Latest / Identity at the Center / #229 - Cryptography 101 for Identity Practitioners with Dr. Andrew Stern of Revive Labs

Transcript

#229 - Cryptography 101 for Identity Practitioners with Dr. Andrew Stern of Revive Labs · Identity at the Center

0:05
This is Identity at the center. If it has anything to do with I
0:11
AM, this is the go to podcast now.
0:15
Your hosts, Jim McDonald. And Jeff Steadman.
0:20
Welcome to the Identity at the Center podcast.
0:22
I am Jeff and that's Jim. Hey, Jim.
0:25
Hey, Jeff, how are you? Oh, not so bad yourself.
0:28
Good. You know I've been.
0:30
Think a lot about remember how we used to do the YouTube
0:33
streaming? We did that for a little while.
0:35
It's still out there. It's still out there.
0:37
It's on YouTube, a little forever.
0:39
Yeah, exactly. Well, I feel like, you know, one
0:42
of the things I was thinking about, it was like, okay, how do
0:44
I wind up wasting time? Not not in a bad way.
0:48
I think I I had a friend, Patrick Gibbons, who used to say
0:54
everybody's got to waste a little time and it's it's kind
0:57
of profound in a way because. It's kind of true and one of my
1:00
ways is I go down these rabbit holes on YouTube and you know,
1:05
there's all different kind of stuff.
1:06
There's like these reaction videos, which I would say are
1:09
more amateurish, but they're they're still pretty
1:12
interesting. I I watch a lot of history
1:16
documentaries which most of those are like professionally
1:19
made TV shows which then end up on YouTube.
1:23
And then there's kind of the influencer videos.
1:26
And I was watching one of the influencer videos and the person
1:30
was at a conference. It wasn't an I M conference, but
1:34
he gave me an idea like we could do that.
1:37
What do you think? Do what exactly do you like the
1:40
video? Like kind of like walk through
1:42
the conference with video cameras, talk to people, give
1:47
people like a sense of what it was like to be there.
1:50
Maybe some some clips from. The different presentations that
1:54
we sat through, obviously for podcasting, we could just set up
1:58
a camera to kind of like shoot it and then throw that on
2:02
YouTube is like a 1015 minute video of like hey, here was
2:06
Octane or Identiverse in the year 2023.
2:11
That would be interesting. It sounds to me like you're
2:14
giving me more work to do editing and more equipment to
2:18
buy and things like that. So I mean, we could do it like
2:21
an iPhone. Maybe we can put the iPhone
2:23
cameras to test and video and stuff like that iPhone.
2:26
Cameras are pretty good. Yeah, I'm sure it'll be good
2:29
enough for that kind of thing. It's an interesting idea.
2:32
Let's talk about it and figure out how we can.
2:34
I don't know if people even wanna see that, I feel like.
2:37
We did that live streaming for a while.
2:39
I liked doing it. It was actually easier for me
2:41
once I had it all step and running because I felt like, OK,
2:44
you know, it's it was streamed and here's what happened.
2:48
Can't no take backs, right? So if you were there, you can
2:51
see it. If you watch the replays, you
2:52
know it, you know, that sort of thing.
2:53
There there really wasn't any editing going on.
2:56
When you do a live stream, it's pretty much, you know, warts and
2:59
all or whatever happens kind of is there.
3:01
Obviously, when we do audio podcasts, we try to keep it less
3:06
meandering. Yes, we can.
3:09
But also, you know, trying to put a little bit of Polish on it
3:11
just to make sure that you know that the product is good.
3:13
But I think it'd be interesting to do like a, I don't know,
3:16
person on the street type thing, right where it's you've got a
3:19
microphone, you're kind of interviewing people.
3:20
We see it all time at most conferences we go to.
3:22
There's usually some crew that does that might conflict with
3:25
that, might not, but I'm game. I don't know if people are
3:28
interested in in seeing that on a YouTube channel, but there
3:32
would be literally two to three of them per year that we could
3:35
do. Great.
3:36
Well, that's all it would be. But that was kind of why I
3:38
brought the question up here in this forum was, you know, I
3:42
wasn't sure how you're going to think about it.
3:44
But hey, our listeners can now provide feedback.
3:47
Maybe I'll put a a poll out there on LinkedIn or some kind
3:51
of message and see if we can get some comments of people who
3:55
think it's a good idea. So look for that.
3:58
All right. I'm curious to see what what
4:00
comes out of that. Yeah.
4:03
Speaking of conferences, we got a whole bunch of stuff coming up
4:06
that you and I are going to be at together, separately and
4:10
everything in between. We're going coast to coast.
4:13
I'm going to be at the Cybersecurity Midwest Summit
4:16
2023. It's in Cincinnati, OH on
4:19
September 14th, something put on by Thomas Park and CDO magazine.
4:22
I'm going to be part of a panel there talking about identity and
4:25
access management. So if you're in the Cincinnati
4:27
area. Come on by.
4:29
It's at a Marriott property, I think somewhere in that area.
4:32
So we'll have a good old conversation as part of like a
4:34
whole day of a different cybersecurity sort of
4:37
conversations. Then in October, which is going
4:41
to be a very busy month for you and I, we're going, I'm going to
4:44
Identity Week America. That's October 3rd and 4th in
4:47
Washington DC I'm going to be hosting a panel discussion on
4:50
pass keys. Starting to line up who's going
4:52
to be part of that panel? Think I've kind of teased folks
4:54
like Andrew Shikiyar maybe have folks like Tom Sheffield over at
4:58
Target, maybe others that we can pull in to kind of talk about
5:02
that. And we've actually got a
5:03
discount code for our listeners. If you use the code Ida C30,
5:07
that gets you 30% off of your conference pass, which is very
5:10
cool. That code works for both the
5:12
Identity Week America and the Identity Week Asia conferences.
5:16
So if you are, you know on the other side of the world
5:19
literally for Jim and I, they have a conference out there in
5:21
Asia as well. You can use that same code for
5:23
30% off. We'll have a link in the show
5:25
notes for that kind of information.
5:27
While I am in Identity Week America that week in Washington
5:31
DC, October 3rd and 4th. Jim, you're going to be at
5:34
Octane, right? I'll be at Octane.
5:36
All the details aren't nailed down, but we do have.
5:41
A discount code for 30% off on your registration.
5:44
It's Okay TNIDA C30. And then later in the month you
5:51
and I will be at the Authenticate conference, will be
5:54
on the stage as part of the keynote, which is pretty
5:57
something I'm pretty stoked about.
5:59
And then on day two, we're going to have a room with seating for
6:03
a live studio audience and we're going to have six guests.
6:07
We'll do a preview show right before.
6:10
That conference kicks off, so everybody will know Okay, here's
6:13
the the different guests that we're planning on talking to.
6:16
And yeah, I'm really looking forward to that one.
6:19
Yeah, that's going to be kind of cool.
6:20
Let me just see how the how we pulled this keynote together and
6:23
kind of pull off this idea of a live streamed in front of a live
6:27
studio and Internet audience show.
6:30
As part of the keynote and we we have a discount code for that as
6:34
well. I D AC15 podcast, you get 15%
6:37
off, so come see us out and authenticate.
6:40
That's October 16th to 18th. It's in Carlsbad, CA,
6:44
picturesque little golf course resorts, the beaches nearby just
6:48
a little bit north of San Diego. So it means the weather should
6:52
be fantastic and that'll be a good time.
6:54
So hopefully people come out and, you know, attend our our
6:58
keynote and the rest of the conference and then.
7:00
You know, hopefully we can fill a chair or two as we're watching
7:04
as they as you watch us kind of put together our shows on on
7:07
site. Jim, what are we going to talk
7:10
about today? Because this was kind of a A I
7:12
see this almost like A2 parter from a topic perspective.
7:15
We're kind of kind of set the ground level and then we're
7:18
going to follow up this episode with another conversation in the
7:21
future. But where are we going today?
7:23
Right, so today's episode is Cryptography 101.
7:27
The following episode is going to be around quantum computing
7:31
and how it's going to affect the future, and I think the basis
7:36
for that is cryptography. Well, I've been in this space
7:39
for over 20 years. I've been in IT for even longer
7:43
than that, and cryptography's kind of been one of these things
7:46
that have been afraid to dive into.
7:49
I'm not afraid to dive into much right like I learned TCPIP on my
7:53
own. And that's a bit of a math
7:55
problem. But when I started to look at
7:57
cryptography back in the day, you know, it was something that
8:00
was a bit intimidating. Funny thing is, going back to
8:02
the YouTube conversation, I've tried to watch several YouTube
8:06
videos on cryptography, and the people talk so fast and I kind
8:10
of feel like, okay, I learned two or three bits that I'm going
8:14
to forget here pretty soon. And so I said, all right, well,
8:17
let's have an episode like Cryptography 101 for I am
8:22
practitioners. And I put a post out there on
8:25
LinkedIn and our friend and our guest today, Andrew, volunteered
8:31
to come on. And he said, I can explain
8:35
cryptography at a fifth grade level and I can go into the deep
8:38
end of the pool, which happens to be 30,000 leagues deep, the
8:42
deep end of this pool. But we don't want to go all the
8:44
way that deep. But he was the only one who even
8:48
volunteers. So I was like, all right, you
8:50
win, man. It's brave.
8:52
It's a. Brave outing, yeah.
8:53
Very brave, very brave. Yeah.
8:56
So let's go ahead and introduce our guest instructor for the
8:58
day. We're gonna kind of go to
8:59
school. He is Dr. Andrew Stern.
9:01
He's the founder and CEO at Revive Labs.
9:04
Welcome to Identity Center, Andrew.
9:06
Yeah. Thanks so much for having me.
9:09
Yeah, so brave man jumping into the into the fire here.
9:14
Cryptography can be pretty deep. It's a lot of math as I
9:18
understand it, definitely not my strong suit.
9:20
So I'm going to be learning here alongside everyone else.
9:23
The idea here is to kind of come up with, you know, the base
9:26
level of cryptography, kind of the one O 1 for especially for I
9:29
M people. And then you know what happens
9:32
when quantum comes along and wrecks everything.
9:35
But before we get to that, we were kind of talking before.
9:39
We hit the record button here and I asked you questions like,
9:41
well, how did do you feel like you're an identity and or
9:45
cryptography? Or maybe it's a little bit of
9:47
both. But how did you get into
9:48
identity and cryptography? Yeah, so it's a bit of a weird
9:54
story. So I did finish a PhD and zero
9:58
trust cybersecurity about two years ago.
10:01
And after that I started a company for Vive Labs, which
10:07
during that time, the cryptocurrency craze was
10:10
actually going pretty hard. So I kind of fell in love with
10:17
the idea of a passwordless authentication system that
10:22
really had no fall back of, you know, these really weak things
10:26
that people need to remember and store and all this garbage.
10:30
So for me, I really dove deep into how those credentials were
10:35
managed and how people actually could recover those things in
10:39
case with massive failure. So it's interesting that you say
10:43
password lists with without anything to fall back onto,
10:46
because I think this is a key differentiation for a lot of
10:48
passwordless products. You've got password less and
10:51
you've got password dash less. The difference between I think I
10:55
too sometimes gets lost in translation where one of them
10:58
doesn't actually have a password.
11:01
In the equation, whereas the other one does.
11:04
But maybe it's obfuscated or hidden by other mechanisms like
11:07
biometrics or other things, right.
11:09
There's still something back there.
11:10
It's kind of a fall back. You know, it's interesting.
11:12
You kind of bring that up. I also want to ask you a little
11:15
bit about your doctorate. So it's very rare that someone
11:19
as smart as yourself is willing to come on on our show.
11:21
So talk to us about your doctorate degree.
11:24
What was that process like? You know how to.
11:26
You know, first of all, what's it in?
11:28
And just walk us through for people who aren't familiar with
11:30
what it takes to get a doctorate, Absolutely.
11:34
So I'll just start by saying it takes a little bit of stupidity
11:36
to do a doctorate. So just to just to throw that
11:39
out there, don't be scared of doing it, just be scared of the
11:42
actual ramifications of spending five to seven years of your life
11:45
on it. But other than that, I got it in
11:50
electrical and computer engineering.
11:52
So not specifically computer science, but I specifically
11:58
worked in hardwarebased cybersecurity, which means going
12:02
down to the silicon level, the chips that actually operate
12:06
every device in the planet. Figuring out how these keys are
12:09
stored, how you can actually extract them out, How you can
12:13
use the implementation of some of the cryptography that we're
12:16
going to talk about today to extract secrets in ways that the
12:22
algorithms are secure against. So it's a pretty cool field.
12:28
Going into a little bit about like how that process works, I
12:32
think it's important to know for people that haven't done a PhD
12:35
or haven't looked into it. Doing a PhD is often free
12:39
intuitions perspective. So if you just do a masters, you
12:44
might have to pay extra money to do that extra year or two.
12:47
But if you go all into the PhD, you often do a research
12:52
assistantship or a teaching assistantship along with that.
13:10
Speaking of, I don't know, maybe research, but I was looking at
13:13
your LinkedIn profile and there's a reference of.
12:56
So there's coursework. But the main point of all of
13:00
this is just to do the baseline research that pushes humanity's
13:04
knowledge forward. That's that's kind of the goal.
13:08
That's pretty. Being a part of activates DARPA
13:19
and being an Activate DARPA fellow for people who aren't
13:22
familiar with DARPA, that's, I assume the US Defense Advanced
13:25
Research Projects Agency, kind of where Tony Stark and others
13:31
might be creating all the cool stuff, right that that might be
13:35
out there. Can you talk a bit about what is
13:37
first of all, what is activate and then what does it mean to be
13:40
an activate DARPA fellow? What is it?
13:43
Yeah, so it'll probably be helpful to start with Activate.
13:46
They're actually a nonprofit organization that helps PhD
13:52
level scientists start companies because one of the biggest
13:56
problems that they saw were Phd's coming out, getting swept
14:01
up by Intel, Google, Apple, all these big companies and
14:06
effectively their research was dead on arrival, right?
14:09
The only person in the world who knew how to push this research
14:11
forward has now been acquired by these companies who really don't
14:15
want that to get out. They're willing to pay a lot of
14:17
money for it. So it's actually a two year
14:20
program. Mine specifically was funded by
14:23
DARPA. They have others that are funded
14:26
within the clean tech sector by the Bill and Melinda Gates
14:29
Foundation or NSF actually just put out a massive award for them
14:34
as well to support this initiative.
14:36
And it's really an honor to be a part of this super selective
14:40
group of individuals that are trying to do crazy stuff to help
14:43
the world. Sounds like a bunch of geniuses
14:46
figuring stuff out, which is kind of cool.
14:48
Now you you founded a company called Revive Labs.
14:53
What is that? Yeah, so Revive Labs, our goal
14:57
is to get rid of the phone number as the baseline fall back
15:03
for everything in your life. So if you can imagine, phishing
15:08
attacks are very much a day-to-day occurrence within the
15:12
identity space. We are working to make a
15:16
cryptographically secure back end that credential managers and
15:20
other passwordless focused systems can help to get these
15:25
keys back in case of failure. And like I said, we we
15:29
originally started out in the cryptocurrency space where
15:32
there's I think $4 billion lost last year and there's something
15:37
like 20 plus percent of the total Bitcoin supply is just
15:42
gone forever because people just can't access it anymore.
15:45
And that's that's a very real reality that's starting to come
15:48
up in other situations. Andrew, I thought we could maybe
15:52
start with a bit of a history lesson.
15:54
So I mentioned I like watching these history documentaries, was
15:57
watching one on the Enigma, which is a cipher.
16:01
And that's kind of, I thought it would be an interesting context
16:05
to get into cryptography and you know, the need, the way it was
16:10
in the past and how that's transitioned to where we are
16:13
today in the world of computing. Yeah, absolutely.
16:18
Enigma was obviously a very substantial development in the
16:23
course of cryptography. So prior to that, a lot of
16:29
cryptographic systems required people to meet up in person to
16:35
transfer information in a encrypted way.
16:39
So let's say I want to send Jim a message that I don't want Jeff
16:43
to be able to read. Jim and I would need to come
16:45
together at A I don't know, we'd meet at some bar, we'd exchange
16:50
these super secret one time passcodes and say this is what
16:53
I'm going to encrypt this with. We jumble the letters in a
16:57
certain way and then effectively we can communicate in secret.
17:02
Even if Jeff gets our letters, he can't figure out what theck
17:05
we're saying. The Enigma machine was very
17:11
interesting because they actually had a physical machine,
17:15
so this wasn't handwritten. You didn't need to do this math
17:18
by hand. It's like a calculator, just for
17:21
encrypting things. And they used these mechanical
17:27
parts to actually shift, rotate, swap characters to be whole new
17:33
words, phrases jumble this information.
17:37
And it it started this race for kind of how secure really are
17:42
these algorithms that are used to actually communicate, and can
17:48
you do these things without having to directly meet up in
17:52
person and distribute them widely to, for example, your
17:56
entire military force? Yeah.
17:59
And and so my understanding of a cipher is, you know, one of the,
18:03
I think great examples would be like the movie The Christmas
18:06
Story where Ralphie gets that that secret decoder ring
18:10
basically just shifts. You know, some interlocking
18:15
circles of, you know, A is E and then B is F, etcetera, etcetera.
18:22
My understanding with the Enigma was that it was multistage
18:25
encrypted, right. So it shifted, and then it was
18:27
shifted and it was shifted again.
18:29
And this was a tool that the Nazis had, was this Enigma.
18:34
And somehow. The Britain was able to get
18:39
actually one of the machines. So they were able to decode all
18:42
these messages by retyping them into the machine on the decode,
18:46
which I I think it's just an amazing part of history because
18:50
you think about this war happening.
18:53
They think the Nazis think they are sending encoded messages or
18:57
encrypted messages and they could all be decrypted.
19:00
Absolutely. And that intelligence was
19:02
critical to ending that war, right.
19:06
And it's it's super interesting to see how they were able to go
19:10
through and actually reverse engineer the entire machine so
19:15
they could figure out what the key was that they needed to
19:20
actually set up inside of the Enigma machine.
19:25
So for those that are unfamiliar, they have different
19:29
settings with knobs and plugs that basically you could
19:32
configure the machine to act in a certain way and that's really
19:36
equivalent to some of the the private keys that are baselining
19:41
all of this cryptographic stuff that we have today.
19:44
I think that gives us kind of a a couple of the major concepts,
19:48
right? And so now we still have these
19:50
problems, but now they're on a much grander scale in terms of
19:55
the computing power and the. The need to encrypt at a much
20:01
greater level and so I want to start off with kind of some some
20:06
basics and you know the the word encryption kind of what is
20:11
encryption and you know also I heard the term encoding a lot
20:16
and I wonder if you could explain the difference between
20:19
encryption and encoding. Yep, absolutely.
20:22
They there are a lot of words in the space that sound very
20:25
similar and they're very different.
20:27
But encryption is effectively that process of taking a piece
20:34
of information can be a message, a document, whatever that you
20:38
want to send to someone else, or store in a secure manner and
20:43
effectively jumble up the pieces of information so that somebody
20:48
that just comes across it, whether it's a man in the middle
20:50
attack or you just leave it sitting on a table.
20:53
If it's a piece of paper, nobody can actually get that piece of
20:57
information out without a specific key that will be able
21:02
to decrypt it. So encryption has two parts,
21:06
right? Encryption and decryption.
21:09
So encryption takes your plaintext thing in, makes this
21:14
what they call a ciphertext, which is this jumbled up piece
21:17
of information, and decryption is the process of using that key
21:21
that you have for the decryption process to get your plaintext
21:26
back. On the other hand, encoding is
21:28
really just a way for people to place information in ways that
21:37
are helping out the specific system that it needs to
21:40
interface with. So something like a in the
21:44
identity space, right? You have these things like a PM
21:48
file, right? You'll see keys are often stored
21:51
in these things and you need to upload them into different
21:54
portals on the Internet. That's just one specific
21:59
encoding scheme. There are ways to change the
22:03
encoding scheme because all of the information is just sitting
22:06
in plain text. But maybe 1 system wants to read
22:08
it in this Pam file. One wants you to just copy and
22:12
paste this text into the weird fields that the system needs.
22:16
Maybe it can work with the CSV file, so just separate it by
22:19
commas instead of with this specific metadata in front of.
22:24
It so the encoding is not really the intent behind encoding is
22:29
not to make it hard to read, it's more to make it more easy
22:35
for the machine to process. Oh wow, OK, I actually didn't
22:40
know that. So when we hear about
22:43
encryption, we hear symmetric encryption, asymmetric.
22:48
And I think you made a good point.
22:49
It's encryption and decryption, right?
22:51
But for the sake of making it simple, just symmetric and
22:56
asymmetric encryption, can you explain the difference between
23:01
those or what those two things are?
23:03
Yeah, absolutely. The encryption and decryption
23:08
part is actually very important for this point.
23:11
So for symmetric encryption algorithms, you have one key
23:16
that is able to both encrypt and decrypt that piece of
23:20
information. So if if you have, you know
23:25
whatever bits long key you shove it into the system, there's one
23:30
way that that key will encrypt it and the same key will be used
23:34
during the decryption process. Asymmetric though has two
23:38
separate keys there, one is used for that encryption process and
23:43
the other one is used for the decryption process.
23:46
And having two separate keys seems kind of odd from like a
23:52
baseline standpoint. But when you're talking about
23:55
making systems that can communicate without needing full
23:58
trust in the entire system, right, This whole, I don't want
24:02
to meet up with Jim in person thing.
24:05
I want to send this over the Internet.
24:06
I want a key that I can have anybody in the world know.
24:10
And then I want the secret one that I can only get information
24:14
back from Jim. So it's kind of like I can set
24:17
up a post office mailbox outside of my house and then the person
24:23
with the right key can, you know, do things with it.
24:26
Used an interesting term there and this is our fifth grader
24:30
opportunity. You talked about keys.
24:33
Is it like the key that opens the door to your front house?
24:35
I mean or front door? How do you explain these keys to
24:39
the 5th grader? Yeah, so the the 5th grade
24:44
explanation. Often it is good to go with like
24:47
relative examples to how you get into a house, right?
24:53
We'll say exploring different opportunities within the digital
24:57
space. Every key is just a bit, a
25:00
number of bits, so just zeros and ones.
25:04
You'll often see encryption algorithms listed like Shaw 256
25:10
or AES 256, RSA 2048, these kinds of things.
25:16
That big number at the end is often just the key length.
25:20
So how many bits do I need as my key to actually operate this
25:24
this function? So is KEY a synonym for
25:28
certificate? I know we're going to talk about
25:31
certificates in a little bit, but I like, but I just, it
25:35
sounds to me that it's kind of the same thing.
25:38
Keys are definitely related to certificates, but they're not
25:41
the same thing. One thing that's good to know
25:46
about certificates is that they have a lot of different fields,
25:49
right? So we talked about encoding.
25:51
There are certain ways to have information laid out right, and
25:56
a certificate often has a standardized way of looking so
26:00
that your browser, for example, can read it.
26:04
And one of the things if you click into your browser and look
26:06
at what the certificate is, it'll actually give you some of
26:11
that information. So it'll have a public key for a
26:15
specific provider directly in that certificate.
26:20
Likewise, if you have a certificate on a user's device
26:24
that authenticates them within your corporate network, that's
26:27
gonna have different information but still a similar format.
26:32
So it'll it'll provide a way and context for that specific piece
26:36
of information as to how all of this should link up within this
26:39
larger like infrastructure that's built around it.
26:42
It sounds a little bit like certificates.
26:44
Sort of like a combination of encoding and encryption to some
26:48
degree, right? Am I getting that correct?
26:51
Yeah, certificates definitely have encoding.
26:54
They definitely have keys for encryption, and they also have
26:59
hashing in there as well, which I'm sure we can get into.
27:03
The encryption itself is, as I understand it, is basically just
27:05
a math problem, right? They're different types of
27:09
encryptions are different types of math problems, problems.
27:12
And you mentioned at the end the bit length being how strong I
27:16
guess. How strong is that math problem
27:18
that needs to be calculated and figured out.
27:21
So. Is that correct?
27:23
And then what does it mean to break an encryption?
27:26
Yeah, all those are loaded questions.
27:29
I'll start with the, like I said, the numbers at the end of
27:34
the algorithm often are just the the key length that's required
27:38
for that algorithm. The massive caveat on what I'm
27:42
about to say is that key length is not necessarily indicative of
27:48
how strong your encryption is. So for example, if you take
27:53
something like a ES which is a symmetric key cipher, and then
27:59
you compare it to RSA which is an asymmetric key cipher, 128
28:05
bit a ES is roughly equivalent to 248 or 2048 bits of RSA.
28:14
So 20 times the key length in RSA is about the same as 1X in.
28:22
Yes. OK.
28:24
So when we say the different types of encryption, sorry, I
28:26
just want to, I want to make sure I understand that.
28:28
I feel like I'm in class asking questions.
28:30
So when we talk about encryption, it's not so much the
28:35
bit length like you mentioned, but the type of encryption
28:38
influences how complex that bit length needs to be.
28:41
So the way I'm kind of thinking about it is, OK, well, you can
28:43
have a very long bit length, but if all the answers are either
28:46
yes or no, eventually you can figure that out pretty quickly
28:49
compared to. Maybe something that's like
28:51
hexadecimal or binary or other things like that, right?
28:54
They have more values for each bit, is that?
28:58
Am I thinking about that right? Yeah, absolutely.
29:01
There. There's a few different places
29:04
that you're you're combining a lot of ideas and they're all
29:06
going in the right direction. I love it.
29:08
So effectively, the algorithm itself can be vulnerable to
29:13
different pieces of the key space discussion.
29:18
So maybe there are easier things to figure out within that key
29:22
space. Maybe there's not just only one
29:24
right answer for every one key that goes in, which is something
29:27
that you really, really don't want to do right?
29:30
You might have two to the power of 2048 bits combinations for
29:36
this output, but maybe it's just oh OK, half of them have the
29:41
same output. That's just a bad cipher.
29:44
It doesn't doesn't necessarily mean that your key is providing
29:47
extra security. That being said, the actual
29:51
algorithms that you use of of the newer ones that have come
29:56
out. So AES for example is very
29:58
common, but today you'll often see AES 256 being the bare
30:03
minimum that people use. And that's specifically because
30:08
computers are constantly getting better at breaking these things.
30:12
So when you're talking about breaking the most common, the
30:16
way that people explain this is just how hard is it to brute
30:19
force break this combination. So if I, if I run a brand new
30:25
GPU, load up all those cores and try to, you know, track your
30:30
password, how long is it going to take?
30:33
Or if I iterate through all if you're only using like 64 bit
30:38
encryption, I can do that in a few days or even sooner,
30:43
depending on how good your hacking tools are.
30:45
But once you move into some of these crazy things like elliptic
30:49
curves and all this cool stuff that's coming out, there's some
30:54
wildly difficult challenges for these computational devices to
30:58
solve. Yeah, on both ends, right?
31:00
You have to wildly compute the encryption and wildly decompute
31:07
the decryption. You know, I wanted to run
31:12
through, you know, a couple of. Real world use cases for where
31:17
you'd use symmetric or asymmetric and let me throw out
31:21
the ones I think I'm going to or you say So something like a for
31:26
asymmetric would be like where you have a public key that's
31:32
shared between both ends of the communication.
31:36
So something like the Internet, something like a encrypted
31:40
website. And a symmetric might be where
31:43
you're like encrypting your hard drive or using something like a
31:49
zip or something like that. So am I right?
31:53
And what are some other, like really good examples?
31:57
Yeah, no, all those examples were spot on.
31:59
So if you try to log into your bank, for example, online, they
32:04
have a private key that only they know, and you will
32:09
authenticate into their system using the public key that they
32:12
distribute to everybody, right? Everybody should be able to come
32:14
to the website, but only they should know the answers to the
32:17
questions that you're putting in, or be able to start that
32:20
communication back and forth. One of the interesting things is
32:24
actually how asymmetric cryptography is usually more
32:29
computationally expensive, so it takes longer to run these
32:32
things. So when you're working over the
32:35
Internet, you're actually using both asymmetric and symmetric.
32:39
So you use asymmetric to get that initial session started.
32:44
But once you have a session going, you can use something
32:47
like RSA or something that faster to transfer all of the
32:52
secure data you need to push back and forth through that
32:55
pipe. And that that computation
32:59
limitation is something that's constantly on the minds of some
33:03
of these larger organizations that have to push a lot of data
33:07
through to their customers. Just do we want to upgrade and
33:11
double or triple or 10X our CPU usage?
33:14
Or do we want to run things faster, cheaper, Get things
33:19
going? Well, the other thing is like I
33:20
would assume the user experience would get a lot worse if people
33:23
were having to wait for the output of the encryption.
33:28
Yep, 100%. So you mentioned a few
33:32
different, a few different levels of encryption.
33:38
One that I hear about a lot is like Shaw.
33:42
So how important is it for I am practitioners to understand
33:46
them? What are some of the big ones
33:49
out there and kind of what are some of the main guidelines like
33:52
these ones are good, these ones have been shown to be broken,
33:56
things like that. I think that Shaw is a good lead
34:00
into what hashing is since there is a difference between
34:05
encrypting something and hashing something.
34:08
So like we were saying about encryption, you want to pass a
34:11
message and you want to be able to decrypt it later.
34:14
Hashing gives you that same looking random jarble nonsense
34:19
so you can't see what you put into the system, but has no way
34:24
of getting it back. So they call it a one way
34:26
function. So I put some nonsense in it.
34:30
It makes the Super crazy unreadable thing.
34:36
And oftentimes they'll use that for in the password kind of
34:40
identity space, right? So I want to put my password in.
34:43
I want you to know that I I had, I typed the right password in,
34:46
but I don't want you to store my password on your server because
34:49
that would be really stupid as we've seen from a lot of hacks
34:51
that have happened over the past few years.
34:53
So getting into Shaw right? Like Shaw one supplanted this
35:00
thing called MD5 which was a prior hashing algorithm, and
35:06
Shaw one is also now compromised and you got to go to Shaw two.
35:11
And Shaw 2 uses at least 256 bits of key space for their
35:16
implementation, right? So within these hashing
35:20
algorithms, you want to make sure you don't have these things
35:23
called hash collisions, and that is when you can put two separate
35:27
inputs in and get the same output.
35:31
So thing about that, I put in my password and then Jim puts in
35:35
some other password and they happen to be the same.
35:38
I don't want both of those answers to give me the same
35:40
output because I wouldn't want to let both of us in.
35:42
Let's see different passwords. So take something like SHA 3 and
35:46
then it's usually followed by a number like 256.
35:49
So break that down for us, is it?
35:51
Am I getting this right Shaw Three is the algorithm. 256 is
35:56
the length of the key that you use to do the the encryption or
36:02
the hashing. Yep, absolutely so.
36:05
Why not just do Shaw 31 million? Most of that limitation comes
36:12
from how long do you want to wait for your website to load?
36:16
Kind of a deal, right? I don't want to sit around for
36:18
10 minutes to start listening to this podcast.
36:21
I'm sure it'd be great, but that key needs to go real fast or I
36:25
need to be able to log in really fast.
36:26
So a lot of providers are very aware of that.
36:30
Even though there might be Security benefits, it it totally
36:35
depends on the system that you're building.
36:39
Because the way it works is like you are.
36:43
You type your password in. It's been hashed in some kind of
36:47
data store, right? So it's.
36:49
A block of characters that look nothing like your actual
36:54
password, and it's got to run it through the same hashing
37:00
algorithm it would run it through to write it to the data
37:02
store in order to verify it's correct, and if it's not
37:07
correct, it just says incorrect. Is it?
37:09
Does it work the same way with any kind of biometric?
37:14
Where it basically turn, does it turn your face into a number or
37:18
your thumbprint into a number and then hash it and put it into
37:23
a data store? Yeah, the concept is very
37:26
similar. And you'll actually, if you
37:30
think about when you set up a new phone or a new device that
37:33
has these biometrics, they always ask you to set it up
37:38
again, right? They they won't carry over your
37:41
fingerprint or carry over your face or whatever you're using to
37:45
authenticate. So each system has their unique
37:50
way of processing this and make sure not to transmit, let's say,
37:54
your face to apples so that they can identify you anywhere in the
37:57
world. Biometrics is a slippery slope,
38:01
but effectively yeah, it trans. It transfers your face into a
38:06
key and they have some some process of having certain amount
38:10
of confidence that you are in fact you.
38:12
So I'd like to bring us into, I think one of the maybe
38:16
fundamental and, but it's more of like the architecture of how
38:19
this works. But let's start.
38:21
What are certificates? What's Certificate Authority?
38:26
And what's a Public Key Infrastructure?
38:29
Yep, certificates. I'm sure all of your listeners
38:32
use certificates on a regular basis, whether they need to
38:36
update them, insert them for single sign on their websites or
38:40
whatever. So the certificates actually a
38:46
approved document that is issued by a certificate authority.
38:51
And these certificate authorities as you mentioned,
38:55
play a role in this larger Public Key infrastructure or
38:59
PKI. So these certificate authorities
39:03
are trusted entities within the the network, whether it's
39:08
Microsoft, if you're using like Entra or Azure AD or one of the
39:15
other providers, or if you're on the Internet scale, right?
39:18
You can find these different providers just by looking into
39:23
the certificate that's loaded in your browser right now.
39:26
And what happens is they go through and act as a trusted
39:31
third party for whatever communications going to happen
39:34
over the network. So they do the legwork of
39:38
saying, okay, I know Jim's organization is real.
39:42
I have validated that. And I'm going to put my, you
39:46
know, money where my mouth is an issue.
39:48
The certificate that proves that this was issued by me, this is
39:54
approving this specific individual or organization for
39:58
use of this product, and this is how you can communicate with
40:02
them securely. So part of what's included in
40:06
the actual certificate is a public key that people can
40:11
verify using the certificate authority that will help you
40:15
establish secure communication to that entity.
40:20
And the other half is actually a hash of the full certificate to
40:24
make sure that nothing's been tampered with.
40:27
And just like we talked about in the password example, you want
40:30
to make sure that the certificate has the right
40:32
information in it and that it's been signed by the certificate
40:35
authority that it is authentic. So I want to throw a few things
40:40
out there and you tell me what they are.
40:43
Certificates, CAS, Pkis or something else?
40:46
So in iOS land. Or Apple and we have keychain.
40:52
Keychain is a password manager at the highest level.
40:57
So it doesn't have. It doesn't.
40:58
It's not a certificate authority, no, no.
41:02
It just stores credentials. What about GoDaddy?
41:06
GoDaddy is in between between you and the Internet, right?
41:10
I wanna go buy a domain. They work with Certificate
41:14
authorities. I don't.
41:16
I don't believe they are a certificate authority, but I
41:19
know that a lot of the like larger organizations like if you
41:23
go to Microsoft or Google, they often are their own certificate
41:27
authority and there's processes for doing that.
41:31
And there might be reasons that you would want to do that for
41:34
controlling your own infrastructure.
41:37
But GoDaddy, for example, provides access to the Domain
41:43
Naming Service, which DNS right you want to type in a web
41:47
address and resolve it to something, as well as often
41:51
providing integrations with people that can install SSL, TLS
41:56
licenses or certificates should I say?
41:59
So the next one we wanted to throw out there because we've
42:01
been seeing this notation or naming.
42:06
X509 like, How did that? That's such an odd name to me,
42:11
but what are X509 certificates and how did they get that name?
42:15
X509. I'll just say, all of these
42:19
things have super complex names for seemingly no reason, just
42:26
because they're built by a bunch of nerds that can only think in
42:29
numbers, right? So X is a cool letter and then
42:32
you got like this, this family of certificates or standards
42:36
that you have to appease to. So X 500 is a series, right?
42:41
And then you have X5O9, which is the ninth thing that they did.
42:45
So there there's actually like a international standards body
42:50
that that came up with this thing.
42:52
And yeah, asking for rationale as to why things are that
42:57
specifically gets a little bit more complicated.
43:02
So, so the certificates have an expiration date built in them,
43:07
right? And I understand, I think the
43:09
purpose of the expiration date is if they get fumbled, they
43:13
get, you know, somebody gets a hold of them who shouldn't have
43:16
them, eventually they'll expire so they can run with them for so
43:20
long. Is that correct?
43:23
Yes. Most most operating certificates
43:26
for like websites are about a year.
43:28
Right now and so that was my lead into a listener question.
43:32
So Mike Woodburn submitted a question.
43:36
What are your thoughts on Google's 90 day certificate
43:40
expiration plan? That's a great question.
43:43
I think there are a lot of different ramifications for what
43:47
that means. I'll just say baseline security
43:50
improvement, having faster removal of expired certificates
43:57
will be better, right? So if there is something that is
44:00
exposed for a certain amount of time, the remaining time that
44:04
you have left in a year versus the remaining time left in 90
44:07
days is significantly improved. Similarly, when you're thinking
44:12
of Quantum coming in, you'll want to actually be able to
44:15
upgrade the system a lot faster. So some certificates out there
44:20
are still supporting older protocols that can't actually be
44:25
used securely. And you'll start seeing these
44:28
like red lock logos that like they're kind of OK, but they're
44:33
like getting depreciated. So I think Google's really
44:36
interested in moving that forward.
44:38
But looking a bit broader at what this is going to do, it's
44:43
going to force a lot of the manual processes that are in
44:45
place at a lot of organizations to get upgraded to automated
44:50
operations. So if you can do something once
44:54
a year, like, it's still a giant pain if you have like hundreds
44:57
or thousands of these things. But personally, I can manage
45:01
upgrading my own certificate once a year, right?
45:03
I put a calendar thing in and it's good.
45:06
I'll say there's also downside to that.
45:08
Microsoft I think recently had two different occurrences where
45:12
they had outages caused by an engineer not changing this.
45:17
Like literally if you forget to see this calendar notification
45:21
you're going to have you know Azure go down or something
45:23
sounds bad. So moving to a 90 day schedule
45:27
is going to get really unsustainable for that model.
45:30
So you need to automate a lot of these systems to upgrade
45:32
automatically, stay current pipeline and whatever upgrades
45:37
will need to get pushed in. Which is not going to be a small
45:42
effort, but I think long term, when you look at how fast things
45:46
have evolved since the Enigma days, things are things are
45:50
about to get crazy. I immediately thought when you
45:53
when you started to answer the question around the overhead for
45:56
administrators and say okay, yeah once a year, get it.
45:59
Even still with once a year people forget to forget to
46:02
extend or replace the certificate and now we're time
46:05
by doing it 4 * a year, which that is administrative overhead
46:08
for sure and keeping track of that.
46:10
So definitely trying to automate I think the certificate.
46:14
Life cycle is probably a good pick.
46:17
You talked about Quantum and I think that's how we kind of want
46:19
to wrap up this discussion because well, first of all, I've
46:22
learned a lot. Second of all, am I going to
46:25
have to unlearn all this when Quantum comes along?
46:28
Because if you if you listen to what people are saying out there
46:32
and like headlines which are probably click bait to begin
46:35
with anyway, Quantum's going to break all of this and we have to
46:39
come up with new. Novel, whatever word you want to
46:43
use right ways to get into the quantum encryption space.
46:49
As I understand it right now, it's very expensive to do
46:51
anything in quantum right now, but it is starting to take root.
46:54
You've got large organizations and probably nation states that
46:57
are looking at quantum as sort of the next level for that.
47:02
Can you talk a little bit about how does this conversation we're
47:05
having around encryption really get affected by the quantum
47:11
space? It's a very, very good question.
47:14
It quantum the the threat of quantum has a lot of people
47:19
scared in in the cryptography community, namely because when
47:24
when you talk about key spaces or like how hard these
47:27
algorithms are to break today when you look at 256 bit AES,
47:34
the key space is 2 to the 256, which is insanely large, right?
47:40
Like we're talking like numbers of atoms in the universe or
47:42
number of stars and multiple galaxies, right?
47:46
Like it's a huge, huge number. The quantum threat is really,
47:54
what if we could have a superposition of 1 and 0 at the
48:00
same time, and we're going to check all the numbers at the
48:03
same time. So instead of breaking the whole
48:06
thing, I only need to break one bit of your encryption and I'm
48:09
going to do it 256 times, which with most of the algorithms,
48:17
data transmission protocols we're using today, that's going
48:20
to be a real bad thing. Yes, the headlines are a little
48:24
bit wacky. These systems are still super
48:27
unstable and very, very expensive.
48:29
So like, Google has one and it needs to work at like cryogenic
48:33
temperatures. It's not like walking around in
48:35
your pocket. But for me, the real scary thing
48:39
about Quantum is that people are already starting to store
48:45
information now that they want to break later.
48:50
So you'll see nation states actually harvesting this
48:53
information and say I want to know the secret information that
49:00
Microsoft's passing over the secure channel.
49:03
What if I could reverse engineer that key?
49:06
That would be great for them, but in terms of what your
49:11
listeners need to know with cryptography, what we've talked
49:16
about today, nothing's really going to change except for the
49:19
exact algorithms that you should be using.
49:24
And a lot of times those things are already described in
49:26
documentation or like Microsoft will have list, or Octa will
49:32
have a list say please change these settings from Shaw one to
49:35
Shaw 3, right? It's just a configuration
49:39
change. So especially when you add in
49:42
some of these automation things, that should be fairly painless
49:45
to upgrade the knowledge in that space.
49:48
Are there certain encryptions that are more resistant to
49:51
quantum? Or because the way quantum
49:54
works, it just it's not going to matter?
49:57
No, the algorithm actually dictates kind of how susceptible
50:03
they are. So some algorithms are dependent
50:07
on like factoring super super large numbers, which is really
50:12
really hard for computers today, but for quantum computers might
50:15
be really really easy and some. So elliptic curve cryptography
50:23
you can look look into that buzzword, you'll see a lot of
50:27
blockchain stuff there. They use some of those
50:30
algorithms, but basically they were put there to try to avoid a
50:35
lot of the headache that's going to come with quantum.
50:39
And obviously things improve over time like these will not be
50:44
secure forever, but they are in fact stronger against these kind
50:51
of quantum systems that will be coming online.
50:54
So what should I be doing as an IEM person to prepare for this?
50:59
To prepare for quantum? I think it depends on what your
51:04
role is within the organization. If you have the ability to
51:10
dictate what your stance looks like for your organization and
51:15
kind of push for why we want to try to push towards automated
51:19
systems, try to have upgrade pass within like version
51:24
controls to get things moving a little bit faster.
51:29
I think it's it's really important to be flexible and not
51:34
lay around too long on legacy infrastructure that a lot of
51:39
people have been doing thus far. It's not so much in terms of
51:44
what you need to learn, it's just that you can be agile
51:46
enough to survive the next wave. And start automating some of the
51:51
manual stuff going inside. Yeah.
51:53
It seems to me, Jeff that you know with the point that Andrew
51:56
was making earlier that. Some nation states are really
52:00
anybody. Could be capturing packets and
52:03
storing them until they could break them later.
52:06
You could be capturing packets where people are sending their
52:10
password over an encrypted channel.
52:12
Maybe one of the things, and not just passwords, but
52:17
authentication secrets overall. Making sure that those are
52:22
getting changed. I know we've been arguing
52:25
against changing them on a too frequent basis because that's
52:28
the NIST recommendation. But if you have that and the
52:32
quantum computing capability comes along within the next
52:36
decade and it's commercially available now, you're
52:40
potentially in trouble if you still have authentication data
52:43
that is 10 years old and someone captured it.
52:48
It's probably depends on what industry you're in.
52:50
But if you're in the industry of like you know nuclear power
52:55
generation or you know Defense Department or government period
53:01
versus if you make Donuts you you're probably in two different
53:06
two different. It could.
53:09
I mean, when we all love to be able to make Donuts at home.
53:14
Yeah, I'd be even more even more round than I already am.
53:16
So maybe not so good. Maybe that's not a good idea.
53:19
Maybe not together, yeah. Angie, you bring up a really
53:22
important thing that I think maybe not everyone thinks about.
53:24
Is that collection of data, right?
53:27
Even if you can't break it today, well, I'm just going to
53:29
tuck it away here in this folder and someday maybe I will be able
53:33
to. Is there anything you can do
53:35
about that if the data is already gone and it was
53:38
encrypted in a certain format? Short of changing every piece of
53:42
data that might have been associated with that stolen data
53:44
set, I'm not sure if there is a defense for that.
53:47
Yeah, it's it's a little doom and gloom in terms of that data
53:50
being out in the open. I I think what lets me sleep
53:55
pretty easily at night is just knowing that what I'm doing now
54:00
and what I will be doing in 10 years from now will probably be
54:03
totally different, right? The the pieces of code the even
54:09
if it's proprietary information that's fed over a network,
54:13
unless it is at at like what you're saying a government level
54:17
and that's why you have some of these more extreme standards
54:20
that are pushing for higher security tolerances today, it it
54:26
really shouldn't matter to you that much, right.
54:29
And by the time we get there if we can succeed with a lot of
54:32
these automations, I I think we'll we'll have enough of a
54:36
flow to kind of keep the system moving right.
54:39
It's a constant, it's a constant struggle between the attackers
54:43
and defenders, but as a as an individual, I'm not too
54:46
concerned. I think the only government
54:49
agency that that should be concerned was probably the one
54:52
called Kentucky Fried Chicken and their Colonel Sanders with
54:55
their secret blend of herbs and spices.
54:57
So hopefully they're on top of this.
55:00
Yeah, that hasn't changed in 100 years or something, right?
55:03
Yeah. And it's secret or like the
55:05
Cocacola recipe or something like that, right.
55:07
I think those are things that are interesting.
55:10
All right, let's wrap things up here for the conversation.
55:13
Andrew, you've been? Extremely informative.
55:16
I I know this is such a difficult concept to try and
55:19
crack within the span of you know, 45 minutes to an hour.
55:22
But I feel like we got a pretty good start on it.
55:25
I do want to end on a lighter note and I find it interesting.
55:28
We're kind of talking before, you know, I was like oh so
55:30
Andrew, like you know what do you in your spare time what do
55:31
you have fun. You mentioned pickleball and
55:34
then you mentioned something of course that piqued my interest
55:37
which was playing competitive games and you mentioned a game
55:41
called Splatoon that I know of. I'm.
55:43
I am almost. Positive that Jim has no idea
55:46
what Splatoon is. Can you talk a little bit about
55:49
first of all, what is Splatoon and then when you say
55:52
competitive, define competitive in that.
55:56
In that context, yeah. So I've actually had the
56:01
pleasure of trying to describe Splatoon to a lot of people
56:05
because it is not a normal game, right.
56:08
At its core, it's a third person shooter.
56:11
So you it's a shooter game, You just don't have their
56:14
perspective. You look over, it's at their
56:16
shoulder, but it's basically paintball.
56:21
So your objective is to often cover more of the map and your
56:26
color of paint than your opposing side.
56:29
There's also you can like blow people up, right?
56:33
There's the whole shooter aspect of it but the the wild part and
56:38
why a lot of people just like turn the game off as soon as
56:40
they figure out it's it's a game is it's based on human squid
56:46
hybrid people so you can like climb walls sink into like the
56:52
they call it ink instead of paint and like swim through your
56:55
own color. It's it's a pretty cool like Z
56:59
axis breaking game and in terms of why I say I played
57:05
competitives Latoon. I actually joined the team back
57:10
in 2015 ran with that team for about a year and spun out my own
57:15
team from like the the you know top tier players on that one and
57:20
formed a new team that was based in the US and Europe to to try
57:28
to play this out like a really really high level while doing a
57:30
PhD. Because you know I'm crazy and
57:35
we, I I only say competitive and I don't like saying professional
57:40
because nobody that plays platoon is a professional right.
57:42
Like you cannot make enough money to actually do this as
57:46
your career without massive like YouTube sponsors or Twitch
57:50
sponsors but it is a good time. Still play casually now, but
57:54
definitely not. Not the same time commitment
57:56
that I had before. I fall into that category of I
58:00
picked it up, I played a little bit and I was like oh boy.
58:03
Either I felt like, OK, OK I used to be good those kind of
58:06
games. So.
58:06
So back in my day it was things like Goldeneye, like I ruled at
58:10
Goldeneye, like that was just that was my jam and it was
58:12
amazing. Halo was also pretty good at,
58:15
but I found as I get older I just suck at those games now and
58:20
I just I I'm just not as good as it used to be.
58:22
And I got really frustrated with that whole, you know, Z axis.
58:27
There's the guy in front of you. Great.
58:28
I've got a shot. And then what happens is they
58:31
duck basically. Right.
58:33
And okay ducking is fine. It's not they just duck though.
58:36
They disappear, Jim. They go like into the ground,
58:39
into the into the ink that is kind of spread all over, which
58:42
is a very cool concept. I think it's fascinating.
58:44
I I stink at it. But I do enjoy kind of watching
58:46
that kind of stuff. Jim, you've you've kind of heard
58:49
the the definition or at least the description of a Splatoon.
58:52
What's going through your head right now?
58:54
Are you trying to decrypt? The answer from Andrew and and
58:58
reencrypt it. No, It's like sitting here like
59:01
feeling kind of anxious, like, OK, what questions Jeff going to
59:04
ask me about my favorite video games?
59:07
And I'm thinking, OK, like, well, I used to like, I used to.
59:11
I worked in an arcade in high school.
59:15
So yeah, but you know, the games that I remember that I love the
59:18
most for games like Spy, Hunter and Frogger.
59:22
Worker time centipede. Yeah, yeah, yeah.
59:25
Now you're now you're on to it. Yeah.
59:28
We had the we had the axe throwing competition.
59:30
Part of the place was they had like, old school video games,
59:34
but there's so many of them that were broken.
59:37
I'll say just, I'm like, oh, I love this game.
59:39
Oh, wait, it doesn't work. Yeah, they'll let you know, just
59:43
like in the olden days. The the joystick might work up
59:47
and down and to the right, but not to the left, which is
59:50
probably moved to the right and once you get to the right of the
59:53
screen the game was over. The first game I walked over to
59:56
was the original Street Fighter, which is a fighting game.
59:59
And I was like, all right, I'm going to, I'm going to pull, you
1:00:01
know, Canon or or write you out here and start doing my
1:00:05
fireballs and dragon punches. And the bottom right did not
1:00:09
work. So you can't do any of his moves
1:00:12
without that that combination. So I went back to ax throwing
1:00:15
instead. But yeah, yeah, for those of
1:00:20
people who are interested, there is a really cool pinball museum
1:00:23
here in Asheville, which is the the area that I live in.
1:00:27
And they have a bunch of like, old school pinball things.
1:00:29
And Jim, you'd probably like it a lot because, well, you're an
1:00:31
old man and you like that kind of thing.
1:00:35
But yeah, it's, it's, it's a cool spot.
1:00:36
And they've got some of those classic games in the back as
1:00:38
well. I am currently, as of my last
1:00:40
check the the top ranked Time Pilot Arcade cabinets
1:00:45
scoreholder right now, which is not saying a lot because I
1:00:48
played it once and they must reset it very often.
1:00:51
But when I left, I was the number one high scorer on Time
1:00:54
Pilot. I feel like when I was really
1:00:56
into pinball, usually there'd be an ashtray on the pinball
1:01:00
machine. So and and some of these pinball
1:01:03
machines do have that. I mean, these are some really
1:01:05
old and interesting ones. It's it's it's it's a museum and
1:01:10
they've got maybe 30 to 50 different machines of different
1:01:14
ages and stuff like that. So it's kind of cool to see that
1:01:17
there's one old one that is a baseball one with two player.
1:01:21
One player basically pitches the pinball down and the other
1:01:26
player is the batter and has to hit it out somewhere.
1:01:30
And it's basically like an outfield, but the outfield
1:01:33
changes every pitch. So you can't just keep hitting,
1:01:37
you know, home runs because you're getting the timing down
1:01:40
is you actually have to aim and get your timing down of your
1:01:43
flipper to get the ball out to the appropriate spot.
1:01:46
I like it. Yeah.
1:01:47
It's very, it's very and it's it's it's old.
1:01:50
I don't know how old. I want to say it.
1:01:52
It seems like it's like 50s, maybe 40s, but it's kind of a a
1:01:56
a cool. It combines 2 things that are
1:01:57
like baseball and old and old. Andrew, tell me about.
1:02:04
So this team that you created while you're going through a
1:02:07
PhD, which is absolutely nuts, dude, Like, what are you doing,
1:02:10
man? You took the best players from
1:02:13
the one team and kind of created your own kind of super team out
1:02:16
of that, Sounds like. And this game is on Switch,
1:02:20
right? The Nintendo Switch.
1:02:22
Yeah, the prior the game I started on was actually Splatoon
1:02:27
One. Now they're on Splatoon 3, so I
1:02:29
played all three of them. The first one was on this thing
1:02:33
called the Wii U, which was probably the worst selling
1:02:36
console of all time. Nobody understood it like it
1:02:40
just didn't make any sense. It just like looked like an
1:02:42
addon for your Wii and nobody got that.
1:02:44
It was a whole new console. But anyways, yeah, I effectively
1:02:52
one. Once we moved to the second
1:02:54
generation, I was like, I want to try to, you know, win.
1:02:57
I don't want to. Work in this middle of the low
1:03:01
class. Be happy we played somebody
1:03:02
cool, right? I want to go to those people and
1:03:05
just, you know, shove them in the dirt.
1:03:07
I don't know, like get going in paint.
1:03:11
It's the competitive side and part of why, you know, academia
1:03:15
wasn't for me long term, right? Startups is more fun.
1:03:17
You have to, you have to go work with some cool people.
1:03:20
But. Yeah, it it was a wild
1:03:23
experience to try to find people virtually over the Internet and
1:03:26
build relationships with them. So I'd played with them for
1:03:30
multiple years before meeting any of them in person.
1:03:34
So the whole whole ecosystem was a very interesting introduction
1:03:41
as to what the decentralized, virtual only future thing was
1:03:45
going to look like. And I'm really appreciative that
1:03:50
I spent the time to do that, even though it was at the time
1:03:53
really counterproductive for what I was trying to get
1:03:56
accomplished. It makes a pretty cool
1:03:58
relationship that way. I'm not ashamed to admit I've
1:04:01
played the World of Warcraft for almost 20 years I think at this
1:04:04
point since beta. And there's I've had some, you
1:04:07
know, I've been part of guilds, been part of rating guilds and
1:04:10
done not the professional level that you kind of see today, but
1:04:13
certainly in a competitive server based approach, like you
1:04:17
know, who's going to get the server first on killing at this
1:04:21
time would have been the Burning Crusade.
1:04:23
So, you know, who could take down Illiden first, right.
1:04:25
Those sorts of things. Sort of like when I was primed
1:04:27
in it and my wife and I actually both played and we were both in
1:04:29
this rating Guild and had a good time with it.
1:04:31
And we had guildies that we, you know, talked to pretty much all
1:04:35
the time. And at one point we actually did
1:04:37
meet in real life, a couple of them.
1:04:39
And it was very awkward because I was, I think at the time, I
1:04:41
probably would have been in my 30s and then, you know, here
1:04:44
comes Ben if it was his name. And I can't remember his
1:04:48
brother's name. So I'm sure they're not
1:04:50
listening to this. It doesn't matter.
1:04:51
But, you know, they walk in and one's like 16 and the other
1:04:54
one's like 23. And, you know, we went and got
1:04:57
Mexican food, had a great time, just kind of talked and, you
1:05:00
know, stuff like that. And then that was kind of, it
1:05:02
kind of worked through it. So it is a, it is kind of a cool
1:05:06
community, especially if you can kind of build those
1:05:07
relationships. And it's not just you know, it's
1:05:11
not just 10 year olds telling telling you about your mother
1:05:15
that's what you see typically on sort of like commercials and
1:05:17
stuff like that. Let's go ahead and wrap it up
1:05:21
for this week. Our next conversation is really
1:05:24
going to get more into that quantum.
1:05:26
But we felt like and and Jim had this idea of like okay let's we
1:05:30
need to like set the stage or get the quantum, what the heck
1:05:33
are we even talking about. And it really starts with that
1:05:35
cryptography discussion we had today.
1:05:37
I know there's so much more and maybe Andrew at some point and
1:05:39
kind of come back and continue the education and conversations
1:05:43
as things go along. But I thought this was really
1:05:46
helpful. Hopefully people out there have
1:05:49
enough knowledge to keep up with the next conversation we'll have
1:05:52
around quantum. We're gonna have a whole bunch
1:05:54
of links in our show notes. So Andrew, it'll be your your
1:05:58
your LinkedIn profile, a link to revivebackup.com so you can
1:06:02
learn more about what Andrew's actually doing with all his
1:06:04
smarts and as well as all of the links to the different
1:06:08
conferences and discount codes that we've got for things like
1:06:11
Identity Week, America and Authenticate and Octane and kind
1:06:14
of things like that. So with that, we'll go ahead and
1:06:17
leave it for this week. You can find us on the web, IDAC
1:06:20
podcast.com, on Twitter, at IDAC Podcast, on Mastodon at IDAC
1:06:26
podcast at infosec dot exchange and definitely can connect with
1:06:30
Jim and I send in those questions and those comments.
1:06:34
Don't forget to hit that subscribe button.
1:06:36
That's the the best way and really the only way you can kind
1:06:38
of help us other than just being a listener to help us put out
1:06:40
great content and help us get people like Andrew who answered
1:06:44
the call of cryptography who can help us out with this.
1:06:49
Thanks everybody for listening and we'll talk with everyone in
1:06:51
the next one. You've been listening to
1:06:54
Identity at the Center. We hope you've enjoyed the show.
1:06:58
Make sure to like, rate and review and we'll be back soon.
1:07:02
But in the meantime, hit the website at
1:07:05
identity@thecenter.com and find us on Twitter at IDAC Podcast.
1:07:12
See you next time on Identity at the Center.