Hi, everyone. Thank you so much for taking the time to view the full version of the talk about our research paper, Encapsulated Search Index, Public Key Sublinear Distributed and Delegatable. This is joint work with folks that are at the comma, David Casual University of Chicago, and my advisor, if you can notice, and my name is Harish. And I will be giving this talk. So before we look at Encapsulated Search Index, we can first take a pause and look at actually searchable encryption. Searchable encryption, the motivation. Why is it so popular? Why has it grown increasingly relevant? The simple reason is remote storage has become ubiquitous, cheap, and convenient. Everyone wants to store things on the cloud. For example, this very presentation is at least stored on two cloud platforms. But the flip side is that do we ever trust the server that we store this data on? And if you ask a bunch of cryptographers, the answer is always no, because we have severe trust issues. And we typically solve by throwing encryption at it. And this is an elegant solution. But apparently our tools are a little too perfect, because the flip side is that it does really do a good job of hiding all information about the data. And consequently, what needs to happen for us to do some operations on the data is for us to locally download and then perform the operations. So searchable encryption was devised as a paradigm or a primitive where we can actually do something cleverer where we will ask the server to help us perform this operation while being completely mindful of the fact that the server is entrusted. And here, all operations we talk about is search, and the concept is therefore searchable encryption or private searching. So what is the setting? We basically throw some additional encrypted structures, which we call as index, and denoted by the letter E. So because there's encryption, you can think that there is some kind of a secrecy that is involved. Now there is the role of an index creator, who is actually the person who creates the index. Search approval is someone who can control the search process, who typically controls the secrecy and therefore can provide information to selectively decrypt the index. And finally, the storage owner who is typically modeled as someone who is untrustworthy controls the storage location on which the data is stored. So if you want to look at the data flow, you have a document that an index data takes as input to produce an index E. This is an encrypted index E. Now if I wanted to search for a keyword W, it will take some secret information, the search approval, to produce a token ZW. And ZW on the index is combined, we use as an input for the storage location to actually produce the matches. And here the security that we require is something known as index privacy or token privacy, where even if I have the index in my hand and a bunch of keywords, sorry, tokens for a bunch of keywords, I have no information about how a token for a keyword W prime looks like if I have never seen it before. And that is the goal that we want is for privacy of indices that have not been queried yet, or keywords that have not been queried yet. And in this setting, we ask the question, can we achieve sublinear search time and public key indexing? The former is very attractive for a simple reason that a lot of the data structure that are out there can support search operations in sublinear time, a bloom filter can do it in expected constant time whereas balance search trees will do worst case long in the size of the tree or the number of entries stored in the data structure. And public key indexing will have the feature of supporting multiple index creators. So there is no bottleneck where I'm reliant on explicitly one single person to do the job. So specifically we look at this construct are these two features of our searchable encryption primitive in this particular setting where most documents actually do not change, that is immutable. So what does it mean is that once it's created, it's there and this gives us the powerful tool of ensuring that our index be not be created incrementally. So I have it, I can be done with it by creating an index. And consequently what it also means is that I can have document specific tokens. What do I mean by that? It means that I have tokens for keywords that is specific to this document. So we do not need the feature of universal indexing or what we at least call as universal indexing where one single token can be used for the same keyword across any number of documents. So we have the setting where the user has two devices a port and a desktop. The desktop is really powerful but insecure. So what I do is I use the desktop to actually handle sensitive documents and I index it separately and then I really remove the data because I can't leave it sitting. So as long as I have control over it I can trust that it's not corrupted. And then if I want to use the index to search on the index I need the phone to authorize the search and security goal as discussed before is index privacy. And we also want the feature of delegation that is we want to support multiple search of keywords. So we allow an encrypted index that's built for a particular document D using a paired secret key, a public key pair SK comma PK to be actually searched by another secret key public key pair SK prime PK prime but without I knowing D and without modifying E. So essentially I do not want this reinvest effort to create a new index E prime but I rather I would still use the same E but I would just delegate the search process alone. Now this is the setting. This is the story that we are telling. This is the motivating application for which encapsulated search index makes sense where we have immutable documents and we want to achieve sublinear search with support for public key indexing and delegation. So more specifically if you were to look at the process flow I have a mobile phone that generates public key secret key for itself and sends public key to the desktop. Now the desktop with access to the public key takes the document D as input and produces index E and handle C and deletes the data, the original document D. So it does not have the document D anymore in its possession, great. So what do we have there? We next want to search for the keyword W. So all the desktop needs to do is send the handle C and the keyword W. So what do I require security wise is that it's privacy preserving. So phone learns nothing beyond W from Caesar. No C, it knows W. There's no other information that's gained about the index E and this should hold information theoretically. Now having received this input the phone has the capability to use a secret key SK and the compact representation or the handle C and the word W to actually produce a document, sorry a token, ZW for the keyword W. And to be specific, it's also specific to the index E, C for this document. So this token is unique to this document or rather to this E, C value, okay. And then what I want is the desktop will now receive ZW as input and we require the desktop to be empowered with the feature of verifying if ZW is corrective form. So we do not want the desktop to produce the wrong output. The most the phone can do is produce a denial of service attack. And then we also want token privacy or key index privacy where I give you a document, I give you a document D and I produce a token ZW for the keyword W in this document D. Then I have no information about W prime. That's not, that's different from W but is present in the document D but also for the same W that occurs in any other document D. So in both these counts we critically require privacy. And finally, the feature that we desire is that the same public key security pair can be used for different documents. So E, C is essentially unique to a document D. So I can use it to compute E prime, C prime for a document D prime and so on and so forth. Now the most important feature is that there is communication that's happening between the desktop and the phone. And we require that this communication for the search procedure between the desktop and the phone should be constant. So critically note that I said only C and W which are constant in size and not the entire index E because E can be as large as the number of keywords in a document. Now these are the required properties and the required process flow but and the formal syntaxes as seen here and I have a general algorithm that will generate public key secret key and the index algorithm that will actually produce the encrypted index E and a compact representation or a handle C. So I just useful for us to split this index procedure as two sub algorithms. One is called the prep algorithm or the prepare algorithm which takes us into PK and produces S and C. Think of S as a trap door and C as the handle and build index will take this trap door and the original document D to produce E and here the E is the index for D and C is some compact representation which is the only thing that needs to be sent for the search approval to provide a token. Now a search process will take as input the secret key the E prime, C prime and the keyword W and produces a bit that's either zero or one indicating if W was actually present in document D prime for which E prime and C prime are the index and the compact representation. Again, for simplicity, we have taken a modular approach in defining algorithms where we have split the search procedure into three sub procedures. Now, this is not important but the important part here is that we achieve privacy preserving unconditionally and that is a feature of separating the index algorithm to two sub algorithms, the prepare and the build index and the C that is produced the compact handle that is produced is independent of the document D. So therefore, even if I give you the secret key D naught and D one, I will not be able to determine which of the two documents was indexed. And that is the key part here where we achieve privacy preserving unconditionally and holds information theoretically. Okay, this is all great. How do we go about instantiating or implementing this primitive? Now, there is a naive solution there which achieves both public key and sublinear search and this is the solution there whereas it does not offer all of the features but it's a very useful launchpad for the rest of the talk how we come up with better primitives that achieves all the features that we want. Specifically, that we have the phone and we have the desktop as before. The phone basically runs the CCA gen algorithm. So think of CCA, that is a CCA secure encryption algorithm it runs the gen algorithm for this and produces public key secret key, keeps secret key for itself and sends public key to the desktop. The desktop now runs the gen algorithm for a pseudorandom function. So it produces a pseudorandom function key K and now for each keyword in the document D it produces a token by running eval of this PRF on the key K and on this input W and then it creates a set or an array of all of these keywords, sorry, all of these tokens but all of these keywords and then I will just build an encrypted index by combining Y with some linear dictionary. So say I think of it as a bloom filter or a balance search stream which I insert values and then it runs the CCA encryption algorithm to actually encrypt the PRF key K and to produce a compact handle or representation C and it deletes key. So at the end and also deletes the document D the end the desktop is left with the encrypted index E and the handle C for the ciphertext C in this case and whenever it wants to search it will just send C and W as before. Now the phone with knowledge of the secret key can actually decrypt the ciphertext C to get recover the PRF key K and then simply run the PRF eval function to get ZW and send ZW to the desktop. Recall that we want the feature where verifiability was required where in we wanted to make sure that ZW could be verified that it was correctly formed. So all the news replaced PRF with a VRF and we're still golden. However, that does not have support for distribution and delegation which were two key properties that we wanted and for completely different reasons these properties are not offered by this naive scheme and we refer you to our full version of this paper sorry, the full version of the paper and also actually our conference sub proceedings to actually read about why this is true. However, we have a good framework on which we can build it. So it's almost seems like the procedure to follow when we are creating a construction of the CSIs as follows, right? We will index W by computing a pseudo random function on W. So and when we store the value in a sub-linked search dictionary because we have public key setting we almost need two different ways to compute this PRF value and we need a consistency check which means that we need some kind of a VRF, not a PRF. So we introduce this new primitive called encapsulated verifiable random function and this primitive has support for delegation and distribution and that's the key point here whereas the naive scheme does not have these two support. So what is the syntax of the other? Think Alice, think Bob. Alice has public key secret key generated communicates public key to Bob. Now Bob has the power to run this encapsulation algorithm simply which is a randomized algorithm which takes us in but public key pk and produces a trapdoor t and a ciphertext c. So now it communicates the ciphertext c to Alice and keeps trapdoor for itself. So now Alice wants to compute the EBRF value on an input x. So what does it do? It takes a ciphertext c, takes the input x and uses a secret key to produce this value y. y is EBRF of x. Concurrently what Bob can do is Bob has this algorithm called comp which will take input x and the trapdoor t to produce the same exact value. So essentially we have produced a map for Alice and Bob to generate the same value y which is EBRF of x using two completely different ways. And there's just the communication of just the c. Okay. So what is the security requirement? Think challenger, think adversary, challenger runs this typical gen algorithm but in addition it also runs the end cap algorithm which is the encapsulation procedure to produce a ciphertext c and the trapdoor t. It communicates pk and c to the adversary and keeps b, sk and t for itself. Now the adversary has access to this eval oracle where it can make queries on inputs c prime comma x and it receives as response the eval on c prime and x.  Now the challenger does the standard in distinguishability game by computing y not by using the secret k sk and the trapdoor eval just the actually the secret k sk sufficient. Sorry, actually doesn't even my back. I trans this y not and y one, it computes these two values and then communicates y underscore b to the adversary. Brilliant. And the adversary responds with b prime and wins if b prime is equal to b. Okay, this is a simple setting and to prevent meaning to prevent trivial attacks we require that c and x star was never queried by the adversary. And now let us look at the construction where we have Alice, we have Bob Alice basically picks random element a and computes g to the a as the public key. Bob on the other hand runs this end cap procedure and communicates the ciphertext as in here and then it keeps the trapdoor for itself. Now Alice can compute y in this manner basically takes input e f h comma h of c comma x raised to the a comma c because it knows the value and correspondingly it does the Bob can do it by using the trap door which where it has the powerful element s which is nothing but a to the r or g to the a r. So essentially a to the a r will come as exponent outside and the same values hash because c is equal to r. This is a simple construction. We can prove that this is secure under the b d d h assumption in the random model model. Okay. So now all we have seen is we have made a case that e v r f is a primitive it's a useful primitive and we have shown that it's a construction possible. Now let's see how to build this ESI in a generic fashion. So the key gen algorithm is nearly running the e v r f key gen algorithm. And then the index procedure runs the end cap to actually compute c comma p and the indexing the remaining indexing procedure is very similar to the naive solution except that instead of running p r f dot eval it will run e v r f dot com and then runs the data structure build algorithm to produce an index key and then returns e and c. Now the search procedure will simply do the same thing as what we saw before instead of running e v r f dot eval by first decrypting and then running the eval it will just run eval on sk and c and then run the d s dot find algorithm. Now the beautiful part here is that we our composition result here will inherit the properties of distribution and delegation from the e v r f and formally prove it in the paper. So what do we get out of all of this? We get threshold ESI which achieves distributed token generation in a non-interactive manner. So we take our standard e v r f and throw verifiable secret sharing and some e's secret sharing and the scheme is secured under the b d d h assumption. Now the more important feature that we want to consider delegated where I can take a search approval one can delegate the search process to a search approval two without having to recreate the index. So we have this delegate algorithm that takes us input c one sk one and produces sk two and c two. Sorry, also a secret key of the intended recipient sk two and to produce a handle or a representation c two. So this is not recreating the index but simply modifying the ciphertext or the handle alone. And the verification procedure will either will verify if this delegation procedure has happened correctly. Now, as we saw before or rather as we stated before delegatable ESI can be built from delegatable e r f we didn't have this the properties. So let's look at building a delegatable e v r f. So what do we want this again to search approval one somehow we can delegate the process. So instead it will take ciphertext c one and c two and the correctness of the delegation requires that for every single input the eval function is correct essentially and same as a useful algorithm that we will define which will return one if this correctness of delegation passes if pk one c one pk two c two is given it is one if and only if the correctness of delegation passes. So now I've done all of this but I want to now discuss how do we actually build this delegatable e v r f at least the basic thing. So recall that we have this has the standard e v r f construction. And then I mean I've taken the diagrammatic representation and put it on a kind of in a textual format. Now the key idea here is separate the r. So I'm using this r twice here. So I'm once I'm using it to hash the value and once I'm using it as a parameter for the bilinear map. So let me see I want to separate the two process out. So how do I do it? I introduce this new term called d is equal to g to the r. So essentially r is equal to d is equal to g to the r. And I will also include the public key and this value d in C and T. So this is the new definition and the delicate algorithm is this. Basically does a comma r comma d one raise to the a one over a two. So a one over a two think of it is basically a one a two inverse mod of p one or mod of p basically the prime order group that we are working with. And a can now generate however this new Cypatec prime as a squared comma r comma r squared. If I see this, I just need to spread it. It's all public information. Now note that the minute this happens I can now query eval on this value c prime and x star and every check will pass, right? It will produce the correct result and unfortunately we need to prevent this. So the way out is to basically throw in the public key that you also get also inside the hash function. Okay, so that's the key thing here that public key also becomes a part of the hash value here that's computed, okay? And then so we have the delegate algorithm here and what's the next thing that we need to do? We will throw in this additional check, okay? So what we wanna make sure is to see if this is essentially holds true that the component that we get from pk and the component we get from c prime are consistent with each other are correct. Then this is trivially true when I've not modified it and I've not done any delegation. Otherwise d prime is uniquely determined by a prime, r prime and a. And it's because the check passes, right? And the reason why this big exposition is that it's okay to not include d prime in the hash because we have done a prime, we have done r prime in the hash but we are not including d prime but it's fine because this check passes and a prime, r prime and a will therefore uniquely determine d prime. So it's fine to not include it, fine to not verify that that is correct, fine, okay? And the final point here is about the same function because we needed the same procedure, right? So these are the terms. So pk one is nothing but g comma a one, pk two is g comma a two and these are c one and c two, right? They're different a, r and d one and this is some a prime, r prime and d two. If I went honestly delegated, okay? The first two terms will be the same. So if a comma r and a prime comma r prime are the same then it was honestly delegated. So I know that they will produce the same results. The delegation is correct, therefore it will produce the same results. Now, if a of a one comma d one, a one is the public key that we are dealing with and a two is the public key that we're dealing with here. If this value holds, again, we know that the eval function will produce the correct result. It can be mathematically verified and we verify it in the paper but the key point here is that the same procedure will work like this. If these two checks passes, then I will return one, okay? And this is a basic delegatable EVRF and here we only have an honest delegation which means that the adversary can only delegate to a secret key or a party whose secret key does not know and this is secure under the BDDH. Now I can take this and I can also allow for a little bit of corruption, okay? What do I mean by a little bit of corruption is now I can specify SK2, okay? I can specify SK2 and we prove that the same construction, we have some further extensions which will also support this extension and it's secure under BDDH, both in and out delegation. So now I can specify SK1 and ask to get SK2 or I can produce SK2 and ask to an honest SK1. Both of these are possible and we unfortunately, we can only prove it to be secure in a very strong model IBDI, the interactive BDDH assumption. Unfortunately, it's not well studied. So we try to find a middle ground which is the one time thing where only one in delegation varies allowed but any number of out delegation and we prove that the construction is secure under the EBDDH assumption. Now, there's a lot of acronyms here. There's a lot of settings here but the key argument here is this, right? I can, an attacker can simply take a query that take a C that it receives as challenge and then asks it to basically delegate it honestly to a second party. And then once the C has become C prime it can run C prime and it start and because we want it to be delegation correct this will pass, you get the same value and the correctness is avoided, right? We break the scheme trivially. Unfortunately, I mean, the way around this the fortunately rather is to use the same procedure and that is why we require the same procedure critically which will determine if the values that I'm playing with will actually produce the same result, okay? Now, I can do it once. I can keep doing it multiple times. At some point of time, I can do it. I need to somehow retrace the path and that's why bidirectional support for this kind of delegation is quite, you need some stronger assumptions to prove secure. We can check the paper for details for more expansive discussion. So now let's just basically summarize the talk. What have we done here? We introduced this primitive of encapsulated search index which has all of the features including the distribution and delegation. And we also introduced this primitive of independent interest called encapsulated verifiable random function which achieves this computing of PRF value through two different ways which can be done by two different independent parties and I can extend it to the distributed and delegated setting. The basic version secure under the BDDH assumption in the random model model. Now, having said all of this, I should also stress that this is commercially available. It's a product that's out there. Atacama has deployed it in several companies and it's quite successful. So all of this is not purely theoretical result. We also have practical efficiency guarantees because it's been deployed and used extensively by the clients. And that's all I have time for you now. Please thank you so much for taking the time to see the full version of this talk. I'll take questions during the live proceedings. Thank you.


Hello, I'm Dr. Sunil Kini, consultant joint replacement and arthroscopy surgeon at Manipar Hospital's Bangalore. Most patients are expected to get back to their normalcy after a hip and knee replacement and that's the whole motive of doing it. There are certain modifications which we say which are safer to be practiced after a hip and knee replacement. From the hip point of view, after a totally replacement, certain activities which we ask them to preferably avoid, especially the Indian scenario, that would be to sit cross-legged or squat because that would cause a slightly higher chance of dislocation rates than other activities which the patient can obviously do. From the knee joint point of view, after a knee replacement again, certain activities which we ask the patient to avoid as far as possible is sit cross-legged and squat. This is not because of dislocation unlike the hip, but because we're doing this, they put higher chances or put higher stresses on the plastic which in these cases may slightly lead to more chances of loosening of the implant and thus decrease the longevity of the implant.


Hey there. I'm Chad Bonser. I'm the Business Library in Ohio University Libraries. I have a whole class of students working on analyzing the supermarket and grocery retailing industry. And unfortunately, I can't be there to meet with them because, well, not unfortunate. I'm on vacation and I'm in Florida, so sorry about that. But what follows here is my six top tips for researching the supermarket and grocery retailing industry. You'll have six databases here that are key and essential in looking at this industry. What follows here is about a 14 or 15 minute demonstration. Sorry, it's a little bit long, but it's pretty comprehensive. So once you do this, you'll definitely know how to research the supermarket and grocery store retailing industry. So here you go. So the first in my top six picks for grocery and supermarket industry research is the S&P, Standard and Poor's Capital IQ Industry Surveys. These are updated every six months. You can see they cover things like how the industry operates.  Also we should note that all the data that is within here, you get profit ratios for your companies. All this data here is downloadable here to Excel if you click on the downloadable company data. So a great source here to do that. You can also click the PDF here if you want to print the whole thing out in one big document. To find these reports, once you get to Standard and Poor's Net Advantage on the homepage here, all you're going to do is click on under industry surveys. Here we have the food and staples retailing. That's what they call that instead of the supermarket and groceries like some other reports called it. Just select food and staples retailing, hit the arrow there and that will take you to the food and staples retailing industry survey here in Standard and Poor's Net Advantage. A great resource updated every six months and ideal for people who are researching the supermarket and grocery industry. The second database in my list here is Ibis World and if you just search for grocery and Ibis World, you can see you get stuff from online grocery sales, grocery host selling. Here we have supermarkets and grocery stores in the US. These are great reports that do cost you that students tend to over rely on these reports so definitely don't let Ibis World write your whole paper or do your whole project for you. You can see it does give you some nice graphical detail. You can see there's an industry outlook. You get an industry at a glance which gives you a nice kind of nice graphical interface here to see how the industry is doing and that sort of thing. You get market share for some of the major companies. You get operating conditions in the company and things like that. Here we have products and markets including major market supply chain and you get an industry outlook to tell you how the industry is doing that sort of thing. A great tool to get started with, definitely don't let this be the end all be all of your research. That's why I'm showing you six tools here, not just one, but Ibis World is definitely one to consider, particularly if you know nothing about the industry. It's a great place to get started. The information found in Hoover's, which actually comes from the Dunham Bradstreet first research database, is a great compliment to Ibis World and can actually prevent from overusing Ibis World content. Here we have the grocery stores and supermarkets content here in Hoover's, which is based off the first research database. You can see you get industry growth rating. You get all kinds of industry financial information, industry forecast. All these things are clickable here, so you can click on trends and opportunities here for example, and get all kinds of good information to go along with your project. A great way to look at that kind of stuff. You also can see that there's a company's list here. Because we're in Hoover's, which is primarily a company database, all of these companies are clickable within here, so you can go and click and find more information about the companies within that particular industry. So to get this information in Hoover's, basically all you have to do from the Hoover's homepage is you can change the categories to industries and industries type in grocery and see what comes up here. We here we have specialty food stores, grocery stores and supermarkets and that's how you get to these reports. If you want to, you can also go back to the all industries tab here and this will allow you to actually browse Hoover's industries to see what other relevant industries might be available to you within this database. So our fourth tool is called Passport and the advantage of passport over some of the other resources that we've looked at before is that passport does a lot of content for not only the US scale but also the global scale and global market as well. So the great tool to look at the grocery and supermarket industries in other countries, whereas I was world in first research primarily in S&P primarily focus on the US, this does offer some global coverage here. So what you can do is under to get to that content, go to find analysis and here we're going to choose our industry. You can go up here and type in your keyword if you want to but I actually prefer you to start browsing first to see what kind of content you might have. So we choose our industry here and within this section they actually put grocery store and supermarkets under retailing. So we click on retailing there. Now we can choose geography here and let's just say we're primarily interested in let's look at Western Europe and let's do maybe Germany here and then we'll click go. So we'll take us to a list of search results here and here within our list we have grocery retailers in Germany. Pretty cool and we also will have company profiles and that sort of thing of some of the companies in the country. Here we have an overview of retailing in Germany so the broader perspective there. All right, so if we look at grocery retailers in Germany. This takes us to the page here where we have headlines, trends, prospects in the industry, competitive landscape, things like that. And then at the very, very end we'll have all kinds of category data. Let me scroll down past the pictures here looking at sales, company and growth rate and that sort of thing. So now that we know that this is called grocery retailers in Germany, you might go up here and type in grocery retailers in and you can say France. You can say in Belgium. So we have all this information for global coverage there. So really cool. Another way to get this information if you want to get multiple companies or countries at the same time to compare them is go back under industries here and here is retailing. And this takes us to the retailing homepage here. And so what you can do is go into the search tree and here is, let's do retailing as the category and just click go. This is going to take us into the search tree. And the reason we're doing this is that it will take us into a place where we can drill down and look at different aspects of retailing by different geographies. When your results load, you'll see that retailing has been selected, but you might want to scroll down just a little bit to see where that is and see if there's other relevant information down here in the list. So here we have store-based retailing and here we have grocery retailers. All right, pretty cool. And let's just look at store-based retailing as well. And then now we're satisfied with that. We can choose geographies. We'll do now choose geographies here. And once it loads, let's say we're looking at Western Europe. We can select Western Europe there and then go in and choose whatever countries we want. OK, and now we're happy with that. If we scroll down now, we can either click See Data Now or Run Search. Run Search will give us statistics and analysis there. If you just want statistics, you can click on statistics or we can click on things like brand shares or things like that. So if we click on, say, for example, market sizes, this will give us the market size for each country that we selected for the various retailing, store-based retailing and grocery retailers. Again, if you want this information, you can download this to Excel or a PDF, that sort of thing. So a great way to look at that. If you want to, you can click on analysis.  Or if you go back to your result list, you can find all the reports. Here's a retailing in Belgium, Denmark, grocery retailers in Greece, Germany, things like that.  And here's our reports there. If you want to get rid of that, you can go back and look at, if you want to look at company profiles in those areas, here are company profiles. And this will bring up company profiles, including in many cases SWOT analysis of some of the companies in those areas. And so here we have, for example, there's your Aldi Group in Belgium or in Germany. And here are basically different supermarkets and grocery stores and key retailers in those areas. So those are some quick ways to use Passport for this project. A great way to get global coverage in addition to US coverage of the industry in various markets. While the previous four reports, four databases have looked at reports mainly covering the broad industry perspective, Mintel actually does a little more research into the consumer mindset and what consumers think about the, about why they do, why they shop at particular grocery stores and things like that. So Mintel does market research on consumer needs, consumer demand, that sort of thing. So you can see I've found the market drivers here for grocery retailing in the US. You can see it covers all kinds of trends, market size and forecast, things like that. It covers things like social media in grocery stores, marketing strategies, attitudes towards online grocery shopping, things like that. Mintel is pretty easy to use. All you have to do once you get here is if we're just looking for grocery, you can see it's going to bring up grocery retailing. You might also try for supermarket and see if that brings up anything. It looks like grocery is probably, here's supermarket retailing in Ireland, I guess. But if you, it looks like grocery is probably your best bet for this particular resource here. So here's grocery retailing in the US. You can also browse by category here. So here we have, there's a retail section down here if you wanted to browse by overall general theme or sector or demographic that you're looking at reaching. So a great way to find additional information about the retail space and things like that. In addition to that, you can kind of find here's Convenience Store Food Service, right? So we searched for grocery, didn't find that. But here is a report for Convenience Store Food Service which would probably be a competitor of grocery stores. Likewise, if we go back and see there is a, they call it mass merchandisers. So that would be your Walmarts, your big super targets, places like that. And again, if you wanted to, you can search for grocery and then click here or you just click here to search all the reports in grocery there that would bring up some of those other reports there. So here we have the food, drink, consumer coming soon, grocery pricing, promotion, things like that. So it looks like some decent content here for you in looking at the grocery market. From a more consumer perspective than the other resources here in Mintel. The last but certainly not least database that I encourage you to look at is business source complete. This is where you can kind of use business source complete to fill in some of the gaps of your research to find additional articles about your topic and that sort of thing. So if we go up here, I'm not gonna start here first because it's not my first pick, it's more like my fifth or sixth pick because I think you need to have a good knowledge of the industry before you start slapping in keyword terms here. But if you just wanna type in grocery, here we search for grocery, I didn't get halfway there and here we have grocery stores or supermarkets which is kind of what we're looking at, right? So pretty good, we find 59,000 results there. You can see we have stuff from like the Journal of Marketing, we've got stuff from Fast Company, things like that. What I would encourage you to do, even if you do a search just as simple as grocery stores or supermarkets, is go down and limit this to trade publications. What this'll do, it'll get rid of that Journal of Marketing, it'll get rid of Fast Company and so here we have articles from Progressive Grocer. Okay, we have articles from Chain Store Age. Okay, so pretty cool. These are articles written by people in that industry, for people in that industry. Okay, so a great way to get content there. Now if you want to, you can go up here and say, all right, let's limit that down to maybe 2013 to 2015 and look for, we're just basically browsing articles and trade publications from the past couple years about the industry. So a great way to kind of get a good idea of what's going on in the industry from the industry perspective, right? So if we look at some, for example, let's go in and look at this first article and we'll look at Progressive Grocer here just by clicking on the source link. So this tells us it features articles, in-store business, non-foods business, commentary legislation, technology, produce and news of note aimed at executives and managers in the retail supermarket business. If anyone's gonna know what it's like to work, to do business in, to the customer mindset, that sort of thing, it's the authors of Progressive Grocer. They're writing from the industry perspective and their audience is people in that industry. So a great way to look at that kind of content. If you want, so you can go up and just browse by issue. So if you say, let's look at the latest issue, this will take you in to kind of show you what's going on in the latest April issue of Progressive Grocer here in your virtual newsstand, so to speak. So again, Business Source Complete is a great tool to look for those trade publications that will be very useful in complimenting and adding additional information to your reports that you find in the other market research and industry research databases. Hope this video helped you. Should any more help, look for the contact link on the business blog, we gotta help you. Anyway, can take care, have a great day and I'll see you when I get back from Florida. Bye now.


So the ego is a master at making up a crystal ball of a world in which there are many perceived problems. There's not only a body and bodies, but there's all these problems. There's financial problems. There's health issues. There's issues about interpersonal relationships. There's all these pseudo problems that all of them exist in this crystal ball of time and space.  Turn away from that crystal ball. Turn to the light. In the light, that's who you are. You don't really have any problems because none of the crystal ball problems that you believe in are real. So you're hallucinating, but you think it's real. You've gone to a movie theater and now you've got hooked on the movie. And now you're reacting and responding to all the characters and the images that are part of the movie. And now you believe you're in the movie.  Like Jesus does say once in the course, he said, there is one question that you can safely ask. One question, he says, that you can safely ask with any situation, with any circumstance. How do I feel? Oh, he's given me one question to ask and he's saying, yeah, let go of all your time, space. Imagine that there is no crystal ball. Imagine that you're just a mind with thoughts and now you're just working with your mind and there is no world. He does teach that in lesson 132. He says there is no world exclamation point. There is no world apart from what you think. And so if for one moment I say, okay, Jesus, I'm going to go with you. I'm going to say, all right, I'm not going to ask any questions about time and space. I'm not going to ask any questions about learning, nothing about time and space. In fact, as soon as I hear this thought in my mind, practically speaking, how do you exist in the world? Jesus is saying, yeah, who is the you that exists in the world? No, no, come back. How do I feel? Let's just come back to emotional honesty of how do I feel? You see, that one question at least points you back into your mind. It doesn't point you out on a wild goose chase of time and space. It doesn't point to inside the crystal ball. It actually is more authentic to say how do I feel? And what if you just use that how do I feel in an authentic way to come into what is your will for me? You were saying that this morning. What is your will for me? It seems more honest than what shall I do as a person? That seems like a very inauthentic question compared to father, what is your will for me? Or how do I feel and what is your will for me?


It's been about 60 years since George Streisinger started to use zebrafish in research. A child's move from pet chop aquaria to lab has grown to zebrafish been kept in over 1200 laboratories around the world. Now much more recently, scientists have been looking at wild zebrafish to learn lessons about how to make the life of lab zebrafish less stressful. These are zebrafish in the wild. They're found in the shallow margins of rivers and streams in North India where they live in shoals darting in and around river plants. They mainly feed on insects and crustacea and in turn are prey for larger fish, prey for snakes and birds. Wild zebrafish are quite tolerant of different environmental conditions. Perhaps one of the reasons they've made such a successful aquarium animal they've been found to live in a range of temperatures from 24 to 30 degrees C. The water they're found in has a pH anywhere between 7.1 and 7.7 and oxygen levels can change as well. They've been measured between 3.9 and 8.9 milligrams per litre. One factor that's very different between the lab and the natural environment is the amount of noise. Zebrafish listen to their surroundings in their natural home but in the lab where tanks can be loud up to 146 decibels sound levels can be loud enough to damage zebrafish hearing. So the ambient noise in fish facilities is likely to be stressful to the fish and potentially can found research work. In the lab zebrafish are used in an astonishing variety of research. Zebrafish can regenerate heart muscle so they're used in heart research. They can catch diseases like TB and they're transparent when they're young so they're ideal for following the movement of cells and tissues during early development. But whatever the field of research it's important the fish are healthy and behaving normally so that any results are not an artifact of laboratory living. In the wild zebrafish shawl in groups that can grow to several hundred but are usually smaller. In captivity zebrafish are almost always kept in groups except when individuals are removed for breeding or other work. Wild zebrafish are usually found in clear running water but they can occur in more murky, turbid conditions. In the lab tanks are always supplied with clean running filtered water. While wild fish have to find their own food zebrafish in the lab are fed daily and tend to be heavier than their wild relatives. In the wild the riverbed can vary from mud to pebbles. The laboratory fish are now sometimes housed in tanks put over sheets decorated with a pebble pattern representing a riverbed. And when given the choice zebrafish prefer to swim above a pebble pattern compared to being in a playing tank. Sometimes fish are provided with floating plastic plants and occasionally live plants but here the fish preference is less clear. Although floating plants whether they're artificial or real do give the opportunity for fish to hide from aggression from other fish. Recently zebrafish have been shown in the wild to seek out warmer water when they have an infection. Apparently this induces a fever like reaction that helps to reduce the infection. In the future laboratory tanks might be modified to give more of a gradient of conditions such as heat and light and oxygen concentration but for now the priority in the majority of labs is to maintain all these environmental factors within very tight limits. Zebrafish in the wild have to contend with a complex environment and the ever present threat of predation. Zebrafish in captivity are in a far simpler world. By presenting zebrafish with choices we can learn how to make their laboratory world a little more to their liking perhaps removing some of the stresses of living in tanks. Stresses were only just becoming aware of.


What's going on everyone Sam here with latent sports cards? We are doing 21 22 penini select basketball each two ten box break number four Random or tiered random team style. Here's a look again at your random results. There's always it is the boxed-off one As always you can find these on the website under the results tab as well as the link in chat. Let's do it everybody good luck See some nice stuff come out.  Yeah, true. That's a good point. Honestly Carl Why there's a Jeremiah Robinson Earl? Jason Tatum Josh giddy base rookie RJ Barrett court side there's Zaire Williams on the disco rookie concourse and silver Ray John Rondo Williams the third And silver LeBron premier level nice one there Lakers So much you sure Thank you, dude Lou Jen Stort And Paul George how to do for box one we're on the box to got one-in-one case coming up next Teardrand Something something big is coming out of there. Yeah Franz Wagner rookie Zach Levine on the premier level disco Lonzo Zaire There's a Kate Cunningham disco concourse nice one there pistons a few H Jimmy Butler silver Yeah, I was gonna say Yeah, Chris D'Warze and it's a very good point Ray John Rondo and a blue Chris Paul Eight out of 25 nice one there on the premier level grads on that their sons tier two hit for Brandon H That is a good tell for sure whenever I mean whenever it's the First of the month again Jalen Suggs on the red nice one there 31 out of 49 grads magic Carl. We got One spot left in the 2022 But yeah one spot left and black and origins Santy Aldema disco Tomorrow Scotty Barnes rookie on top Call Anthony as a Chris D'Warze red nice one there for the Pacers 35 out of 49 Silver Chris Paul D'Ron sharp on the silver or not the silver, but the disco That was way off center. That is I had assumed silver premier level for the Bulls Josh giddy base rookie Lori marketing disco And Brook Lopez Yeah, dude, it's gonna be so much fun, man. We got prism first off the line World's Cup in stock for personals right now. So anybody who's interested in that we can rip some tonight Get an early pretty sneak peek preview. Let's go. Bop a Bop it off Stevie Wonder centered the discos true Franz Wagner Payton Prichard disco Damian look Josh Richardson a red courtside disco 43 out of 49 Celtics Celtics legend Silver down open. I was kind of wild actually only went for that that little I was pretty surprised Dorte's Kevin Love And Herbert Jones on the blue 25 out of 25 pelicans nice one there on the Top tier. Yes, Michael M Seth Curry on the disco And Anthony did see what we got next. Good luck here again, everybody Jalen Johnson, there's a Ricky Rubio Premier level disco and exactly One auto out of these why not why not us Sean? What I know Scottie Barnes Rick courtside will Barton carl Anthony's house on the disco How are you urban silver? Or a blast maybe gold Green Joshua Prima And silver Andrew Wiggins I was gonna say yeah the concourses have been a little bit rough. Everything else has been fine. I'm mostly fine Yeti rookie So bias here is a tray young yeah, it's left right you can see and they're on sharp. All right box six Alfred Shen good nice one there Scottie Barnes on the rookie honestly Haven't Mowgli base rookie Cavaliers deadsman me Quentin Grimes on the concourse disco and silver Donovan Mitchell jazz Corey Kispert concourse disco and a blue of Miles Bridges eight out of 25 going to the Winx Scottie Barnes rookie nice one there Jordan Clarkson disco Andrew Wiggins. This is dead to select the h2 says different chrome dust. Holy cow Santillatima is a Jamal Murray Chris ball Deontay Murray and silver Davion Mitchell Kings But I healed for the Kings on the concourse disco and a blue James Harden that's nice four out of 25 Nice one there Brooklyn and Thomas Damian Lillard on the red court side six out of 49 It's a cool on there for the Blazers Eric are on the tier two Shengun on the rookie Say chrome dust my dog has a sneezing fit. That's how much chrome dust there is Carl It's like going through our computer through your computer Start breaking in ski masks. Yeah, there's I had to soon move premier level rookie disco. Isaiah livers Usman Garuba for the Rockets and silver Jalen Green concourse nice. There you go Rockets all George and Precious that you are going to the Raptor six out of ten. That's when they're Toronto Toronto is Edison L Congrats Edison about Colin Sexton Bradley Beal has a Jackson. There's a Zion court side disco nice one there pelicans Congrats again Michael Evan Mowgli rookie Jalen Suggs rookie Darius Garland disco and silver Montrez Harold. Thanks for the follow there Stephen Yeah, we do personals to on the website Leighton sports cards at gmail.com or no Leighton sports cards calm. We've got Trayman on The disco RPA Congrats Thunder not numbered there. Okay. See Eric R Calcuzma disco and Lonnie Walker court side 12 out of 25 on the blue Jalen Suggs rookie disco Vontegren Yeah, I was a nice Zion actually I like the disco look at the court side, especially if they're like gold or different color. They're always nice court sides are fire John and coming up Darawn Sharp Going to the Nets John and coming you accidentally press Michael Porter jr. There's Dallin O'Banton for the Raptors and Isaiah Jackson silver Isaiah Jackson Anthony Edwards disco And silver Peyton Pritchard my fake Gucci shirts on my finally Yeah, I didn't think I was gonna get it It's on its way Just love China. Yeah Jalen Suggs rookie Jalen Green disco concourse nice one there Rockets and Jaden Springer that'll do for the break there really not anything to recap Thanks again everyone for jumping in we'll get these right out to you guys


Blocks for Contact Two blocks which are useful for us as teachers to keep in touch with our learners and our co-teachers are the Online Users block, seen on the left here, and the Messages block, which we'll add shortly. The Online Users block shows us who's recently been online and who is currently online now. This is useful in a face-to-face teaching situation as well. If you're in a room and you want to make sure that all your learners are logged in with you. To add the Messaging block, as with other blocks we turn the editing on by clicking the button top right or by clicking the link in the Administration block, and then scroll down to Add Block, choosing the block we want. The Messages block is a quick way of seeing who has sent you any messages and you can read them by clicking them here. And similarly, you can use the Messages block to locate learners whom you wish to message.


Spring Cleaning is here and Appalachian Wireless has the deal to get you started. Get a Samsung Galaxy S8 for a penny or a Galaxy S8 Plus for only $89.99 on the region's best network. Better service, bigger savings, that's today's Appalachian Wireless. So your agreement requires you to store for details. From January of 2017, 16 people in Pike, Floyd and Johnson counties have died in car crashes. 15 of those people were not wearing seatbelts. Deaths that could have been prevented. And when it's too late, it's too late. The Click It or Ticket targeted enforcement campaign kicked off this morning in eastern Kentucky. The Kentucky Office of Highway Safety and Highway District 12 joined together with law enforcement agencies to focus on seatbelt safety. The Click It or Ticket campaign focuses on safety education, strong laws and law enforcement officers saving lives. In 2016, the use of seatbelts in passenger vehicles saved over 14,000 lives of occupants over 5 years old. Nobody wants to get a ticket, but if we can go out and ride a seatbelt ticket, you're there and it makes somebody buckle up. And later on down the road, they are involved in a pretty serious collision and they survive. That makes it all worth it. We want people to obey the law, but we want people to get home to their families. And if we can bring fatality down by wearing your seatbelts or if we can bring seatbelt usage up, then we've done our job. Not only does wearing a seatbelt contribute to keeping motorists safe if involved in a collision, it also saves them money. Insurance companies look at the seatbelt usage rate in the county when they send their rates for auto insurance. Click It or Ticket officially begins Monday. Law enforcement agencies around the region will conduct safety checkpoints and saturated patrols during the campaign. In Pikeville, Shelby Porter, EKB News.


Introducing LiveCap, which captures the last 30 seconds of any live stream so you don't miss any exciting moments. Here's how it works. You can install it as a Chrome extension from LiveCap.tv and then when you're watching a live stream, you simply push the Chrome button to capture the last 30 seconds. Here is Tali and I'll show you how this works. Let's watch Tali. You guys want to go all toward your... You only need me on this map, bro. It's all good. You know, why don't we all just go into a point and then just put four walls around each other. So let's say that was just an exciting moment that I wanted to capture. I'll click this button, capture, or I could press Alt X and then it automatically takes that last 30 seconds. That just happened. It's the 30 seconds ago and puts it into a permanent record on LiveCap.tv. And here it is. Let me just pause the original stream and then you can watch it again here. There's worse jobs than that for sure. Hey, you guys want to go all toward your... LiveCap also did an AMA recently on Reddit for popular games. Dota 2, Starcraft 2, Counter Strike, and Hearthstone. And I'll send links. You'll find them in the description beneath this video to all of these reddits. And you're welcome to read about LiveCap, all of your questions answered in these reddits. Hope this helps. So you get the idea. What happened was that any time you're watching any live stream and you want to record the last 30 seconds permanently and it also records the chat at that time, which is loading right now. So you'll be able to see a history of the exciting moments of anything that you're watching. Isn't that cool? It's a free service. And just go to www.livecap.tv, get the Chrome extension, and just push it any time you see exciting moments that just happened. Send us links to any exciting moments that you have captured using LiveCap in the comments below. I would love to see them as well. Tell us what you think of LiveCap. Is this a service you will be using whenever you're watching a live stream? I would love to know. And do you have any other tools that you think the Freedom Family can use to grow faster? Send us those down there in the comments below, because that is the spirit of freedom. We help each other grow together as a family. And if you don't know, we just started our community team where people are dedicated to answering every single one of your comments. Click that I up there in case you didn't know who's on the community team. And if you want to join the community team, just watch that video. Who am I? I am George, CEO and founder of Freedom. And this is a different shirt because the other one I normally wear is in the wash. And you've been watching. And we will grow together as a family because this is the Freedom Family. You are part of it. We are all part of it. And we're all growing together. So grow with us and partner with Freedom. That play now button right there on the video bar is all you need to click to get started.


A silicon-controlled rectifier, or SCR, is a specialized type of control diode. The electron flow is the same as in an ordinary diode, from cathode to anode. However, unlike other diodes which only perform an on-and-off function, a SCR can regulate a flow of electricity with gradation when forward-biased. This is accomplished by manipulation of the adjustable gate control. This gate control function determines when and how much the SCR conducts. A common application of SCRs is in light bulb dimmers. Here is a circuit that contains a light bulb and a SCR. As the switch at the gate controller is adjusted to control power in the AC circuit, note the timing of the gate pulse and the subsequent change in the waveforms. Also, observe that average current flow increases and the light bulb becomes brighter.


Hi, my name is Manuel. I'm from Germany and I did the 120-hour Tiesel course. What I like about the course as a father of two children, of two small children, I'm... I was really excited about the format of the course that I can decide on my own when to work and when to do the tests. I learned a lot and I think it's write the content that you need for getting started as a teacher in English. So I recommend the course to others and I'm glad that I did that.


So yeah, so this is joint work with Sumega Garg and Mark Zandri. So the main question that we're going to focus on in this talk is what sorts of security notions can we expect for message authentication in a world with quantum adversaries? So we know that once quantum computers come online, we expect to see adversaries with enhanced computational capabilities, such as the ability to factor. But in addition to that, these quantum adversaries will be able to access and interact with cryptographic protocols in a quantum manner, something fundamentally different. And we would like to understand what does it even mean to be secure in such a setting. So in this work, we're going to explore, quote unquote, best possible notions of security, or at least attempt to get best possible notions of security. And we're going to give constructions realizing these security definitions. And for this talk, we're going to focus on a very basic setting. So we're going to focus on the setting of information theoretic security. And we're going to talk about private key protocols where the parties communicate only once between each other. And there's two parts. One is we're going to focus on protocols that authenticate classical messages. And then in the second part, we're going to talk about full-fledged authentication of quantum data. OK, so authenticating classical messages. Let me focus on message authentication codes, or MACs. So these are a basic crypto primitive that ensure message authenticity and integrity. And so let me explain this by a way of example. So let's say there's a bank, your favorite bank, and you want to transmit the following message M to it. Withdraw $100 from my bank account. And you like to do this in some secure and authenticated way. So let's say you use your bank card. And let's imagine that the bank card shares a random key between itself and the bank. So in the random key H, you can think of as being a random hash function. So when you send this message over, your bank card will append a hash, H of M of the message you want to send to the bank. And when the bank sees this, it can check that the tag, this H of M piece, is indeed the hash of the message it received. And it will accept and then withdraw $100 from your bank account. But what if there's an active adversary who's trying to corrupt the communication from yourself to the bank and instead wants to create an authentication of some other message M prime that, for example, could say transfer $1,000 to Charlie. If, say, the attacker's name is Charlie. And it tries to cook up a bogus authentication tag T prime to convince the bank to do this. Well, the security guarantee of a one time Mac is that even if the attacker gets to choose this original message M and it sees the message tag pair M comma H of M, with high probability it should not be able to produce a forgery, a different message tag pair. So achieving this security definition is not hard in the classical setting. If H is a pairwise independent hash function, then this gives rise to a information theoretically secure one time Mac. This is also known as the Wegman-Carter one time Mac. And this is secure against computationally unbounded adversaries or classical adversaries. All right. And this definition can be easily generalized to the many time setting. So let's say, you know, this smart card is used to authenticate multiple messages, say messages M1 up to MQ. And the attacker gets to see the authentications of all of them. It still should not be able to produce a forgery, you know, so long as the number of queries to the Mac Q is, say, polynomial and some security parameter. So the question we're interested in is, well, what if the adversary has a quantum computer? OK. If the interaction between all the parties is classical, then the Wegman-Carter Mac, for example, still remains secure. And this is because we have information theoretic security of this Mac, right? So if the interaction is still classical, then the only difference potentially is that the adversary has more computational power. But as I just explained, this doesn't affect the security. But on the other hand, if the interaction is quantum, then, you know, we have to ask ourselves, well, what does it mean to be secure? OK. So to explain what quantum interaction is like, I'm going to explain the basics of quantum information to you guys in one slide. And it's not too hard. So the first thing is, you know, imagine that you have some system that can be in de-possible classical states. So for example, you have a bit. It can be either on or off. These are two states. Quantum mechanics says that this system, the classical states, can be mathematically described by elementary basis vectors. So say state 1 is represented by the vector that's 1 in the first coordinate and 0 everywhere else. And similarly for the other classical states. But more generally, this system can also be in a quantum state. And this is described, most generally, by a complex unit vector in c to the d. And quantum states are represented by this funny bracket notation. But really, all this is just some linear combination of the d basis states. And we have the constraint that all these coefficients, alpha sub i, they're complex numbers. They can be positive, negative, or imaginary. They just have to square and sum to 1. That's if you have something like this, this is a quantum state. And the way to think about this is that if you have a system that's described by this state, you can think of it as somehow simultaneously being these classical states all at the same time, but with these complex weights somehow in the background. And how do states change over time? Well, they change over time via linear transformations that preserve L2 norm, also known as unitary matrices. So if you have some quantum state of the system psi and you apply unitary matrix to it, you get another complex unit vector psi prime. And that's just another quantum state. The last thing is something called measurement. So this is another thing that can happen to a quantum state. If you have a quantum state psi and you measure it, what you get is a classical state, i, with probability alpha i squared. And these are probabilities because they sum to 1. And the important thing to know about measurement is that once you measure, it collapses, and you get a classical state out, and all the information about the other alpha i's just disappear. So in this sense, quantum states are fragile. So here's an example of a quantum state. You've probably heard of Schrodinger's cat. It can either be alive or dead. But a possible quantum state of this cat is the superposition of being dead and alive, where the coefficients, these alpha i's, are 1 over square root 2. And it has a coefficient of minus 1 over square root 2 of being alive, whatever that means. OK, so now that you know as much quantum information as I do, we can now think about what different attack methods that the attacker can perform. So what if the attacker queries your bank card with a superposition of messages? So we call this a quantum-chosen message attack. And what the adversary will do is just prepare some superposition of classical messages and feed it into the smart card. And the smart card will then authenticate it in superposition. So you can imagine that now this quantum state is just possibly an exponential number of messages all authenticated simultaneously. And then the question is, well, what can the adversary do with this quantum state? Maybe it could perform some complicated quantum computation on this state to, say, extract the secret key, this hash function H. Can this adversary produce a forgery just from this one quantum superposition query? So this question has been studied before. So in 2013, Bonet and Zandri gave a security definition for this model where the attacker can make superposition queries. So we say that a MAC is Q time BZ secure. If it can make Q superposition queries to this MAC, yet no matter what quantum computation it does afterwards, it can't produce a Q plus 1 valid message tag pairs with non-negligible probability. So this is a pretty natural definition of security for message authentication codes. It kind of lines up with the classical security definition. And one theorem that they proved is if H is a 3Q plus 1 Y is independent hash family, this yields a Q time BZ secure MAC, provided the output range of the hash family is large enough. So that was a feasibility result. And as Aaron mentioned in the first talk, there are some negative results showing that there are some standard message authentication codes like CBC MAC, PMAC, and so on that actually fail to be quantum secure. That is, there are quantum superposition attacks that are able to extract the secret key. So in our work, what we ask is, so that's a very nice definition, but can we demand an even stronger guarantee than the Bonet-Zandri security definition? So their definition doesn't rule out the following situation. So let's imagine that the attacker prepares a superposition over classical messages where each of these messages M in this set, script M, are strings that are prefixed with, say, the string Alice. So this superposition gets submitted to the smart card. And it signs all of them. And it returns it to the adversary. And what the Bonet-Zandri definition says is that now this attacker can't produce, since it only made one quantum query, it can't produce two valid messages tag pairs. But it doesn't rule out producing one message tag pair, H of M prime, where M prime now is a string that starts with Charlie instead of Alice. So technically, this is allowed by the BZ security definition, but it somehow seems like there's a break in security. Like how was this attacker able to produce a valid forgery of a message that wasn't even in the original superposition? So we give a security definition that rules such behavior out, at least in the one time setting. So our security definition says the following. So let's consider the real experiment. So in this experiment, the attacker will produce an arbitrary superposition of messages, authenticate it, and perform some attack, and sends this attack over to the bank. This is just what happens in the real protocol. And we would like to compare this with the ideal experiment in which the adversary, before it does anything, it's going to measure the superposition that it receives from the smart card. And I put this powdered wig on this adversary to indicate that it's acting classically. So when it measures, what it obtains is, remember that I told you, when you measure a quantum state, you're going to get a classical outcome with some probability, and then the superposition collapses. And it will get m comma h of m with some probability alpha m squared. And then based on this classical outcome, it's going to do some processing. It's going to send some state depending on this m h of m to the bank. So in essence, this is just a classical attack. And our security definition says, your MAC is epsilon reducible to classical adversaries if both these views are epsilon indistinguishable in the accepting case. That's the guarantee that we make. And included in these views is we have the state of the secret key. It includes the message sent to the receiver. And also, we also characterize what happens to the state of the attacker's private memory. So this is a pretty all-encompassing security definition. OK. All right. So that's the secure definition. Now, can we actually achieve it? It turns out that we can. If h is a three-wise independent hash family, mapping n bits to t bits, then the security of h actually epsilon reduces to classical adversaries for exponentially small epsilon. So this shows you that the most straightforward one-time MAC that you would use in the classical setting is still secure in the quantum setting, because it just forces the adversary, even if it has a quantum computer, to act classically. And we already know of security guarantees in that case. OK. So a corollary is that the Wegman-Carter MAC, with three universal hashing, resists forgeries, even against superposition queries. And this recovers the BZ security notion for one-time MACs. And more informally, you can ask, well, what information can the adversary learn about the key? This just reduces to a question of, well, what can a classical adversary learn about the key? And not very much. So let me point out some features of our security definition. In some sense, it is the best possible security definition for one-time MACs in the quantum setting. Why is that? Well, the adversary can always measure the superposition and just pass on. Once it measures, it passes on the classical outcome it gets, and this will never be detected by the receiver. The receiver, all it does is just it gets a message tag pair and just checks that they're consistent. And if you measure the superposition and pass on a valid message tag pair, the receiver is always going to accept. So you can never rule such an attack out. And what we're saying is this is the only type of operation that the adversary can do. So it gets this classical outcome and then just does some processing on the message it receives and its own private space. And we can never rule such a thing out. So another feature of our security definition is that it considers the state of the key in the view. So it considers the correlations between all the parties, the messages, the adversary with the key. And so in fact, our security definition holds with high probability over the choice of key. So that's that for authenticating classical messages. Let me now turn to the quantum setting where we want to authenticate full-fledged quantum data. So now all parties possess quantum computers. This is in the future. And let's say Alice and Bob share a secret key. And Alice has some quantum state that she wants to send to Bob. And Bob wants to recover the state and detect if any tampering has happened to this quantum state that Alice wanted to send. So in this protocol, Alice will try to encode her quantum state somehow, so e of psi. She sends it across the wire.  And Bob now has to decide whether to accept or reject. And hopefully, if it accepts, it produces a quantum state psi prime that's close to the original state psi. So what kind of security guarantees can we hope for in this setting? Well, we saw in the previous talk that actually we can hope for quite a lot. So here's what we can hope for. So here's the real experiment. They run this some protocol. And we have a secure protocol if this view is indistinguishable from the following ideal experiment where Alice just sends her encoding of her message straight through. And the adversary doesn't even look at it. And the adversary just performs some quantum operation on his own private memory. He doesn't even interact with the system. OK. This is the ideal experiment. And it turns out, so our security definition is that these two views are indistinguishable in the accepting case. And again, included in the view is the message sent to the receiver, the state of the attacker's private memory, and also the state of the secret key. And this definition extends previous definitions. The main feature is that now the key is also included as part of the view before. The key was just this indistinguishability statement held on average over the key. So first let me describe what are some consequences of this security definition. So first, this says that if you have a secure quantum authentication protocol, you've effectively made the attacker oblivious to the communication. So in the accept case, the adversary effectively doesn't even look at the message. And this is rather strong. I mean, in the classical world, you can never prevent the attacker from examining the messages that are sent across the wire. But one feature of quantum mechanics is that if you try to measure a quantum state, it necessarily disturbs it. And it's this disturbance that hopefully will be detected by the receiver. So that's one thing. The other thing is this definition actually allows for key recycling. So if you look at this ideal experiment, the message just goes across to Bob, and the adversary doesn't even look at the message. So what that means is that the adversary can't be correlated with the key because it was independent to begin with, and it's going to be independent afterwards. So that means in the accept case, you can safely reuse the secret key for some other protocol in full. And this is something that, again, in the classical world is not possible without computational assumptions. And I also want to mention that previous works were also able to argue that you can reuse the key or partially reuse the key. But here, our security definition says that, and in fact, you can use all of it. All right, so let me mention some constructions that satisfy this security definition. The previous talk describes this unitary design scheme, and they showed, in fact, that if you use something called unitary two designs, which is like the quantum analog of a pairwise independent hash function, in some sense, this actually gives rise to a quantum secure authentication scheme. I won't talk about this here. I want to talk about another protocol we give, which we call auth QFT auth. And this is a secure authentication scheme that actually uses the Wegman-Carter Mac as its building block. There's one caveat that satisfies a slightly weaker definition of security, which I'll describe in a second. So this is how it works. So let's say you have a classical Mac. Just think of the Wegman-Carter Mac. H is like a three-wise independent hash function. And so this is how the encoding is going to work. So Alice has some quantum state psi. It's going to just treat psi as if it were a classical message. So it applies the Wegman-Carter Mac. And then on the resulting state, it's going to apply the quantum Fourier transform on this state. And then after that, it's going to apply another invocation of the Wegman-Carter Mac using a fresh key, H prime. Very simple. The coding is just simply the reverse process. The receiver is just going to check that the outer authentication tags were consistent with the message. It then performs the inverse quantum Fourier transform and then checks that the inner authentication checks out. It turns out that this simple authentication scheme is secure if we don't, as long as we don't consider the second key, H prime. But aside from this caveat, we have exactly the same guarantee with high probability. If there's any tampering on this state, the receiver will be able to detect it. All right, it looks like my amount of time. So let me summarize. We give some new security notions for measures authentication in the quantum world, both for classical authentication and quantum authentication. We gave some constructions. OK, thank you.