm using that to pay down my son's student loans. If my ex-husband lives long enough to pay off the debt, then I'll be able to help my younger daughter who I know has substantial student loans. But I don't know if that'll happen. Yeah, 30 years. It seems to me this has, in many ways, defined your life. It has. I mean, good things obviously have come out of this, the missing child center. And I was, I would call myself crazy with anger, but that anger I knew had to be channeled into something positive. And the outcome of that was the missing child center, Hawaii. Can you talk about your efforts, the reasons and your efforts to found it? Well, my efforts were because I was so angry. We had nothing in Hawaii to recover children. The police department was, I mean, they should have gotten the FBI involved shortly afterwards because they knew that he had taken them out of the state, but they didn't follow protocol. One of the police officers told me, this is what should have been done, but they didn't do it. And I knew he was going to take them into Mexico. So we weren't able to stop them.  And they called me and the police didn't want to do anything. They said, Oh, this is a domestic. I said, it's not we're divorced. This is what's in the divorce decree. You know, I need you people to get involved to help. Um, I ended up having to call my client Douglas Gibb, who ex chief of police who was retired at the time, and he actually got the police to help me. I mean, I've had all these possibilities of stopping my ex, but, you know, the system within the police department was just not well suited to recovery of children. So that's why I did this. I met a woman, Pam Ferguson Bray, an attorney, and we worked together to lobby their legislature and, you know, do studies on what the missing child centers were effective. And January 1, 1995, the missing child center Hawaii was came into being. And since then, it actually, they actually found my two daughters. I mean, at the time I had spent so much money on legal fees, I just didn't have any more money. And I stopped hiring. I stopped paying all these attorneys in Mexico. I had a civil and criminal attorney there. You get nowhere. And I lived in Mexico with my ex husband earlier. And, you know, the way to do things is to pay people off, but I didn't know who to pay off. And plus I didn't have, I wasn't rolling in dough. So basically the missing child center found my kids. You mentioned Douglas Gibbs was your client. What kind of business are you in? I'm a financial advisor and I know my company doesn't want me to give. Okay, that's fine. I just wanted to know in general. So Amanda, you know, you got involved with the missing child center, when and why? Hi, Jay. Thank you so much for having me on. Thank you. Thank you. First, I want to commend Sharon for her courage to come forward and share her experience as a survivor of an international parental adoption so that other parents and children won't have to suffer like she and her kids did. I came on board as the coordinator of the missing child center, known as MCCH in 2018. Prior to that, I was a family law attorney in private practice for about six years. And so thanks to Sharon, there was an office that I could work for and serve families and children without having to charge them anything for our services. And it's just been an incredible honor and privilege to do so. So are you the only one working with the missing child center or you have a staff of 200? Well, you have the right number two. Our staff is two people, no zero zero after it. We are a staff of two people, myself and the assistant coordinator. And we actually cover the entire state of Hawaii. And we serve as the state's official missing children clearinghouse. And I am also the Miley Amber Alert coordinator for the state. And as you mentioned, we are the state department of the attorney general. So we talked before the show about, you know, the demographics on this sort of thing. And I get the idea that most of the cases where children are missing and come to your attention are, I hate to use this term, because Sharon was trying to avoid using this term when she was talking to the authorities. But they're domestic cases. They're one parent steals the children away from the other. Am I right about that? Most of the cases are domestic type abductions, right? Well, most of the cases at our office are endangered renaways because that is one of the categories of missing children that we respond to. But when you're talking about abductions or kidnappings, it will mostly be a parental abduction. Stranger abductions are extremely rare in Hawaii and also rare nationally. So I mentioned Miley Amber Alert, that is a tool that we use for the stranger abductions. They can also be used for dangerous parental abductions. And so when we are responding to abductions here at Missing Child Center, most of the times are going to be parental or family abductions.  Sometimes they will leave the state and sometimes they will leave the country. But I would imagine most of them really don't leave. They stay around and try to hide maybe on a neighbor island or something. Sharon is shaking her head. Maybe not. Where do they go? What's the, what are the numbers on that? Well, it's definitely difficult to hide a child on one of our islands because the good thing about living in Hawaii is it's so small. We have county police on each island. We also have federal law enforcement partners. Usually if the child is being concealed in state, we are able to find that child pretty quickly. It becomes a whole other matter when the child leaves the state or the country. We do see a lot of, you know, out of state abductions and international abductions. And that also is because where we're situated globally, it is actually pretty easy to get out of the state and go to another country, whether it's, you know, Mexico, whether it's Asia, whether it's Europe. I handle all of those cases. And don't forget the Middle East. From a cultural point of view, I am personally familiar with parents, mostly men, who have abducted their children back into the Middle East. Anyway, so, you know, what's the, how do these cases reported to you? Do they come directly? Do they come from the police? Do they, you know, they come from family? How do you, how do you open a file, so to speak? Excellent question Jay. So usually the parents will report the incident to the county or local police department and they will get assigned an investigator and that investigator will either refer the parent directly to us or they'll call us and ask for assistance. So our primary obligation under the state law is to assist the law enforcement agencies to locate the children and the police departments are well aware of that. That is our responsibility to provide that assistance. So it'll either be the police department or the parents will reach out to us directly to assist. I'll open up a case and then we will also refer them to the National Center for Missing and Exploited Children for additional resources from case assistance to family support services. They provide all of that to families of missing children for free. Yeah, you and your number two are quote, coordinators, but you know, the scenario that Sharon was talking about involved another country far away. It's a federal jurisdiction thing, of course, if that's the case. And I wonder if you are getting the cooperation you want from federal agencies who would have jurisdiction in destinations like East Coast or other countries. Yes, we have excellent partnerships with our law enforcement agencies in the state as well as on the mainland. So the Justice Department connects all of the clearinghouse managers together. So if there is an incident where a child is taken, let's say to Idaho, I'm able to pull up the information very quickly of who is my counterpart in that state and then make immediate contact and request assistance from that state. So our federal partners have made that very, very wrong in terms of how to leverage our resources. We have a lot of agencies here in Hawaii on the federal side that help us, the FBI, Homeland Security, the U.S. Marshals, the U.S. Secret Service. And then of course we have our state partners travel for services, the judiciary. As the clearinghouse, it's my responsibility to coordinate all of these different agencies so that we are leveraging all resources possible to get that child recovered. And time is of the essence. And that's why everything needs to be done as quickly as possible. Why is time of the essence, Amanda? Time is of the essence because the parent may relocate to another state with the children, but they could also go to another state or another country. They can be on the move. If they are really motivated to conceal the whereabouts of these children or child, they will be on the move. And we see these parents going through multiple states back and forth, which makes it extremely hard for us to track them. Luckily, the information on the missing child is in the national database called NCIC. So they should be flagged at the airports. They should be able to be identified by different state law enforcement agencies. And it is absolutely critical that we prevent that child from being taken into more different states or out of the country. Once they're out of the country, it becomes extremely difficult to get them back as Sharon has personally experienced. Well, here's an awful question for you. What's your rate of recovery? Are there children that are off the grid completely? Are there children who may not have survived? So most missing children are recovered safely. And that's a great thing. That's here locally and of course across the country. But there are incidents where the children have not been located. The National Center for Missing and Exploited Children has posters of some of our local kids who were abducted in a parental abduction who have not been found and that their parent is still waiting for answers. And the thing about missing child center and NICMIC is we will never close a case until that child's found. It doesn't matter if that child turns 18 or not, that case will not be closed until that child is found. Whether it's 20, 30, 40, 50 years later, we will keep it open. Because if there's even one percent chance that we can get that child located and reunited, we will do everything in our power to make that happen. So do you prosecute? I don't personally prosecute. As you mentioned, I'm an attorney, but I'm not a practicing attorney. But these cases can be prosecuted. In Hawaii, the crime is called a custodial interference. And if the child is taken out of the state or out of the country, it could be a felony crime. So on the one hand, on the civil side, there's the family court and that parent is going to be attempting to enforce their custodial rights in family court. On the criminal side, there could be a police investigation of custodial interference where charges could be brought and the prosecutors could pursue and bring justice upon that perpetrator. So there's two things going on. It's a very, very difficult legal process. It's an extremely difficult, painful, emotional process. These are the most intricate, complex, difficult cases that you could possibly imagine. And I, as an attorney, I used to have cases where the kids, my client's children were abducted. So I know how difficult it is. But the main thing is that the parents are acting quickly, that they are doing everything that they can to start that process. Filing the police report, registering court orders in the state that they believe the children may be. There's many different things that they should be doing. But it's absolutely imperative that they seek out those resources so that we can respond quicker. You know, if you do have any prosecutions of people who steal away children, I appreciate you calling me up because I would like to volunteer to be on the jury. I have a few. I appreciate your passion, Jay. It's an absolutely horrible thing to happen to a parent. And that is why Sharon coming forward to share her experience is so commendable. And we just want to make sure that we're putting that information out there because a lot of the times it can be preventable. Some of the times it can't be. By therapy, by intervention, how do you prevent this? Well, it's definitely important for parents to look at the risk factors. So, you know, Sharon mentioned earlier that her ex-husband threatened to abduct the children. That is a huge red flag. Now, most people wouldn't think that someone's capable of carrying out that threat mostly because it's a crime.  But definitely be aware of the threats. If there's a history of domestic violence, child abuse, you know, fighting over the child, that parent has a criminal record or ties to another state or country, you know, be mindful, do what you can. The State Department does have a program to flag passports. And that's definitely something that if you've been threatened with this, that you may want to look up. Who do they call? So the U.S. Department of State has an Office of Children issues. And these are the folks that come into play if there is an attempted or a successful international parental abduction. They do have a program where you can request that a child's passport be flagged or try to prevent that child from getting a passport. It's a lot harder now because I guess the good thing about the Patriot Act and because so much is required in order to get a passport to begin with, that if you have an agency, the passport agency that will not issue a passport or will flag it so that if someone's using the passport to leave the country, they can stop them there. So that is a good thing because once a child is taken out of the country, then you're dealing with international laws. They may not be helpful. There's something called the Hague Convention. It's a reciprocal agreement between countries. But even if they've signed on to the Hague, it doesn't mean it's going to be easy to get the child back. Sharon, I want to ask you a question about the defenses. The justification or arguable justifications that people have in wrongfully removing children. I mean, for example, if it's a shared custody and this guy, this hypothetical spouse, takes off with the children and says, I'm just exercising my shared custody rights. Is that the same thing as kidnapping a child? Well, to be honest with you, the most frequent time children are abducted, parental abductions, are during summer and Christmas vacation. And that's why we wanted to talk about this prior to Christmas because there are things that parents can do if they suspect they're having a difficulty with their spouse. And the spouse may or the parent, they may not even be married, may want to take the child out of the country or out of the state. If they're in Hawaii, I would say call Amanda, call the Missing Child Center. And they can give a number of things that the parents can do to thwart that. There's no good reason for doing this. I mean, to be honest with you, the National Center for Missing and Exploited Children states that in most cases, if it's a parental abduction, it's an attempt to punish the other parents. In cases, parents will murder children to punish the other parent. They will torture their children. My son was tortured. They will beat, they will do all sorts of horrible things to the children because they know that's the most effective way to punish the parent, the other parent. And they're not doing it for the benefit of the children. No, but a third party may be listening through this spouse who takes the children away. And maybe the spouse has a shared custody arrangement. Maybe they're not married and there's no law, no document governing exactly who has custody. He just takes them away. Now, is that something where the Missing Child Center can do something? You're assuming that if he takes them away, it's not okay. But it could be okay, right? He could argue that it's okay. Well, that's where if a parent believes that their child may be subject to a parental abduction by contacting somebody, Amanda or Calais, they can start the process. That parent is going to have to get an attorney and it's going to have to start some sort of legal action to make it so that they can't just take the child anytime they want willy-nilly. Even if they're not married, they may have some type of shared custody, but there are rules within that. And I would say if they believe that their child may be abducted, start the process of reaching out to somebody like Amanda to help guide them on what they can do to protect their child. Because if they are abducted, then it becomes much more difficult. A footnote on that, Amanda. What is your website address so that people can find you? Well, it's a very, very long website. So I'm just going to say Google Missing Child Center, Hawaii, because it's a very long Attorney General type state. But our phone number is<PHONE_NUMBER>. In writing my book, one of the things that I did in the appendix is to give resources where people could find help if they think something like this might happen to them.  Because if a child is abducted, the National Center for Missing and Exploited Children can age-enhanced pictures of the child. What's helpful, they want pictures of both parents at different ages to help them age-enhanced pictures of the children. So I have a number of different things that people can do if they think something like this may happen to their children to better protect them. But it's good to be proactive with, you know, that's really important to be proactive. Let's talk about your book. You wrote a book, Sharon. Can you talk about the book? Yes, it took me 15 years. And I know this is like 32 years after my children were abducted. But you know, in my attempt, the first thing that I would say was my attempt to reach out to my daughters because I know they've been brainwashed. And since I don't have the facility to speak with them or communicate with them, how can I undo any of that? I can't. And so I decided, well, you know, if I can't, you know, reconnect with my daughters, then maybe what I can do is find a way to give other people caught in this ugly dilemma and give them ideas on how they can protect themselves and their children. And so it took a long time because I did write the book by myself. I had to take all these writing classes. You were really determined. Yes, I was very determined. And like I said, I took my S when I found he came back and designed United States. I included that too. And I learned lots of legal things that parents can do that I wasn't even aware of until, you know, we went back to court to get him to pay back child support. And so it's so complicated. And all these different states are literally competing with each other, you know, for child support. I mean, that's something I was not aware of. They all want to collect from the same individual. Interesting. Well, because they're given benefits. That was one of the things Texas told me I should close the case in Hawaii. I was at the point of starting to get money from my ex. And they wanted me to close the case in Hawaii. I needed to get copies of our divorce decrees in order to initiate the payment. And they said, oh, you should close it. And then move it to Texas. And I said, and then they said, oh, I'd have to pay to come and go to Texas for any kind of filings. And I'm like, I said, does Texas make more money if they can say that they recovered the money from my ex? And they said, oh, yeah, the federal government gives us more money. And so I'm like, oh, okay. Leave it to Texas. Actually, Texas has a pretty good system, which Amanda told me that they have actually more protections in Texas than most states. But, you know, I wasn't going to wait another five years. And then if he moved, that's the other thing. It's like, I'd have to find where he's moving to. And I, you know, it's not simple. And justice is the name of your book. Where can I find your book? Well, actually, it won't be available until the end of November. And you can go to www.bookswiths.hawaii.net. It's through Legacy Watermark Publishing here in Hawaii. I got so tired of having to edit, edit, edit with these different literary agents, I said, don't forget it. I'm just going to self publish it because otherwise I'll be doing this for the next 15 years. And I don't want to do that.  She's kind of, she's been around the block on this. She's written a book on it. She's had personal difficult experience on it. Is Sharon somebody you talk to? Does she talk to you? Is she close to your organization? Sharon is one of the first people, when I started in 2018, that fully embraced me coming into the position, one of the first people I met, and to learn that she, one, is a survivor parent. And two, is the person who pushed for the establishment of Missing Child Center so that Hawaii can have a clearinghouse to serve these families is incredible. I have the utmost respect for Sharon. She and I are always been in contact over the past five years. Sometimes we'll get coffee. We'll talk about, you know, just in general, you know, what we think is needed to improve our system response for missing and abducted children. I consult with her. And having that survivor perspective is absolutely crucial to me in my work. And so I've just been so grateful to have her mentorship, her friendship, her partnership. And actually, if I can make any profit from this book, I'm trying to figure out a way to get it to the Missing Child Center. But the difficulty I have is there with the Attorney General's Office, though it's a state agency. And I'm currently looking for a small nonprofit that might be willing to work in conjunction with us to help support the endeavors of the Missing Child Center. But it has to be done in such a way where, you know, they would know that I might be able to give them would be used to support your determination will prevail. And I would say we all owe you a debt of gratitude, Sharon, for having taken a tragedy and making it into public service. It's really commendable what you've done. Well, that saved me because otherwise I'd be a very bitter messed up human being. I don't think you are that today. And Amanda, thank you for your service. It's very important that you do what you do. And somehow I believe that not only do you recover children who have been abducted, but in doing so, in maintaining this effort, you reduce the number of children who are abducted in the first place. So thank you. Thank you for raising awareness of this issue, which nobody talks about this. Nobody wants to talk about divorce or parental abductions. But we can help so many people by making sure that they know that you can do something. There are resources available. We are here to help you. Okay. And I really feel that it is a very painful experience to have a child abducted and Lord knows what happens to that child away from the family. It's an attack on the family is what it is, not only the spouse. So what you're doing is really the really difficult situation is that child. Because even though my son has done very well for himself, we spent years in counseling. It's very difficult when a child comes back. It's very hard. I'm sure it is. I'm sure it is. Thank you, Sharon Young. Thank you, Amanda. Keep up the good work and make our community secure. Thank you so much.


O título de este talk é o aspecto da neurodífica inútil, as xinurraciones das xoas arqueológicas e genéticas, e é dedicada ao memoria de Luca Cavalli's Forza. As xinurraciones da neurodífica inútil, o modelo de difusión de danza significa que é o aspecto da xinurración, então os mecanismos da xinurración do aspecto da neurodífica são as xinurras da xinurras e da xinurra. Contra o modelo de difusión cultural eu sinto que o modelo era un xinurro da ideias para que não exista xinurros da população de xinurro, mas o mécanismo da xinurro no modelo é a transmisión dos planos animas e xinurros dos xinurros da xinurro. E o modelo de difusión cultural que é mais genélido, então esses dos modelos são xinurros da xinurro, então nós vamos descansar sobre este tipo de nóvels. Em xinurro, xinurro de difusión cultural nós ensinarámos a estimar que os luces ráquios da neurodíficasen o xinurro da xinurro da phantasm dos 2.0 grs Sino que é o reláxio do análisis que temo a xinurro da xinurro e que a xinurro da xinurro da xinurro da xinurro da xinurro da xinurro da xinurro ou mais precisamente no 1.9 grs ou 2.3 grs. e nós vamos usar que no próximo slide. Então o aspecto de anuísica, apresenta a regresión de distancias e gaitas, foi entre 0,9 e 1,3 km per ano. Nós mostramos este rango como o grubo de tango no slide, então aqui nós temos entre 0,9 e 1,3 km per ano. O excesso rectificado é o tempo do anuísico. E nós mostramos duas líneas que é o rango do anuísico do anuísico como funcione da intensidade de transmisión ocultora. Este parámetro C é o número de anuísicos que convertexam para cada anuísica e generación. Então, por exemplo, se o C é 10, significa que 10 anuísicos convertexam para o anuísico que é either via interfrídeo ou via culturación, paríspaira e farmar e generación. Então nós vemos que a intensidade aumenta, aumenta o valor de C, que é o que nós superemos, porque se a C é maior, o rango do anuísico convertexam para farmar, o que é o número de farmar, o que é o aspecto do anuísico. E estas duas líneas corresponde o máximo e o mínimo de producción de valores, nós fippamos unión, quí site a que as líneas se reivendam e que os anuísicos se salven e que a robots nos facen para que os anuísicos se formem mais importantes para o anuísico, o que é o número de farmar e o anuísico. É xe only the cultural effect defined as the speed minus the denic speed which is the speed for C core 0. This is the denic speed because if c is 0 then zero hunter-ladders are converted into pharnas that there is no reportable measure so the model is purely da denic. So the speed minus the denic speed is the cultural effect relative to the total speed in percentage and from the figures we can plot these parts and we see that Since in this slide, we see that the observed range, which is between 1.9 and 1.3 km per year, is this one. This spread rate are too fast, so this region is inconsistent with archaeology because the model is too fast to reuse the data. So she is residency, so residency hunter-radar were converted by generation. So here we have to disregard this region, we can only consider the region where she is less than 3, and for this region, the cultural effect is less than 48%, so it is less than 50%. So the importance of cultural transmission or cultural diffusion was should be smaller than the importance of the human diffusion. So archaeology implies that the analysis expected in Europe was mainly in the human, according to this model. Later, we will see what genetics implied, and we will see that it adds a lot of information to this very same product. But if we are doing so, we can, since in this session, a topic that is considered is the spread and the presence of new decision, we can consider this interpolation map of the dates of many sites. We see that, as it is well known, that with neolithic time, from the southeast, it's around the Alps, later it climbed the mountains and went to the north, more slowly, because here the isochrons are closer together, and as well it's in the Alps that you need the other regions. In the Mediterranean, it was much faster. Here we can estimate the spread rate in different regions, and as expected, we should have in the Alps and in Europe, it was slower than 0.7 km per year. And in the regions, it was faster. For example, in the West Mediterranean, here we show as diamonds the earliest sites in each region. If the diamond is white, it means that the front arrives in time. If it's black, it means that the front arrives to Earth. For inland travel, without sea travel, it's to Earth. So the model that not agree with the data. The model that agree with the data requires that the jumps per generation, along the coast, are at least of 350 km. So, in this case, the spread was much faster, and about 8.7 km per year, very much faster than the average of 1 km per year. And it's due to it, we think, to these long jumps. Then, finally, we turn to ancient genetics. We have gathered at a race of 16 individuals, a total of 513, whose mitochondria DNA has been determined. We analyzed several cases, because its frequency, which is from here in red, decreases westwards and northwards in five minutes. And it is absent in hunter value. This is what we should expect if there is a different diffusion and some degree of cultural diffusion. Why? Because, for some time, for any given time, the places located farther away from the origin of the expansion still have more hunter values, so the cultural transmission is stronger, and then in the thick marker we decrease faster. This is what is called the genetic plane. This is the same as the previous slide, but here we presented it in a different way. This is the percentage of the neomythic marker, of apple root pain. So, for example, in series, 43% of every neomythic farmers has the neomythic genetic marker, has apple root pain. It decreases to the west and to the north, to Anatolia, Hungary to Asia, Germany, North Eastern Spain, These squares are the earliest, the oldest neomythic data, and this line is a regression, which is nothing but the genetic line. So, the frequency of the neomythic marker decreases as the neomythic wave expands. We also see that for the triangles, which are more recent genetic data, the values are generally slower, so the frequency decreases in time. This is also what we should expect it to be, because in this model we are only assuming that farmers can interpret with or can cooperate hunter-gatherers in their communities. So, since hunter-gatherers do not have neomythic marker, because no hunter-gatherer has been found in Europe with apple root pain, then, as hunter-gatherers are incompleted, the frequency of the neomythic marker of apple root pain should decrease. And this is what we see. So, we found some simulations in order to try to explain this quantity. Simulations begin with some farmers only at this site. Rassamla, which is the oldest PPMD site in Syria, in this database at the rate reported there. We set the initial percentage of apple root pain at the cell in the rate, in the simulation rate, which is a rectangular rate of square cells. At the cell containing this site is the initial site, the origin of the expansion. By trial and error, so that the simulation gives the search percentage at the average location and date of the early farmers in Syria, whose mental condition of DNA is known. So, these are the initial conditions. The right place and the right initial percentage of the genetic marker. All of the grape cells, of course, are the initial yield of the farmers and with hunter-gatherers of the acceleration density. Then, it's known of the rate described as in non-coast-mountain and coaxing. At each node or cell in the grid, at a time spare, the step of one generation, we compute three processes. In other words, in the dispersal of farmers between young bocells with a site of 60 kilometers and probability of 62% of values being obtained from less than a perfect date. And also, she travels farmers up to 100 kilometers so that the arrival times are given with the biological data on average for the east and west Mediterranean. A monoglaborate model could consider, for example, a number of distances in the west of the 150 kilometers we have seen before. But this study was non-simultaneously to the views one. And I don't think it would change the results. It should be the conclusion of this. Then, there are two steps. Each generation, for all nodes or cells in the grid, are cultural transmission and representation of the relation. Cultural transmission is done as follows. Since we have to compute the percentage of the neolithic marker of the apple group K, which, because we want to compare it to the data, we have to distinguish the farmers who have apple group K, pn, and the farmers who do not have apple group K, px. Because the percentage of farmers who have apple group K is the number that's happy, by the total number of farmers who have it plus those who don't have it. And we also compute the number of hunter-gatherers. We state once again that no hunter-gatherer has apple group K, because many hunter-gatherers have been analyzed, and in Europe there has never been found any hunter-gatherer who has apple group K. This is why we are analyzing this marker. If we analyze the number of markers we have to know how many hunter-gatherers have it and their number. So we apply cultural transmission theory to compute the couples. Then it's couples between hunters, eggs, and farmers, either with apple group K, with the neolithic marker, and or without it, x. This is, by this equation, x is the cultural distribution intensity, it's the same parameter as the previously in the archaeological analysis, the cultural transmission intensity, the number of hunters that become farmers per your pioneer and farmer generation. And we also compute the couples of farmers here. Cultural transmission doesn't play in the rules, so she does not appear in the rules. Cultural transmission takes place between hunters and farmers, so between hunters and farmers and orings, but not between farmers and farmers. So here that is not a new bias in the choice of mates. This should be an example. And finally, the production. We apply the production scope of farmers to our zero children, where our zero children have a production rate per farmer. And for 50% of mates, mates we do hunter and farmer, children, that means 50% of mates, because the mother is a hunter-gader because the mate token geogineis transmitters from mother to son. And this is a simple model. In another model of the mother, we show that all mothers are hunter-gaders, which are more in agreement with the number of data, but the results were almost the same. So here we have the results. These are the same numbers of the data as before, and the lines have been obtained from the simulations. If she is equal zero to zero, there is no cultural transmission. There is no hunting hunter-gader who becomes a farmer, so the upload group carry the music marker can not change, so it's constant. The stronger the cultural transmission, the higher the value of she, then the more important the degrees, due to the incorporation of the relative people of the music marker in the population. And we see that she is very small. The archaeological data we have seen before that she must be less than three, but here we find that it is about all point of all two and not very different from these. So genetics should be combined with archaeology, it is possible because you can get more out of additional information. And here there is a minimum, I don't have time to explain it, but it's due to the two words, the England word and the Italian word, and the yellow regions are those in the previous slide, so here are the minimum. And it's easy to understand why one word has a steeper flow and this yields the minimum, it's simply because the distance between jumps is longer for the she word. I don't have time to explain this in detail, but the important point is that if we looked up just from the archaeology, we had that there is a region consisting of archaeology, she must be less than three, but genetics impones a much narrower region, she about 0.02, so only 2% of farmers were involved in cultural diffusion, so 98% of farmers did not play any role either in vertical or horizontal cultural diffusion, which is this conclusion has not been obtained before, but it's in agreement with genome-wide data that shows that the spread was overwhelmingly dimic. But genome-wide data cannot be used to estimate the number of farmers for reasons that they cannot explain, because they don't have time. So under cultural effect was only about 2%. So this concludes my talk. Thank you for your attention.