6th HLF – Laureate Lectures: Ingredients for Successful Research
Hellman, Martin E.
Martin Hellman: "Ingredients for Successful Research" Looking back over more than 50 years of doing research, I can discern several key “ingredients” that helped me in my work. First, I was not afraid of doing things that others thought foolish, and this was also important in the work of many of my most successful colleagues. Second, I had what Buddhism calls “beginner’s mind” – I did my best work in cryptography when I knew only a small fraction of the relevant math that I now know. Third, I trusted my intuition, rather than rejecting it as “irrational.” This talk illustrates each of these points from my personal experience. The opinions expressed in this video do not necessarily reflect the views of the Heidelberg Laureate Forum Foundation or any other person or associated institution involved in the making and distribution of the video.
 Okay. Are we set up for the next speaker? Wonderful. So the next speaker and last speaker of this year's Heidelberg Lord Forum is Martin Hellmann. He's best known for his work in public key cryptography together with Wittfield Diffie, who's also here, and Ralph Merkel. He received the Turing Award together with Wittfield Diffie in 2015 for fundamental contributions to modern cryptography, which I think is a very good summarization of his achievements. In the course of his work, he had to deal with very different players in academia, in industry, and with government agencies. And this experience got him interested in questions of ethics of research and other fundamental issues. And from this very broad perspective, he will today talk about ingredients for successful research. Martin, we're glad you're here and the floor is yours. Let's see. Set up a tie-up. Stopwatch. Start. So thank you, Andreas, and thank you all. I apologize for getting in the way of your coffee break. So I'm going to talk on ingredients for successful research. This is based on not quite secrets, but kind of secrets that I've observed over 50 years of doing research myself and also my colleagues. And to summarize, this is what I hope you will get from the talk. It's very wise to do something foolish. Secondly, don't run away from things you're afraid of, embrace them. Third, the best time to do research is when you don't know what you want to know. There's mind in Buddhism. Another which we'll have to explain in the talk is embrace the irrational, which sounds very strange in mathematics and computer science meeting. And finally, even great papers are sometimes rejected. So even if you have a paper that's rejected, don't think you should run away. So let me hit the wisdom of foolishness first. How did I come to understand the wisdom of foolishness? Well, my wife. What happened about 30, her name is Dorothy. So about 30 years ago, she had bought a deck of tarot cards. These are fortune telling cards. And she was doing them on the table. And I wondered, what is she doing, this strange woman? We don't believe in things like that. We're rational people. So fortunately, I'd learned enough and I actually asked her, why are you doing this instead of treating her like she was crazy? And she explained that she had some fear of tarot. And this is understandable because the church, not so much today, but 100, 200 years ago, made anything that was at all mystical, anything irrational, was of the devil because the church wanted a monopoly. And so it's understandable that she had picked this fear up just through our culture. And what she said was very interesting. She said, I decided if I was going to be afraid of it, I ought to know what it was first. She embraced her fear, which was actually quite helpful to me. So she said, would you like me to do your tarot reading? And I said, sure, let's see what the silly cards say. So she did the reading and it ended up, I was the fool. This is one of the cards. And my first, my reaction initially, I didn't say it so much, but I was thinking, I'm no fool. I'm a famous professor. I've done all this great work. These cards are crazy. But then Dorothy explained to me the positive side of the fool. The fool goes where no one else goes. And as soon as she said this, I realized that the success in my research had come from being a fool and not being afraid of being seen as foolish. When I started working in cryptography, I don't think it's an exaggeration. This is the work, by the way, that won me the Turing Award. I don't think it's an exaggeration to say that all of my colleagues told me I was foolish. They told me I was crazy. And they had very good reasons that I will not go into here today. There's not enough time. And they were right. But it was wise to do something so foolish, as you can see from the Turing Award. So guess what? The cards were right. These silly tarot cards actually predicted the right thing. So who knows how it works? There are other examples. I could go on for all day. Actually, let me show you the laureates who are here. Raise your hands. Let's see. It's about... How many of you did work that was regarded as foolish? Yeah? Okay. And you see almost all of them. And so I'm going to give you just a few examples. Vince Cerf, who is in fact chairman of HLF, wrote to me, and I made sure I got it right. I emailed him. He said, packet switching was regarded as crazy even after the great success of the ARPANET that preceded the internet. People thought it might be okay for email, which we were using it for very early. But voice? No way. Too much latency. Video? Oh my God, the latency problems were even worse. How do you get video over the internet today? Packet switching. I have a voice over IP telephone system. They were wrong. Federico Fajin, he's not a Heidelberg warrior, but he won the top prize in communications. He designed the first microprocessor at Intel, brilliant man. And he wrote to me that the CEO of a major company that made Random Logic, which was largely replaced by microprocessors, wrote in an article, anyone who thinks a CPU, because they couldn't call it a microprocessor, they hadn't invented the term yet, anyone who thinks the CPU will replace Random Logic is out of his mind. Well, it's good to be out of your mind. Brad Parkinson, who won the, I'm checking on time how I'm doing, Brad Parkinson, who won the top award from the IEEE for GPS had the same situation. Another way to see the wisdom of foolishness. For every good idea that I've had that's paid off, I've had to do at least 10, maybe 100, and who but a fool would get excited by idea number 10, which a priori looks no different from ideas one to nine, all of which failed. And yet if you don't get excited by idea number 10, you have no chance of success. So let me give you some examples to not on so much the wisdom of foolishness here, but rather beginner's mind. So I'm going back to my PhD thesis 50 years ago. It was on something called learning with finite memory. And the mathematics is not that important, but you'll see the conclusions are. You have a sequence of observations, x1, x2, an infinite sequence that are independent random variables identically distributed according to some probability distribution, p of x. And p of x is one of two known distributions. So all the variables are picked according to either p1 of x, or all of them are picked according to p2 of x, both known. And it's well known in this case that the error probability goes to zero exponentially as the number of samples tends to infinity, the Batacharya or the Chernoff bound, for example. But what happens if memory is limited as it always is? That's the learning with finite memory. Well, when I first came to this in 1966, 67, there were about 20 papers, and they all defined finite memory the same way. You could remember the last K observations. Well, as I worked on it, for various reasons, I redefined memory as the number of states in memory, the number of bits. So a three-bit memory can have eight states. And this, of course, makes much more sense. First lesson, just because everybody else has done something a certain way, don't be afraid to redefine it. You need to either be arrogant or courageous. And actually, I talk about that elsewhere. It won't be here, but there's a fine line between being arrogant and courageous. And the one thing I would recommend is it's good to be courageous. It's not good to be arrogant. And so if you have a friend, a wife, a husband, and they say you're getting arrogant, pay attention, dial back a little bit, and that's the way you'll be courageous. So let me give you an example. The first problem we considered was a trick coin. You made a coin that was going to have 75% chance of showing heads and 25% chance of showing tails. Unfortunately, you dropped it on the floor before you stamped heads and tails on it. So you pick it up and randomly stamp heads and tails. So either the probability of showing heads denoted by P is 0.75 or 0.25. And let me see what I'm doing on time so I know what I'm up to. Eight minutes. No, I need to speed up. OK, so this is actually a figure from my thesis. I pulled it out. I scanned it. So it was done by hand. And in this case, you might think if you're trying to determine whether the coin is biased three quarters toward heads or three quarters toward tails, you might use the saturable counter. Move up one state on heads, down one state on tails, and it saturates because if you reach state M, you can't go higher. You stay there in state one. If you get a tails, you stay there. Well, I had no idea how to solve for, but beginner's mind is coming in here. I had no idea how to solve for the steady state distribution. Mu of i is the probability of being in state i, where i goes from 1 to M, as the number of observations tends to infinity. Well the usual way to do it is to look at the fact that like state two has probability flowing into it from state one and from state three. We get a second order difference equation. So just like in differential equations, you end up with a solution which has two undetermined coefficients a and b. But lo and behold, a turns out to be zero. So you just have one undetermined coefficient, really, b, that has to be solved from the boundary conditions. So I looked at this, and I was childlike enough, which is another important thing, curious enough. I wonder if there's a first order difference equation that I could get, so I wouldn't have to deal with a. So I came up with a new way for solving Markov chains like this. Instead of looking at the probability flowing into a state, I looked at the probability flow across a boundary. So like in this case, I divided the machine into state one and everything else. What in steady state, what's the probability flow from left to right? Well it's p times mu of one. That must equal the flow from right to left, which is q times mu of two. Well of course that's true in general for all i, and you can quickly see that you just get a single exponential, and it's easy to then solve for it. Okay, and it turns out, now you might say, so big deal, you were able to find another way to solve Markov chains. That proved to be critical in establishing a lower bound on the error probability and showing that you could achieve it. And this is the canonical, again from a diagram from my thesis, the canonical form of the epsilon-optimal machine. You move up one state on what I call h sub epsilon. It's the maximum likelihood ratio event. It's the events that most favor the hypothesis, let's call it h one, where you decide in the right half of the machine. T sub epsilon are the observations that are most in favor of the other observation. So just like with the saturable count, you move up one state or down one state, and by the way, you're throwing away most of your observations. You only move up one state or down one state on the most informative observations. Why can you do that? Because you have an infinite number of them. Even if you throw away 99.9% of an infinite number of observations, you still have an infinite number left. And this makes sense because you only want to move up on the most informative observations. You want to preserve the value of each state, and you only want to move up one state. The k over here, let's see where is it. This k is needed because unlike the coin tosses, it might turn out that there's a drift to the right or a drift to the left under either hypothesis, and you need to match for that. It's almost like a matching transformer in electrical engineering. And the deltas at either end, you notice that you only leave state one with probability delta, and you only leave state m with probability delta, where delta tends to zero to get close and closer and closer to the optimal machine. Because you're most certain of your decisions in state one and state m. The states in the middle are not as informative. Anyway, all this came because I took the second order difference equation and said, okay, we need a different model. Yeah, I'm running a little behind so I better speed up. Okay, my first year of graduate work, but so this is for those of you who sometimes wonder, should I continue doing my PhD? Who am I to make an original contribution to research? I had that same second year slump. I felt like I'd hit a brick wall just before I got this result that became my thesis, and I was wondering, should I drop out of the PhD program? Well, over spring break, I decided I was going to, part of the problem was I was taking a lot of courses, so over spring break, I was going to put in at least 40 hours, just like a regular job doing research. Within the first half hour, no, oh, let me back up. Within the first half hour, I had the result, so you can go, especially with theoretical research from thinking you're dead to being totally alive and in heaven in a very short time. By the way, if something happens in half an hour like that, it meant that it's not purely rational thinking. Something was going on at an unconscious level, and I don't have time to go into it, but one morning I woke up and I just had the solution to a problem that had been bothering me and clearly my unconscious mind had been working on it. Actually, I'll skip those because I'm running behind. I wondered, could I play all day, sleep all night, and get great research results? I mean, this sounded fun. Of course, you have to do the hard work to put all the raw ingredients in there for your unconscious mind to work on it. But there is an important lesson. Don't slave drive yourself. Don't just work and work and work and work. Give yourself time to let things marinate for the results to come up and trust your intuition very quickly. There was a PhD student at Stanford who was in mine, but his advisor, who had been my advisor, really liked the research he was doing, but he had failed the PhD qualifying exam twice. And usually you cannot take it a third time. But he got a special dispensation, but he'd better pass it this third time. I offered to help him. I said, come to my house, I'll give you a mock exam. I gave him a question, and he was doing horribly. So I stopped him, and I said, so let's talk about how to do this differently. And as I described it to him, he said, that's what I was going to do initially. That's what I intuitively felt, but I figured it couldn't be that simple. And so when he took the exam, he didn't overthink things and he passed. Beginner's mind. I did it in the diffusion approach that I used in my thesis. But also I did my best work in cryptography. We came up with public key cryptography when I knew maybe one-tenth of the relevant mathematics that I now know. Of course, you were a math major, so maybe you were better. But would you also say that you did the best work when you knew much less than you now know? Of course. Of course. That's the reason. No, it's... Okay, no, but you did learn a lot more later. Yeah, but I didn't discover other things because of the personal things I did. Okay. I'm not saying you shouldn't learn more, but just don't be afraid. If you wait until you know everything you should know to do research in an area, you'll never do research because you'll never know it all. Many others have experienced this as well. I'll give just one example. Andy Viterbi would be better in a communications audience, but how many of you have heard of USC, University of Southern California? I mean, if you know that the... Well, the engineering school there is the Viterbi School of Engineering. Why? Because Andy Viterbi gave them over $50 million. Now how did Andy get this money? He and Irwin Jacobs founded Qualcomm, which is a huge company, but Andy had a paper. He's famous for Viterbi decoding, which some of you may have heard of. I asked Andy, I had heard that he had trouble... The reason he came up with Viterbi decoding was because he didn't understand sequential decoding, which was the technique being used before. He said it wasn't exactly right, but he did have trouble getting students to understand the performance of sequential decoding, so he attacked it in a different way. Oh, yeah, I'll skip that. Let me talk about public key cryptography because no talk by me or Whit would be complete without that. What is public key cryptography? First of all, this is a picture of... I'm in the middle, I had a little more hair, and Whit looks roughly the same. He's just matured. The third guy on the left, or your left, is Ralph Merkel, who independently came up with the privacy part of public key cryptography. Public key cryptography is important. This is one way to explain it. It protects more than $5 trillion, and since we use trillions differently, that's five times 10 to the $12 every day in financial transactions. I wish our patents were still valid. It's essential for secure software updates. It's really at the heart of security on the internet and in the digital economy. It broke out of a groove, or what, and often they're the same, dating back to August Kerkopf in the 1870s. Whit knows this history better than 1871, he thinks, somewhere around there. I'll skip that. The same thing happened, by the way, with Einstein. He broke out of a groove or rut that the physicists were in about white being a wave, not a particle, but I'll skip that because we're running well on time. To understand with public key cryptography, let's start with conventional cryptography, which is the old form where you need a single secret key to communicate. This is a more modern picture of Whit and myself, taken at one of the awards ceremonies. I have a message I want to send to Whit. The trouble is my wife, Dorothy, is listening in. Maybe we're planning a surprise birthday party for her. What I do is I generate a red, remember, this is conventional cryptography, not public key. I generate a random key K, I get a courier to take it to Whit. Notice the courier is a secure channel. It's not the channel that Dorothy can listen in on. So Whit gets the key. I then can encipher my message using the key that I know and Whit knows. I can send it to Whit. Unfortunately, Dorothy gets it, but that's not a problem because Whit can decipher it, but Dorothy cannot. She does not know the key. Conventional cryptography. Now, most people, when they think of conventional cryptography or cryptography at all, think in terms of privacy. Dorothy can't see the message that Whit and I, she can't understand the message that we're sending. But authentication is at least important. So we get both because Dorothy does not know the single secret key, and she's therefore unable to either end, to decipher the message I send Whit. That's privacy. She also cannot encipher a message and send it to Whit and make it look like it came for me. That's authentication. So the important thing is authentication is actually more important in the digital economy than privacy, even though most people don't think about it. Think about banking. If I'm writing checks on my bank account and you can read all the checks I wrote, you're violating my privacy. I'm annoyed. But what happens if you can write any check on my account? Then you're violating the authentication and stealing money. So authentication is at least as important as privacy. Now, what are the problems with conventional encryption? The first is that we need couriers or registered letters or something to send these messages. Let me see how I'm doing. 21 minutes. Yeah, doing OK. The second problem is that conventional encryption can protect against third-party forgeries, like Dorothy injecting a message to Whit, but they don't prevent Whit, because he's a very dishonest character in case you don't know this, from encrypting a message and sending it to himself and claiming that I sent it. Like, if he's my stockbroker and I'm a client and he's trading in my account for his own purposes and he loses money, he wants to make it look like I sent the message, because we share a single secret key. And public key cryptography can provide what we call a digital signature, and it's message dependent, which is very important. And this also is what's used for secure software updates. Well, let's look at how public key cryptography solves the first problem, that of couriers. It allows the seemingly impossible. And let me talk in terms of the room. I want to communicate with Whit, and we have not prearranged a key, have we, Whit? I hope he cooperates. We haven't. So if I call the message out to him, Bob Tarjan there, we'll hear it, and I don't want him to hear it. If I tell Whit the key, Bob will hear the key, so I can't have a courier. But, of course, if Bob has, or Dorothy, has unlimited computing power, they can understand anything Whit and I are saying. That's why it sounds impossible, but nobody has unlimited computing power. And so that's the trick. Can we come up with a system that Whit and I, and actually I'll pretend Dorothy's sitting there since I use her on the sides, and plus I don't want to make you the bad guy. And Dorothy doesn't mind. So can we exchange messages with just a fraction of a second of CPU time that would take Dorothy millions of years to understand or to forge? Well, let's first consider messages written on pieces of paper, because that's easier to understand. So here we are again, me and Whit and Dorothy's in the middle. So every message I pass to Whit, Dorothy gets to hold it. So I put my message inside a strong box, and I lock it with a lock that only I know the combination to. ML is Marty's lock. I then give the box to Dorothy. Can she open it? Nope. She gives it to Whit. Can he open it? Unfortunately not. I wish he could. But I made the box big enough for Whit to put a second lock on. Whit's lock. He then passes the doubly locked strong box back to Dorothy. She cannot take off either lock. When I get it, what can I do? Take off my lock, leaving only Whit's. I then pass it back to Dorothy, who gives it to Whit, who can do what? She can't open it, but Whit can take off his lock and get the message. Now, it's important in this that the operation be commutative. Addition, by the way, is a quick reminder is commutative, whereas subtraction and division are not. Now, what's commutative about the lock analogy? The locks could be put on and either order and taken off and either order. It didn't matter. It's commutative. Removing it would not be commutative if only one lock could fit on a box, as shown in this picture. Let's say that I had made the strong box like a normal strong box, where only one lock fit on it. When Whit got it, he could put my strong box in a bigger strong box and put his lock on the outside. But when he passed it to Dorothy back to me, I can't get inside to take off my lock. It's not commutative anymore. Now, the discrete exponential function that we used in what's now called Diffie-Hellman key exchange is a commutative one-way function. And I sometimes try to get this called Diffie-Hellman-Merkel key exchange, because this part of the invention, we actually came up with a Merkel system. I won't go into the details, but Ralph deserves credit here. So the function that we used was y equal alpha to the x-mod q, where q is a prime number, and alpha is some base. Now, you can quickly compute exponentials, like alpha to the ninth. You don't have to do eight multiplications to get it. Square alpha, that's one multiplication, squared again, squared again. That's three multiplications, and you get alpha to the eighth. And the numbers don't get bigger and bigger and bigger because you're doing this mod q. You can always reduce down after each phase. And so you got alpha to the eighth with three multiplications. You get alpha to the ninth by multiplying by alpha to the first. In the same way, if you have a thousand-bit prime, it takes at most 2,000 multiplications mod q to do the exponentiation, which is fast on a personal computer, for example. On the other hand, going in the reverse direction, which is known as the discrete logarithm function, is hard. By the way, there's no proof of this. There's a lot of indications, but no one's proved that someone could break this. And so if you want to win a Turing Award, you know what to do. Now, when I was playing with this one night, the discrete exponential had been suggested to me. Let me see where we are. Yeah, not bad. Had been suggested to me by John Gill, who I'll have a picture of him in a minute. And I said, let alpha and q be fixed. Everybody knows it. And then, if which could be secret and which could be public, we needed a secret key and a public key. X had to be the secret key and Y the public key, because it's easy to go from the secret key to the public key, but hard to go from the public key to the secret key. If it's easy to go from the public key to the secret key, the secret key is not really secret. And now, OK, then what I came up with is, after playing around, I realized that when two users, like you and I, want to talk, I use your public key and my secret key, you use my public key and your secret key, Bob can't get it. When Bob and I want to talk, we do the same thing and you can't get it. And so what is it? If you raise yi to the xj power or yj to the xi power, one uses public key, the other uses secret key, you get the same result. Oh, sorry. You get alpha to the xi xj, because it's commutative. Whether you do alpha to the xi and then xj or the reverse alpha to the xj, then xi, you get the same result. It's a commutative one-way function. So how did we discover public key cryptography? One of the things Witt and I realized as we were working is that there was a taxonomy. In fact, in privacy and authentication, our 1978 tutorial paper, we call it the taxonomy of cryptography. And the simplest function of cryptographic interest was a one-way function, then a conventional crypto system. And we didn't yet have public key, but we did see that a trapdoor cipher would be wonderful for a general. Because if I'm a general and I have an army and I'm fighting Bob's army, then I want a really secure Dorothy's army. OK, you're right. It's nice that she stayed home. I want a secure cipher system for my troops. But if Dorothy's army captures it, I don't want them to be able to use it. And so if there's trapdoor information that I know that allows me to break it quickly, if they use it, I can break it. Now, Witt and I never came up with a really good trapdoor cipher system. But we realized from trapdoor cryptography to a public key system was a small step, which I won't go through here. Wow, I will. I generate a trapdoor cipher. I tell it to everybody. Witt, who I want to talk to, then generates a random key. And cipher's a message to me with that key. I can get it because I know the trapdoor information, but none of you can. Public key cryptography. Trapdoors, many people call public key cryptography trapdoor ciphers. But as this example shows, trapdoors are used everywhere in cryptography. In fact, they're essential to all cryptographic problems. I'll skip that one. It's closely connected to Stephen Cook's P equal and P question, is basically if P were to equal and P, roughly speaking, there are no secure cryptographic functions of any type. I mean, you get into problems because it's polynomial versus non-polynomial. And n to the 100th is a pretty big polynomial. But that's roughly speaking the case. So what was John Gale's contribution? By the way, if you were very observant, you saw his picture on the first day. Dave Patterson, in his talk, showed the Stanford Berkeley crew that created the risk processor. John was there. And he looked pretty much like this. This is John in 1976. And so I went to John. I started. I said, oh, why did I go to John? He had a PhD in mathematics. He worked with Manuel Blum, by the way, at Berkeley. And so he could have done it in computer science, but he did it in mathematics. He was a better mathematician than me. So I went to him and asked him for the simplest cryptographic function. I said, John, what functions do you know that are easy to compute but hard to invert? He suggested factoring, which we'd already thought of. Unfortunately, we hadn't played with it enough. Once we had public key cryptography, oh, we would have gotten the RSA system. But we missed that. And so then he said, what about indices? I said, what are indices? John's a mathematician, remember? And what we call discrete logarithms, mathematicians, at least in those days, called indices. So sometimes just asking people for simple advice can be really helpful. Now, Ralph Merkel, who was in that earlier picture, was an undergraduate at Berkeley and then a master's student. And he took a CS 244, a information security course, in the fall of 1974. And he had to do a term project. We were working independently, by the way. We didn't know about Ralph at this point. He didn't know about us. And he proposed the privacy part of public key cryptography as project number one, establishing secure communication between separate secure sites over insecure communication lines. That is public key distribution. It's the privacy part of public key cryptography. Notice what the professor wrote in blue. Project two looks more reasonable. The mundane project may be because your description of project number one is muddled terribly. Talk to me about this today. So what did Ralph do? He dropped the course and did public key cryptography anyway. Unfortunately, the CACM rejected Ralph's paper. They eventually published it. The editor wrote, I was particularly bothered by the fact that there are no references to the literature. Has anyone else ever investigated this approach? No. She sent it to an experienced cryptographer, is the way she described him, because the referees are anonymous, who wrote back, the paper is not in the mainstream of present cryptography thinking. I would not recommend that it be published. So if you get a paper rejected, do what Ralph did. Keep at it. And by the way, I also had a paper rejected. And at one of the dinners, I think, I was talking to Ahmed Queshi, I think, is his name, from Pakistan. But he's at UC San Diego, if I remember. And he said, oh yeah, my advisor and I had a paper rejected from a conference. And we submitted the exact same paper the next year. And it was awarded the best paper award or something like that. So reviewers are not perfect. Public key, I'm going to skip this, I think. Let me see what we're doing on time. Yeah, I'll skip that. Yes. Go back one point. That second, the experienced cryptographic expert, I haven't been able to identify that person. OK. Other repreying actions. I think that was an NSA guy whose purpose was. OK, so Whit, since you couldn't all hear it and it's not on the tape, Whit said, he's tried to identify who the reviewer was. He believes he's someone from NSA, which I also agree with. And he thinks that he may have been trying to kill the paper. That's a possibility. But that would be really, really nasty. NSA does not stand for nasty security agency. OK. I'm going to skip this because we're running a little short on time. And I know that I'm between you and lunch and bathroom break. And we didn't have the coffee break. So to summarize, what are the secrets from 50 years of research? This is repeating what I said. The wisdom of foolishness. Don't be afraid of appearing like a fool. I was at Tom Kylat, some of you know him. He's won the National Medal of Science. President Obama bestowed it on him. And at his 80th birthday party a few years ago, a woman asked what I was doing. And I told her my wife and I were working on a book on creating true love at home and peace on the planet. And she said, she was polite, but she said, you're barking up. You're on a fool's errand. Instead of getting mad, my face lit up and I said, thank you. That's the best compliment you could pay me. And fortunately, Jim Omura, who some of you may know, he'd been a professor at UCLA, was standing about six feet away. I said, Jim, come tell this woman what you told me when I first started working in cryptography. And he said I could quote him on this so I knew that he would tell her that Marty, you're crazy to do this. Embrace your fears. Notice how Dorothy embraced her fear of terror rather than running away. And I've had that happen too. There was some Richard Chropell's analysis of factoring algorithms which showed the sub-exponential behavior. Initially, I felt, well, I can't understand that. And finally, one day, I sat down and just worked away at it. And it was easy. By the way, now it seems impossible again because I've forgotten how to do it. Beginner's mind, don't wait until you know everything that you think you want to know to do research. And embrace the irrational. There's an interesting interplay between the rational and the irrational in doing research. If we only did it rationally and linearly, we'd never get breakthrough results. And even great papers are sometimes rejected. So don't get dejected. So I'm going to end instead of with an equation, with a picture of a gorgeous glider. What does this have to do with all this? Well, it has to do with the wisdom of foolishness. The first time I was talking about the wisdom of foolishness many years ago, I stopped in the middle of the talk and I said, well, of course, when you're brainstorming, embrace foolishness. But when huge sums of money are going to be invested, when lives are at stake, you need to bring cold, hard logic to bear before you go forward. And as an example, I just picked out of the air I hadn't thought it through. I said, for example, if someone proposed a solar-powered airplane, I would tell them, that can't happen. You can look at the wing area, how many photovoltaic cells you could put there, what the maximum efficiency is, how much power the plane needs, and see, it's impossible. And as I'm interrupting myself to say this, I stopped and I said, wait a minute. I fly a solar-powered airplane all the time. I don't now, but I did back then. I flew a glider just like this. This is not me, and this is someone else doing this maneuver. But it doesn't have photovoltaic cells on the wings. Rather, the sun heats up a big valley many square kilometers, and it creates a bubble of hot air that then rushes up in a concentrated thermal. It's concentrated. And so I was stuck. Even when you try to be a fool, you sometimes will miss it. So keep that in mind. Thank you very much. So Andreas, do we have time for some questions? Oh, yes, absolutely. Thank you, Martin, for your very illuminating personal talk. First question. Well, I've been doing research for a long time now. I'm 85 years old. Oh, even a little longer than me. And I disagree with much of your advice. Oh, good. But there is one piece of advice I'd like to reinforce. It has to do with getting discouraged. I started graduate work in 1954. My first publishable paper, or so I thought it was publishable, was finished in 1955. And just after I finished it, I went to the library to see what's new. And there, in an Italian journal, was an article about my stuff. It was written by Alexander Oztroski. And at first, I thought, well, I've been scoped. But then I looked him up. He's been publishing papers since 1911. Aha, I thought, I'm catching up. So by the way, I have one school of thought about how to do research. You have another. Neither one is right, neither one is wrong. Try them both. Questions? OK. I love this portable microphone. Yeah, I did. Yeah, anyway. So I don't actually do research in cryptography, but I think about it a lot. And quantum cryptography, and you were talking about, all these crypto systems are based on trapdoors. And something I often think about is, aren't there heaps of trapdoors? I feel like I'm always, like I do maths research. And I'm always doing these things that I feel can't easily be reversed. And then I'm like, is there a crypto system that could naturally somehow arise from that? But I don't know. What do you think of the main obstacles to turning a trapdoor that you see into a cryptosystem? Or is it just that you can't verify that it really is a trapdoor? I think luck is the main obstacle. And you never know. Like the Traptor and Apps Act that Ralph and I worked on turned out not to be so good. Ron Rivest had a MDE, let's see, Ron's algorithm. He's had systems that have been broken. So you have to not be afraid of having systems broken, is what I'd say. And just try it and take it to somebody else and see what they say. Because you need a fresh mind. When Adelman has often said he doesn't think he belongs on the RSA paper because he didn't actually come up with RSA, what he did was, he was the guy that kept shooting down all their previous algorithms. And this one, he couldn't shoot down. And that's when they decided it worked. But that's critical. OK, is there another question? Other questions? Somebody over there, bring your microphone. It's probably faster. So you talked to us about the fine line between courage and arrogance. Where is that line? Where is that line? So by the way, you can download the book that my wife and I wrote free of charge at annumap.com. If you go to my Stanford home page and look, I think it has a link there, certainly, if you then look for publications. And what I realized, there was a man who impressed me as an arrogant Jewish professor from New York. The full story is in the book, so I don't have time to do it here. I'm Jewish. I'm from New York. I'm a professor. And arrogance was too much. I hated him. I didn't even know I hated him. But there's a way that something happened that made me realize I hated him. He was my dark side made incarnate. The dark side is the side of ourselves that's so important to our conscious minds that we cannot accept that it's there. And if we push it down and don't face it, don't embrace our fears in this case, it runs us around. And the story explains it more. I came to realize that he was my dark side made incarnate. And I actually had to face it. And so then I realized that arrogance has stood me in good stead. When Witt and I took on NSA almost singlehandedly in the late 70s over the data encryption standard and over the freedom to publish papers in cryptography, I remember my mother calling me and saying, what the hell are you doing? You're going to get yourself hurt, killed. And it wasn't just NSA. It was their foreign equivalents that were probably unhappy. And so I realized that that's when I realized that there's a fine line between courage and arrogance. And the one thing I came away with from this is, first of all, I need to be open to the fact if Dorothy, my wife, she's the best one for telling me this. She says, Marty, I think you're beginning. I think you're getting a little arrogant here. Rather than like 30 years ago, I would have said, not me. And I never would have taken it. Now, she might be right. She might be wrong. It's also a matter of perspective. Let me dial back a little bit and go back, make sure I'm on the courage side, not the arrogance side. OK. One more question. Oh, I can't possibly throw it back there. Somebody in the middle of the room will help me. Really? Without killing any of the young researchers. Thank you. Sorry for any casualties along the way. So my question is about the information sharing that we were doing. Like you send the key to the Diffie through Dorothy, and he puts a key, and he returns you, and you take off the key. But what if Dorothy puts a fake key with the name of Diffie, and sends you back, and you perceive it as, you got the question, right? Yeah. He just described the man in the middle attack. What if when I passed the strong box with one lock to Dorothy, instead of giving it to Witt for him to put his lock on, she puts her lock on. I can't tell the difference between her lock and Witt's lock, and she gives it back to me. I take my lock off, and I pass it to Dorothy. I think it's got Witt's lock, but it's really got Dorothy's lock, and she can open it. It's called the man in the middle attack, and there are ways to deal with it. I don't have time to go into it here. So SSL 3, which is very much like TLS, the transport layer security, that guards against man in the middle attack. It's a very important attack. Thank you for mentioning it. I actually thought about saying something, but we were running well on time, and so I'm glad the question came up. OK. We are exactly on time. Thanks again, Martin, for your presentation. Thanks. I was glad for attending. Thank you.
 Okay.  Are we set up for the next speaker?  Wonderful.  So the next speaker and last speaker of this year's Heidelberg Lord Forum is Martin Hellmann.  He's best known for his work in public key cryptography together with Wittfield Diffie,  who's also here, and Ralph Merkel.  He received the Turing Award together with Wittfield Diffie in 2015 for fundamental  contributions to modern cryptography, which I think is a very good summarization of his  achievements.  In the course of his work, he had to deal with very different players in academia, in  industry, and with government agencies.  And this experience got him interested in questions of ethics of research and other  fundamental issues.  And from this very broad perspective, he will today talk about ingredients for successful  research.  Martin, we're glad you're here and the floor is yours.  Let's see.  Set up a tie-up.  Stopwatch.  Start.  So thank you, Andreas, and thank you all.  I apologize for getting in the way of your coffee break.  So I'm going to talk on ingredients for successful research.  This is based on not quite secrets, but kind of secrets that I've observed over 50 years  of doing research myself and also my colleagues.  And to summarize, this is what I hope you will get from the talk.  It's very wise to do something foolish.  Secondly, don't run away from things you're afraid of, embrace them.  Third, the best time to do research is when you don't know what you want to know.  There's mind in Buddhism.  Another which we'll have to explain in the talk is embrace the irrational, which sounds  very strange in mathematics and computer science meeting.  And finally, even great papers are sometimes rejected.  So even if you have a paper that's rejected, don't think you should run away.  So let me hit the wisdom of foolishness first.  How did I come to understand the wisdom of foolishness?  Well, my wife.  What happened about 30, her name is Dorothy.  So about 30 years ago, she had bought a deck of tarot cards.  These are fortune telling cards.  And she was doing them on the table.  And I wondered, what is she doing, this strange woman?  We don't believe in things like that.  We're rational people.  So fortunately, I'd learned enough and I actually asked her, why are you doing this  instead of treating her like she was crazy?  And she explained that she had some fear of tarot.  And this is understandable because the church, not so much today, but 100, 200 years ago,  made anything that was at all mystical, anything irrational, was of the devil because the church  wanted a monopoly.  And so it's understandable that she had picked this fear up just through our culture.  And what she said was very interesting.  She said, I decided if I was going to be afraid of it, I ought to know what it was first.  She embraced her fear, which was actually quite helpful to me.  So she said, would you like me to do your tarot reading?  And I said, sure, let's see what the silly cards say.  So she did the reading and it ended up, I was the fool.  This is one of the cards.  And my first, my reaction initially, I didn't say it so much, but I was thinking, I'm  no fool.  I'm a famous professor.  I've done all this great work.  These cards are crazy.  But then Dorothy explained to me the positive side of the fool.  The fool goes where no one else goes.  And as soon as she said this, I realized that the success in my research had come from being  a fool and not being afraid of being seen as foolish.  When I started working in cryptography, I don't think it's an exaggeration.  This is the work, by the way, that won me the Turing Award.  I don't think it's an exaggeration to say that all of my colleagues told me I was foolish.  They told me I was crazy.  And they had very good reasons that I will not go into here today.  There's not enough time.  And they were right.  But it was wise to do something so foolish, as you can see from the Turing Award.  So guess what?  The cards were right.  These silly tarot cards actually predicted the right thing.  So who knows how it works?  There are other examples.  I could go on for all day.  Actually, let me show you the laureates who are here.  Raise your hands.  Let's see.  It's about...  How many of you did work that was regarded as foolish?  Yeah?  Okay.  And you see almost all of them.  And so I'm going to give you just a few examples.  Vince Cerf, who is in fact chairman of HLF, wrote to me, and I made sure I got it right.  I emailed him.  He said, packet switching was regarded as crazy even after the great success of the ARPANET  that preceded the internet.  People thought it might be okay for email, which we were using it for very early.  But voice?  No way.  Too much latency.  Video?  Oh my God, the latency problems were even worse.  How do you get video over the internet today?  Packet switching.  I have a voice over IP telephone system.  They were wrong.  Federico Fajin, he's not a Heidelberg warrior, but he won the top prize in communications.  He designed the first microprocessor at Intel, brilliant man.  And he wrote to me that the CEO of a major company that made Random Logic, which was  largely replaced by microprocessors, wrote in an article, anyone who thinks a CPU, because  they couldn't call it a microprocessor, they hadn't invented the term yet, anyone who  thinks the CPU will replace Random Logic is out of his mind.  Well, it's good to be out of your mind.  Brad Parkinson, who won the, I'm checking on time how I'm doing, Brad Parkinson, who  won the top award from the IEEE for GPS had the same situation.  Another way to see the wisdom of foolishness.  For every good idea that I've had that's paid off, I've had to do at least 10, maybe  100, and who but a fool would get excited by idea number 10, which a priori looks no  different from ideas one to nine, all of which failed.  And yet if you don't get excited by idea number 10, you have no chance of success.  So let me give you some examples to not on so much the wisdom of foolishness here, but  rather beginner's mind.  So I'm going back to my PhD thesis 50 years ago.  It was on something called learning with finite memory.  And the mathematics is not that important, but you'll see the conclusions are.  You have a sequence of observations, x1, x2, an infinite sequence that are independent  random variables identically distributed according to some probability distribution, p of x.  And p of x is one of two known distributions.  So all the variables are picked according to either p1 of x, or all of them are picked  according to p2 of x, both known.  And it's well known in this case that the error probability goes to zero exponentially  as the number of samples tends to infinity, the Batacharya or the Chernoff bound, for  example.  But what happens if memory is limited as it always is?  That's the learning with finite memory.  Well, when I first came to this in 1966, 67, there were about 20 papers, and they all defined  finite memory the same way.  You could remember the last K observations.  Well, as I worked on it, for various reasons, I redefined memory as the number of states  in memory, the number of bits.  So a three-bit memory can have eight states.  And this, of course, makes much more sense.  First lesson, just because everybody else has done something a certain way, don't be  afraid to redefine it.  You need to either be arrogant or courageous.  And actually, I talk about that elsewhere.  It won't be here, but there's a fine line between being arrogant and courageous.  And the one thing I would recommend is it's good to be courageous.  It's not good to be arrogant.  And so if you have a friend, a wife, a husband, and they say you're getting arrogant, pay  attention, dial back a little bit, and that's the way you'll be courageous.  So let me give you an example.  The first problem we considered was a trick coin.  You made a coin that was going to have 75% chance of showing heads and 25% chance of  showing tails.  Unfortunately, you dropped it on the floor before you stamped heads and tails on it.  So you pick it up and randomly stamp heads and tails.  So either the probability of showing heads denoted by P is 0.75 or 0.25.  And let me see what I'm doing on time so I know what I'm up to.  Eight minutes.  No, I need to speed up.  OK, so this is actually a figure from my thesis.  I pulled it out.  I scanned it.  So it was done by hand.  And in this case, you might think if you're trying to determine whether the coin is biased  three quarters toward heads or three quarters toward tails, you might use the saturable counter.  Move up one state on heads, down one state on tails, and it saturates because if you reach  state M, you can't go higher.  You stay there in state one.  If you get a tails, you stay there.  Well, I had no idea how to solve for, but beginner's mind is coming in here.  I had no idea how to solve for the steady state distribution.  Mu of i is the probability of being in state i, where i goes from 1 to M, as the number  of observations tends to infinity.  Well the usual way to do it is to look at the fact that like state two has probability  flowing into it from state one and from state three.  We get a second order difference equation.  So just like in differential equations, you end up with a solution which has two undetermined  coefficients a and b.  But lo and behold, a turns out to be zero.  So you just have one undetermined coefficient, really, b, that has to be solved from the  boundary conditions.  So I looked at this, and I was childlike enough, which is another important thing, curious  enough.  I wonder if there's a first order difference equation that I could get, so I wouldn't have  to deal with a.  So I came up with a new way for solving Markov chains like this.  Instead of looking at the probability flowing into a state, I looked at the probability  flow across a boundary.  So like in this case, I divided the machine into state one and everything else.  What in steady state, what's the probability flow from left to right?  Well it's p times mu of one.  That must equal the flow from right to left, which is q times mu of two.  Well of course that's true in general for all i, and you can quickly see that you just  get a single exponential, and it's easy to then solve for it.  Okay, and it turns out, now you might say, so big deal, you were able to find another  way to solve Markov chains.  That proved to be critical in establishing a lower bound on the error probability and  showing that you could achieve it.  And this is the canonical, again from a diagram from my thesis, the canonical form of the  epsilon-optimal machine.  You move up one state on what I call h sub epsilon.  It's the maximum likelihood ratio event.  It's the events that most favor the hypothesis, let's call it h one, where you decide in the  right half of the machine.  T sub epsilon are the observations that are most in favor of the other observation.  So just like with the saturable count, you move up one state or down one state, and by  the way, you're throwing away most of your observations.  You only move up one state or down one state on the most informative observations.  Why can you do that?  Because you have an infinite number of them.  Even if you throw away 99.9% of an infinite number of observations, you still have an  infinite number left.  And this makes sense because you only want to move up on the most informative observations.  You want to preserve the value of each state, and you only want to move up one state.  The k over here, let's see where is it.  This k is needed because unlike the coin tosses, it might turn out that there's a drift to the  right or a drift to the left under either hypothesis, and you need to match for that.  It's almost like a matching transformer in electrical engineering.  And the deltas at either end, you notice that you only leave state one with probability  delta, and you only leave state m with probability delta, where delta tends to zero to get close  and closer and closer to the optimal machine.  Because you're most certain of your decisions in state one and state m.  The states in the middle are not as informative.  Anyway, all this came because I took the second order difference equation and said,  okay, we need a different model.  Yeah, I'm running a little behind so I better speed up.  Okay, my first year of graduate work, but so this is for those of you who sometimes wonder,  should I continue doing my PhD?  Who am I to make an original contribution to research?  I had that same second year slump.  I felt like I'd hit a brick wall just before I got this result that became my thesis, and  I was wondering, should I drop out of the PhD program?  Well, over spring break, I decided I was going to, part of the problem was I was taking a  lot of courses, so over spring break, I was going to put in at least 40 hours, just like  a regular job doing research.  Within the first half hour, no, oh, let me back up.  Within the first half hour, I had the result, so you can go, especially with theoretical  research from thinking you're dead to being totally alive and in heaven in a very short  time.  By the way, if something happens in half an hour like that, it meant that it's not purely  rational thinking.  Something was going on at an unconscious level, and I don't have time to go into it, but one  morning I woke up and I just had the solution to a problem that had been bothering me and  clearly my unconscious mind had been working on it.  Actually, I'll skip those because I'm running behind.  I wondered, could I play all day, sleep all night, and get great research results?  I mean, this sounded fun.  Of course, you have to do the hard work to put all the raw ingredients in there for your  unconscious mind to work on it.  But there is an important lesson.  Don't slave drive yourself.  Don't just work and work and work and work.  Give yourself time to let things marinate for the results to come up and trust your intuition  very quickly.  There was a PhD student at Stanford who was in mine, but his advisor, who had been my  advisor, really liked the research he was doing, but he had failed the PhD qualifying  exam twice.  And usually you cannot take it a third time.  But he got a special dispensation, but he'd better pass it this third time.  I offered to help him.  I said, come to my house, I'll give you a mock exam.  I gave him a question, and he was doing horribly.  So I stopped him, and I said, so let's talk about how to do this differently.  And as I described it to him, he said, that's what I was going to do initially.  That's what I intuitively felt, but I figured it couldn't be that simple.  And so when he took the exam, he didn't overthink things and he passed.  Beginner's mind.  I did it in the diffusion approach that I used in my thesis.  But also I did my best work in cryptography.  We came up with public key cryptography when I knew maybe one-tenth of the relevant mathematics  that I now know.  Of course, you were a math major, so maybe you were better.  But would you also say that you did the best work when you knew much less than you now  know?  Of course.  Of course.  That's the reason.  No, it's...  Okay, no, but you did learn a lot more later.  Yeah, but I didn't discover other things because of the personal things I did.  Okay.  I'm not saying you shouldn't learn more, but just don't be afraid.  If you wait until you know everything you should know to do research in an area, you'll  never do research because you'll never know it all.  Many others have experienced this as well.  I'll give just one example.  Andy Viterbi would be better in a communications audience, but how many of you have heard of  USC, University of Southern California?  I mean, if you know that the...  Well, the engineering school there is the Viterbi School of Engineering.  Why?  Because Andy Viterbi gave them over $50 million.  Now how did Andy get this money?  He and Irwin Jacobs founded Qualcomm, which is a huge company, but Andy had a paper.  He's famous for Viterbi decoding, which some of you may have heard of.  I asked Andy, I had heard that he had trouble...  The reason he came up with Viterbi decoding was because he didn't understand sequential  decoding, which was the technique being used before.  He said it wasn't exactly right, but he did have trouble getting students to understand  the performance of sequential decoding, so he attacked it in a different way.  Oh, yeah, I'll skip that.  Let me talk about public key cryptography because no talk by me or Whit would be complete  without that.  What is public key cryptography?  First of all, this is a picture of...  I'm in the middle, I had a little more hair, and Whit looks roughly the same.  He's just matured.  The third guy on the left, or your left, is Ralph Merkel, who independently came up with  the privacy part of public key cryptography.  Public key cryptography is important.  This is one way to explain it.  It protects more than $5 trillion, and since we use trillions differently, that's five  times 10 to the $12 every day in financial transactions.  I wish our patents were still valid.  It's essential for secure software updates.  It's really at the heart of security on the internet and in the digital economy.  It broke out of a groove, or what, and often they're the same, dating back to August Kerkopf  in the 1870s.  Whit knows this history better than 1871, he thinks, somewhere around there.  I'll skip that.  The same thing happened, by the way, with Einstein.  He broke out of a groove or rut that the physicists were in about white being a wave,  not a particle, but I'll skip that because we're running well on time.  To understand with public key cryptography, let's start with conventional cryptography,  which is the old form where you need a single secret key to communicate.  This is a more modern picture of Whit and myself, taken at one of the awards ceremonies.  I have a message I want to send to Whit.  The trouble is my wife, Dorothy, is listening in.  Maybe we're planning a surprise birthday party for her.  What I do is I generate a red, remember, this is conventional cryptography, not public key.  I generate a random key K, I get a courier to take it to Whit.  Notice the courier is a secure channel.  It's not the channel that Dorothy can listen in on.  So Whit gets the key.  I then can encipher my message using the key that I know and Whit knows.  I can send it to Whit.  Unfortunately, Dorothy gets it, but that's not a problem because Whit can decipher it,  but Dorothy cannot.  She does not know the key.  Conventional cryptography.  Now, most people, when they think of conventional cryptography or cryptography at all,  think in terms of privacy.  Dorothy can't see the message that Whit and I, she can't understand the message that we're sending.  But authentication is at least important.  So we get both because Dorothy does not know the single secret key,  and she's therefore unable to either end, to decipher the message I send Whit.  That's privacy.  She also cannot encipher a message and send it to Whit and make it look like it came for me.  That's authentication.  So the important thing is authentication is actually more important in the digital economy  than privacy, even though most people don't think about it.  Think about banking.  If I'm writing checks on my bank account and you can read all the checks I wrote,  you're violating my privacy.  I'm annoyed.  But what happens if you can write any check on my account?  Then you're violating the authentication and stealing money.  So authentication is at least as important as privacy.  Now, what are the problems with conventional encryption?  The first is that we need couriers or registered letters or something to send these messages.  Let me see how I'm doing.  21 minutes.  Yeah, doing OK.  The second problem is that conventional encryption can protect against third-party forgeries,  like Dorothy injecting a message to Whit, but they don't prevent Whit,  because he's a very dishonest character in case you don't know this,  from encrypting a message and sending it to himself and claiming that I sent it.  Like, if he's my stockbroker and I'm a client and he's trading in my account for his own purposes  and he loses money, he wants to make it look like I sent the message,  because we share a single secret key.  And public key cryptography can provide what we call a digital signature,  and it's message dependent, which is very important.  And this also is what's used for secure software updates.  Well, let's look at how public key cryptography solves the first problem, that of couriers.  It allows the seemingly impossible.  And let me talk in terms of the room.  I want to communicate with Whit, and we have not prearranged a key, have we, Whit?  I hope he cooperates. We haven't.  So if I call the message out to him, Bob Tarjan there, we'll hear it,  and I don't want him to hear it.  If I tell Whit the key, Bob will hear the key, so I can't have a courier.  But, of course, if Bob has, or Dorothy, has unlimited computing power,  they can understand anything Whit and I are saying.  That's why it sounds impossible, but nobody has unlimited computing power.  And so that's the trick. Can we come up with a system that Whit and I,  and actually I'll pretend Dorothy's sitting there since I use her on the sides,  and plus I don't want to make you the bad guy.  And Dorothy doesn't mind.  So can we exchange messages with just a fraction of a second of CPU time  that would take Dorothy millions of years to understand or to forge?  Well, let's first consider messages written on pieces of paper,  because that's easier to understand.  So here we are again, me and Whit and Dorothy's in the middle.  So every message I pass to Whit, Dorothy gets to hold it.  So I put my message inside a strong box,  and I lock it with a lock that only I know the combination to.  ML is Marty's lock.  I then give the box to Dorothy. Can she open it?  Nope. She gives it to Whit. Can he open it?  Unfortunately not. I wish he could.  But I made the box big enough for Whit to put a second lock on.  Whit's lock.  He then passes the doubly locked strong box back to Dorothy.  She cannot take off either lock. When I get it, what can I do?  Take off my lock, leaving only Whit's.  I then pass it back to Dorothy, who gives it to Whit, who can do what?  She can't open it, but Whit can take off his lock and get the message.  Now, it's important in this that the operation be commutative.  Addition, by the way, is a quick reminder is commutative,  whereas subtraction and division are not.  Now, what's commutative about the lock analogy?  The locks could be put on and either order and taken off and either order.  It didn't matter. It's commutative.  Removing it would not be commutative if only one lock could fit on a box,  as shown in this picture. Let's say that I had made the strong box  like a normal strong box, where only one lock fit on it.  When Whit got it, he could put my strong box in a bigger strong box  and put his lock on the outside.  But when he passed it to Dorothy back to me, I can't get inside  to take off my lock. It's not commutative anymore.  Now, the discrete exponential function that we used in what's now called  Diffie-Hellman key exchange is a commutative one-way function.  And I sometimes try to get this called Diffie-Hellman-Merkel key exchange,  because this part of the invention, we actually came up with a Merkel system.  I won't go into the details, but Ralph deserves credit here.  So the function that we used was y equal alpha to the x-mod q,  where q is a prime number, and alpha is some base.  Now, you can quickly compute exponentials, like alpha to the ninth.  You don't have to do eight multiplications to get it.  Square alpha, that's one multiplication, squared again, squared again.  That's three multiplications, and you get alpha to the eighth.  And the numbers don't get bigger and bigger and bigger  because you're doing this mod q.  You can always reduce down after each phase.  And so you got alpha to the eighth with three multiplications.  You get alpha to the ninth by multiplying by alpha to the first.  In the same way, if you have a thousand-bit prime,  it takes at most 2,000 multiplications mod q to do the exponentiation,  which is fast on a personal computer, for example.  On the other hand, going in the reverse direction,  which is known as the discrete logarithm function, is hard.  By the way, there's no proof of this.  There's a lot of indications, but no one's proved that someone could break this.  And so if you want to win a Turing Award, you know what to do.  Now, when I was playing with this one night,  the discrete exponential had been suggested to me.  Let me see where we are.  Yeah, not bad.  Had been suggested to me by John Gill, who I'll have a picture of him in a minute.  And I said, let alpha and q be fixed.  Everybody knows it.  And then, if which could be secret and which could be public,  we needed a secret key and a public key.  X had to be the secret key and Y the public key,  because it's easy to go from the secret key to the public key,  but hard to go from the public key to the secret key.  If it's easy to go from the public key to the secret key,  the secret key is not really secret.  And now, OK, then what I came up with is, after playing around,  I realized that when two users, like you and I, want to talk,  I use your public key and my secret key,  you use my public key and your secret key, Bob can't get it.  When Bob and I want to talk, we do the same thing and you can't get it.  And so what is it?  If you raise yi to the xj power or yj to the xi power,  one uses public key, the other uses secret key,  you get the same result.  Oh, sorry.  You get alpha to the xi xj, because it's commutative.  Whether you do alpha to the xi and then xj or the reverse alpha  to the xj, then xi, you get the same result.  It's a commutative one-way function.  So how did we discover public key cryptography?  One of the things Witt and I realized as we were working  is that there was a taxonomy.  In fact, in privacy and authentication, our 1978 tutorial  paper, we call it the taxonomy of cryptography.  And the simplest function of cryptographic interest  was a one-way function, then a conventional crypto system.  And we didn't yet have public key,  but we did see that a trapdoor cipher would  be wonderful for a general.  Because if I'm a general and I have an army  and I'm fighting Bob's army, then I  want a really secure Dorothy's army.  OK, you're right.  It's nice that she stayed home.  I want a secure cipher system for my troops.  But if Dorothy's army captures it,  I don't want them to be able to use it.  And so if there's trapdoor information  that I know that allows me to break it quickly, if they use  it, I can break it.  Now, Witt and I never came up with a really good trapdoor  cipher system.  But we realized from trapdoor cryptography to a public key  system was a small step, which I won't go through here.  Wow, I will.  I generate a trapdoor cipher.  I tell it to everybody.  Witt, who I want to talk to, then generates a random key.  And cipher's a message to me with that key.  I can get it because I know the trapdoor information,  but none of you can.  Public key cryptography.  Trapdoors, many people call public key cryptography  trapdoor ciphers.  But as this example shows, trapdoors  are used everywhere in cryptography.  In fact, they're essential to all cryptographic problems.  I'll skip that one.  It's closely connected to Stephen Cook's P equal and P  question, is basically if P were to equal and P,  roughly speaking, there are no secure cryptographic functions  of any type.  I mean, you get into problems because it's  polynomial versus non-polynomial.  And n to the 100th is a pretty big polynomial.  But that's roughly speaking the case.  So what was John Gale's contribution?  By the way, if you were very observant,  you saw his picture on the first day.  Dave Patterson, in his talk, showed the Stanford Berkeley  crew that created the risk processor.  John was there.  And he looked pretty much like this.  This is John in 1976.  And so I went to John.  I started.  I said, oh, why did I go to John?  He had a PhD in mathematics.  He worked with Manuel Blum, by the way, at Berkeley.  And so he could have done it in computer science,  but he did it in mathematics.  He was a better mathematician than me.  So I went to him and asked him for the simplest cryptographic  function.  I said, John, what functions do you  know that are easy to compute but hard to invert?  He suggested factoring, which we'd already thought of.  Unfortunately, we hadn't played with it enough.  Once we had public key cryptography,  oh, we would have gotten the RSA system.  But we missed that.  And so then he said, what about indices?  I said, what are indices?  John's a mathematician, remember?  And what we call discrete logarithms, mathematicians,  at least in those days, called indices.  So sometimes just asking people for simple advice  can be really helpful.  Now, Ralph Merkel, who was in that earlier picture,  was an undergraduate at Berkeley and then a master's  student.  And he took a CS 244, a information security course,  in the fall of 1974.  And he had to do a term project.  We were working independently, by the way.  We didn't know about Ralph at this point.  He didn't know about us.  And he proposed the privacy part of public key cryptography  as project number one, establishing secure communication  between separate secure sites over insecure communication  lines.  That is public key distribution.  It's the privacy part of public key cryptography.  Notice what the professor wrote in blue.  Project two looks more reasonable.  The mundane project may be because your description  of project number one is muddled terribly.  Talk to me about this today.  So what did Ralph do?  He dropped the course and did public key cryptography anyway.  Unfortunately, the CACM rejected Ralph's paper.  They eventually published it.  The editor wrote, I was particularly  bothered by the fact that there are no references  to the literature.  Has anyone else ever investigated this approach?  No.  She sent it to an experienced cryptographer,  is the way she described him, because the referees are  anonymous, who wrote back, the paper is not  in the mainstream of present cryptography thinking.  I would not recommend that it be published.  So if you get a paper rejected, do what Ralph did.  Keep at it.  And by the way, I also had a paper rejected.  And at one of the dinners, I think,  I was talking to Ahmed Queshi, I think, is his name,  from Pakistan.  But he's at UC San Diego, if I remember.  And he said, oh yeah, my advisor and I  had a paper rejected from a conference.  And we submitted the exact same paper the next year.  And it was awarded the best paper award  or something like that.  So reviewers are not perfect.  Public key, I'm going to skip this, I think.  Let me see what we're doing on time.  Yeah, I'll skip that.  Yes.  Go back one point.  That second, the experienced cryptographic expert,  I haven't been able to identify that person.  OK.  Other repreying actions.  I think that was an NSA guy whose purpose was.  OK, so Whit, since you couldn't all hear it  and it's not on the tape, Whit said,  he's tried to identify who the reviewer was.  He believes he's someone from NSA, which I also agree with.  And he thinks that he may have been trying to kill the paper.  That's a possibility.  But that would be really, really nasty.  NSA does not stand for nasty security agency.  OK.  I'm going to skip this because we're  running a little short on time.  And I know that I'm between you and lunch and bathroom break.  And we didn't have the coffee break.  So to summarize, what are the secrets  from 50 years of research?  This is repeating what I said.  The wisdom of foolishness.  Don't be afraid of appearing like a fool.  I was at Tom Kylat, some of you know him.  He's won the National Medal of Science.  President Obama bestowed it on him.  And at his 80th birthday party a few years ago,  a woman asked what I was doing.  And I told her my wife and I were working on a book  on creating true love at home and peace on the planet.  And she said, she was polite, but she said,  you're barking up.  You're on a fool's errand.  Instead of getting mad, my face lit up and I said, thank you.  That's the best compliment you could pay me.  And fortunately, Jim Omura, who some of you may know,  he'd been a professor at UCLA, was standing about six feet  away.  I said, Jim, come tell this woman what you told me  when I first started working in cryptography.  And he said I could quote him on this  so I knew that he would tell her that Marty, you're  crazy to do this.  Embrace your fears.  Notice how Dorothy embraced her fear of terror  rather than running away.  And I've had that happen too.  There was some Richard Chropell's analysis  of factoring algorithms which showed the sub-exponential  behavior.  Initially, I felt, well, I can't understand that.  And finally, one day, I sat down and just worked away at it.  And it was easy.  By the way, now it seems impossible again  because I've forgotten how to do it.  Beginner's mind, don't wait until you know everything  that you think you want to know to do research.  And embrace the irrational.  There's an interesting interplay between the rational  and the irrational in doing research.  If we only did it rationally and linearly,  we'd never get breakthrough results.  And even great papers are sometimes rejected.  So don't get dejected.  So I'm going to end instead of with an equation,  with a picture of a gorgeous glider.  What does this have to do with all this?  Well, it has to do with the wisdom of foolishness.  The first time I was talking about the wisdom of foolishness  many years ago, I stopped in the middle of the talk  and I said, well, of course, when you're brainstorming,  embrace foolishness.  But when huge sums of money are going to be invested,  when lives are at stake, you need  to bring cold, hard logic to bear before you go forward.  And as an example, I just picked out of the air  I hadn't thought it through.  I said, for example, if someone proposed  a solar-powered airplane, I would tell them, that can't happen.  You can look at the wing area, how many photovoltaic  cells you could put there, what the maximum efficiency is,  how much power the plane needs, and see, it's impossible.  And as I'm interrupting myself to say this, I stopped and I  said, wait a minute.  I fly a solar-powered airplane all the time.  I don't now, but I did back then.  I flew a glider just like this.  This is not me, and this is someone else doing this maneuver.  But it doesn't have photovoltaic cells on the wings.  Rather, the sun heats up a big valley many square kilometers,  and it creates a bubble of hot air that then rushes up  in a concentrated thermal.  It's concentrated.  And so I was stuck.  Even when you try to be a fool, you sometimes will miss it.  So keep that in mind.  Thank you very much.  So Andreas, do we have time for some questions?  Oh, yes, absolutely.  Thank you, Martin, for your very illuminating personal talk.  First question.  Well, I've been doing research for a long time now.  I'm 85 years old.  Oh, even a little longer than me.  And I disagree with much of your advice.  Oh, good.  But there is one piece of advice I'd like to reinforce.  It has to do with getting discouraged.  I started graduate work in 1954.  My first publishable paper, or so I thought it was publishable,  was finished in 1955.  And just after I finished it, I went to the library  to see what's new.  And there, in an Italian journal,  was an article about my stuff.  It was written by Alexander Oztroski.  And at first, I thought, well, I've been scoped.  But then I looked him up.  He's been publishing papers since 1911.  Aha, I thought, I'm catching up.  So by the way, I have one school of thought  about how to do research.  You have another.  Neither one is right, neither one is wrong.  Try them both.  Questions?  OK.  I love this portable microphone.  Yeah, I did.  Yeah, anyway.  So I don't actually do research in cryptography,  but I think about it a lot.  And quantum cryptography, and you were talking about,  all these crypto systems are based on trapdoors.  And something I often think about is,  aren't there heaps of trapdoors?  I feel like I'm always, like I do maths research.  And I'm always doing these things  that I feel can't easily be reversed.  And then I'm like, is there a crypto system that could naturally  somehow arise from that?  But I don't know.  What do you think of the main obstacles to turning  a trapdoor that you see into a cryptosystem?  Or is it just that you can't verify that it really is a trapdoor?  I think luck is the main obstacle.  And you never know.  Like the Traptor and Apps Act that Ralph and I worked on  turned out not to be so good.  Ron Rivest had a MDE, let's see, Ron's algorithm.  He's had systems that have been broken.  So you have to not be afraid of having systems broken,  is what I'd say.  And just try it and take it to somebody else  and see what they say.  Because you need a fresh mind.  When Adelman has often said he doesn't think  he belongs on the RSA paper because he didn't actually  come up with RSA, what he did was,  he was the guy that kept shooting down  all their previous algorithms.  And this one, he couldn't shoot down.  And that's when they decided it worked.  But that's critical.  OK, is there another question?  Other questions?  Somebody over there, bring your microphone.  It's probably faster.  So you talked to us about the fine line  between courage and arrogance.  Where is that line?  Where is that line?  So by the way, you can download the book  that my wife and I wrote free of charge at annumap.com.  If you go to my Stanford home page and look,  I think it has a link there, certainly,  if you then look for publications.  And what I realized, there was a man who impressed me  as an arrogant Jewish professor from New York.  The full story is in the book, so I don't have time to do it here.  I'm Jewish.  I'm from New York.  I'm a professor.  And arrogance was too much.  I hated him.  I didn't even know I hated him.  But there's a way that something happened that made me  realize I hated him.  He was my dark side made incarnate.  The dark side is the side of ourselves  that's so important to our conscious minds  that we cannot accept that it's there.  And if we push it down and don't face it,  don't embrace our fears in this case, it runs us around.  And the story explains it more.  I came to realize that he was my dark side made incarnate.  And I actually had to face it.  And so then I realized that arrogance  has stood me in good stead.  When Witt and I took on NSA almost singlehandedly  in the late 70s over the data encryption standard  and over the freedom to publish papers in cryptography,  I remember my mother calling me and saying,  what the hell are you doing?  You're going to get yourself hurt, killed.  And it wasn't just NSA.  It was their foreign equivalents  that were probably unhappy.  And so I realized that that's when I realized  that there's a fine line between courage and arrogance.  And the one thing I came away with from this  is, first of all, I need to be open to the fact  if Dorothy, my wife, she's the best one for telling me this.  She says, Marty, I think you're beginning.  I think you're getting a little arrogant here.  Rather than like 30 years ago, I would have said, not me.  And I never would have taken it.  Now, she might be right.  She might be wrong.  It's also a matter of perspective.  Let me dial back a little bit and go back,  make sure I'm on the courage side, not the arrogance side.  OK.  One more question.  Oh, I can't possibly throw it back there.  Somebody in the middle of the room will help me.  Really?  Without killing any of the young researchers.  Thank you.  Sorry for any casualties along the way.  So my question is about the information sharing  that we were doing.  Like you send the key to the Diffie through Dorothy,  and he puts a key, and he returns you, and you take off the key.  But what if Dorothy puts a fake key with the name of Diffie,  and sends you back, and you perceive it as,  you got the question, right?  Yeah.  He just described the man in the middle attack.  What if when I passed the strong box with one lock to Dorothy,  instead of giving it to Witt for him to put his lock on,  she puts her lock on.  I can't tell the difference between her lock and Witt's lock,  and she gives it back to me.  I take my lock off, and I pass it to Dorothy.  I think it's got Witt's lock, but it's really got Dorothy's lock,  and she can open it.  It's called the man in the middle attack,  and there are ways to deal with it.  I don't have time to go into it here.  So SSL 3, which is very much like TLS, the transport layer  security, that guards against man in the middle attack.  It's a very important attack.  Thank you for mentioning it.  I actually thought about saying something,  but we were running well on time,  and so I'm glad the question came up.  OK.  We are exactly on time.  Thanks again, Martin, for your presentation.  Thanks.  I was glad for attending.  Thank you.
6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_0_59.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_60_191.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_192_239.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_240_335.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_336_491.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_492_551.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_552_2159.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_2160_3743.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_3744_3983.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_3984_8711.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_8712_8855.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_8856_12035.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_12036_15311.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_15312_15851.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_15852_17615.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_17616_17663.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_17664_18611.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_18612_20627.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_20628_21791.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_21792_22031.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_22032_22715.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_22716_23891.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_23892_23939.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_23940_25859.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_25860_27011.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_27012_28547.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_28548_29363.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_29364_30947.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_30948_31211.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_31212_32279.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_32280_32627.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_32628_34067.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_34068_34331.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_34332_34571.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_34572_35579.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_35580_35855.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_35856_35975.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_35976_37403.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_37404_37523.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_37524_38087.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_38088_38159.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_38160_38459.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_38460_38555.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_38556_38663.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_38664_38735.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_38736_38975.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_38976_39047.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_39048_39635.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_39636_39827.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_39828_40403.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_40404_46463.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_46464_47123.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_47124_48227.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_48228_49919.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_49920_51647.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_51648_51779.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_51780_52103.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_52104_53207.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_53208_53327.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_53328_53399.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_53400_54407.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_54408_54491.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_54492_57383.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_57384_59939.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_59940_70499.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_70500_70607.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_70608_70727.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_70728_70883.png 6th_HLF___Lecture__Martin_Hellman_rLN5CXKoN1k_70884_70951.png
Okay. Are we set up for the next speaker? Wonderful. So the next speaker and last speaker of this year's Heidelberg Lord Forum is Martin Hellmann. He's best known for his work in public key cryptography together with Wittfield Diffie, who's also here, and Ralph Merkel. He received the Turing Award together with Wittfield Diffie in 2015 for fundamental contributions to modern cryptography, which I think is a very good summarization of his achievements. In the course of his work, he had to deal with very different players in academia, in industry, and with government agencies. And this experience got him interested in questions of ethics of research and other fundamental issues. And from this very broad perspective, he will today talk about ingredients for successful research. Martin, we're glad you're here and the floor is yours. Let's see. Set up a tie-up. Stopwatch. Start. So thank you, Andreas, and thank you all. I apologize for getting in the way of your coffee break. So I'm going to talk on ingredients for successful research. This is based on not quite secrets, but kind of secrets that I've observed over 50 years of doing research myself and also my colleagues. And to summarize, this is what I hope you will get from the talk. It's very wise to do something foolish. Secondly, don't run away from things you're afraid of, embrace them. Third, the best time to do research is when you don't know what you want to know. There's mind in Buddhism. Another which we'll have to explain in the talk is embrace the irrational, which sounds very strange in mathematics and computer science meeting. And finally, even great papers are sometimes rejected. So even if you have a paper that's rejected, don't think you should run away. So let me hit the wisdom of foolishness first. How did I come to understand the wisdom of foolishness? Well, my wife. What happened about 30, her name is Dorothy. So about 30 years ago, she had bought a deck of tarot cards. These are fortune telling cards. And she was doing them on the table. And I wondered, what is she doing, this strange woman? We don't believe in things like that. We're rational people. So fortunately, I'd learned enough and I actually asked her, why are you doing this instead of treating her like she was crazy? And she explained that she had some fear of tarot. And this is understandable because the church, not so much today, but 100, 200 years ago, made anything that was at all mystical, anything irrational, was of the devil because the church wanted a monopoly. And so it's understandable that she had picked this fear up just through our culture. And what she said was very interesting. She said, I decided if I was going to be afraid of it, I ought to know what it was first. She embraced her fear, which was actually quite helpful to me. So she said, would you like me to do your tarot reading? And I said, sure, let's see what the silly cards say. So she did the reading and it ended up, I was the fool. This is one of the cards. And my first, my reaction initially, I didn't say it so much, but I was thinking, I'm no fool. I'm a famous professor. I've done all this great work. These cards are crazy. But then Dorothy explained to me the positive side of the fool. The fool goes where no one else goes. And as soon as she said this, I realized that the success in my research had come from being a fool and not being afraid of being seen as foolish. When I started working in cryptography, I don't think it's an exaggeration. This is the work, by the way, that won me the Turing Award. I don't think it's an exaggeration to say that all of my colleagues told me I was foolish. They told me I was crazy. And they had very good reasons that I will not go into here today. There's not enough time. And they were right. But it was wise to do something so foolish, as you can see from the Turing Award. So guess what? The cards were right. These silly tarot cards actually predicted the right thing. So who knows how it works? There are other examples. I could go on for all day. Actually, let me show you the laureates who are here. Raise your hands. Let's see. It's about... How many of you did work that was regarded as foolish? Yeah? Okay. And you see almost all of them. And so I'm going to give you just a few examples. Vince Cerf, who is in fact chairman of HLF, wrote to me, and I made sure I got it right. I emailed him. He said, packet switching was regarded as crazy even after the great success of the ARPANET that preceded the internet. People thought it might be okay for email, which we were using it for very early. But voice? No way. Too much latency. Video? Oh my God, the latency problems were even worse. How do you get video over the internet today? Packet switching. I have a voice over IP telephone system. They were wrong. Federico Fajin, he's not a Heidelberg warrior, but he won the top prize in communications. He designed the first microprocessor at Intel, brilliant man. And he wrote to me that the CEO of a major company that made Random Logic, which was largely replaced by microprocessors, wrote in an article, anyone who thinks a CPU, because they couldn't call it a microprocessor, they hadn't invented the term yet, anyone who thinks the CPU will replace Random Logic is out of his mind. Well, it's good to be out of your mind. Brad Parkinson, who won the, I'm checking on time how I'm doing, Brad Parkinson, who won the top award from the IEEE for GPS had the same situation. Another way to see the wisdom of foolishness. For every good idea that I've had that's paid off, I've had to do at least 10, maybe 100, and who but a fool would get excited by idea number 10, which a priori looks no different from ideas one to nine, all of which failed. And yet if you don't get excited by idea number 10, you have no chance of success. So let me give you some examples to not on so much the wisdom of foolishness here, but rather beginner's mind. So I'm going back to my PhD thesis 50 years ago. It was on something called learning with finite memory. And the mathematics is not that important, but you'll see the conclusions are. You have a sequence of observations, x1, x2, an infinite sequence that are independent random variables identically distributed according to some probability distribution, p of x. And p of x is one of two known distributions. So all the variables are picked according to either p1 of x, or all of them are picked according to p2 of x, both known. And it's well known in this case that the error probability goes to zero exponentially as the number of samples tends to infinity, the Batacharya or the Chernoff bound, for example. But what happens if memory is limited as it always is? That's the learning with finite memory. Well, when I first came to this in 1966, 67, there were about 20 papers, and they all defined finite memory the same way. You could remember the last K observations. Well, as I worked on it, for various reasons, I redefined memory as the number of states in memory, the number of bits. So a three-bit memory can have eight states. And this, of course, makes much more sense. First lesson, just because everybody else has done something a certain way, don't be afraid to redefine it. You need to either be arrogant or courageous. And actually, I talk about that elsewhere. It won't be here, but there's a fine line between being arrogant and courageous. And the one thing I would recommend is it's good to be courageous. It's not good to be arrogant. And so if you have a friend, a wife, a husband, and they say you're getting arrogant, pay attention, dial back a little bit, and that's the way you'll be courageous. So let me give you an example. The first problem we considered was a trick coin. You made a coin that was going to have 75% chance of showing heads and 25% chance of showing tails. Unfortunately, you dropped it on the floor before you stamped heads and tails on it. So you pick it up and randomly stamp heads and tails. So either the probability of showing heads denoted by P is 0.75 or 0.25. And let me see what I'm doing on time so I know what I'm up to. Eight minutes. No, I need to speed up. OK, so this is actually a figure from my thesis. I pulled it out. I scanned it. So it was done by hand. And in this case, you might think if you're trying to determine whether the coin is biased three quarters toward heads or three quarters toward tails, you might use the saturable counter. Move up one state on heads, down one state on tails, and it saturates because if you reach state M, you can't go higher. You stay there in state one. If you get a tails, you stay there. Well, I had no idea how to solve for, but beginner's mind is coming in here. I had no idea how to solve for the steady state distribution. Mu of i is the probability of being in state i, where i goes from 1 to M, as the number of observations tends to infinity. Well the usual way to do it is to look at the fact that like state two has probability flowing into it from state one and from state three. We get a second order difference equation. So just like in differential equations, you end up with a solution which has two undetermined coefficients a and b. But lo and behold, a turns out to be zero. So you just have one undetermined coefficient, really, b, that has to be solved from the boundary conditions. So I looked at this, and I was childlike enough, which is another important thing, curious enough. I wonder if there's a first order difference equation that I could get, so I wouldn't have to deal with a. So I came up with a new way for solving Markov chains like this. Instead of looking at the probability flowing into a state, I looked at the probability flow across a boundary. So like in this case, I divided the machine into state one and everything else. What in steady state, what's the probability flow from left to right? Well it's p times mu of one. That must equal the flow from right to left, which is q times mu of two. Well of course that's true in general for all i, and you can quickly see that you just get a single exponential, and it's easy to then solve for it. Okay, and it turns out, now you might say, so big deal, you were able to find another way to solve Markov chains. That proved to be critical in establishing a lower bound on the error probability and showing that you could achieve it. And this is the canonical, again from a diagram from my thesis, the canonical form of the epsilon-optimal machine. You move up one state on what I call h sub epsilon. It's the maximum likelihood ratio event. It's the events that most favor the hypothesis, let's call it h one, where you decide in the right half of the machine. T sub epsilon are the observations that are most in favor of the other observation. So just like with the saturable count, you move up one state or down one state, and by the way, you're throwing away most of your observations. You only move up one state or down one state on the most informative observations. Why can you do that? Because you have an infinite number of them. Even if you throw away 99.9% of an infinite number of observations, you still have an infinite number left. And this makes sense because you only want to move up on the most informative observations. You want to preserve the value of each state, and you only want to move up one state. The k over here, let's see where is it. This k is needed because unlike the coin tosses, it might turn out that there's a drift to the right or a drift to the left under either hypothesis, and you need to match for that. It's almost like a matching transformer in electrical engineering. And the deltas at either end, you notice that you only leave state one with probability delta, and you only leave state m with probability delta, where delta tends to zero to get close and closer and closer to the optimal machine. Because you're most certain of your decisions in state one and state m. The states in the middle are not as informative. Anyway, all this came because I took the second order difference equation and said, okay, we need a different model. Yeah, I'm running a little behind so I better speed up. Okay, my first year of graduate work, but so this is for those of you who sometimes wonder, should I continue doing my PhD? Who am I to make an original contribution to research? I had that same second year slump. I felt like I'd hit a brick wall just before I got this result that became my thesis, and I was wondering, should I drop out of the PhD program? Well, over spring break, I decided I was going to, part of the problem was I was taking a lot of courses, so over spring break, I was going to put in at least 40 hours, just like a regular job doing research. Within the first half hour, no, oh, let me back up. Within the first half hour, I had the result, so you can go, especially with theoretical research from thinking you're dead to being totally alive and in heaven in a very short time. By the way, if something happens in half an hour like that, it meant that it's not purely rational thinking. Something was going on at an unconscious level, and I don't have time to go into it, but one morning I woke up and I just had the solution to a problem that had been bothering me and clearly my unconscious mind had been working on it. Actually, I'll skip those because I'm running behind. I wondered, could I play all day, sleep all night, and get great research results? I mean, this sounded fun. Of course, you have to do the hard work to put all the raw ingredients in there for your unconscious mind to work on it. But there is an important lesson. Don't slave drive yourself. Don't just work and work and work and work. Give yourself time to let things marinate for the results to come up and trust your intuition very quickly. There was a PhD student at Stanford who was in mine, but his advisor, who had been my advisor, really liked the research he was doing, but he had failed the PhD qualifying exam twice. And usually you cannot take it a third time. But he got a special dispensation, but he'd better pass it this third time. I offered to help him. I said, come to my house, I'll give you a mock exam. I gave him a question, and he was doing horribly. So I stopped him, and I said, so let's talk about how to do this differently. And as I described it to him, he said, that's what I was going to do initially. That's what I intuitively felt, but I figured it couldn't be that simple. And so when he took the exam, he didn't overthink things and he passed. Beginner's mind. I did it in the diffusion approach that I used in my thesis. But also I did my best work in cryptography. We came up with public key cryptography when I knew maybe one-tenth of the relevant mathematics that I now know. Of course, you were a math major, so maybe you were better. But would you also say that you did the best work when you knew much less than you now know? Of course. Of course. That's the reason. No, it's... Okay, no, but you did learn a lot more later. Yeah, but I didn't discover other things because of the personal things I did. Okay. I'm not saying you shouldn't learn more, but just don't be afraid. If you wait until you know everything you should know to do research in an area, you'll never do research because you'll never know it all. Many others have experienced this as well. I'll give just one example. Andy Viterbi would be better in a communications audience, but how many of you have heard of USC, University of Southern California? I mean, if you know that the... Well, the engineering school there is the Viterbi School of Engineering. Why? Because Andy Viterbi gave them over $50 million. Now how did Andy get this money? He and Irwin Jacobs founded Qualcomm, which is a huge company, but Andy had a paper. He's famous for Viterbi decoding, which some of you may have heard of. I asked Andy, I had heard that he had trouble... The reason he came up with Viterbi decoding was because he didn't understand sequential decoding, which was the technique being used before. He said it wasn't exactly right, but he did have trouble getting students to understand the performance of sequential decoding, so he attacked it in a different way. Oh, yeah, I'll skip that. Let me talk about public key cryptography because no talk by me or Whit would be complete without that. What is public key cryptography? First of all, this is a picture of... I'm in the middle, I had a little more hair, and Whit looks roughly the same. He's just matured. The third guy on the left, or your left, is Ralph Merkel, who independently came up with the privacy part of public key cryptography. Public key cryptography is important. This is one way to explain it. It protects more than $5 trillion, and since we use trillions differently, that's five times 10 to the $12 every day in financial transactions. I wish our patents were still valid. It's essential for secure software updates. It's really at the heart of security on the internet and in the digital economy. It broke out of a groove, or what, and often they're the same, dating back to August Kerkopf in the 1870s. Whit knows this history better than 1871, he thinks, somewhere around there. I'll skip that. The same thing happened, by the way, with Einstein. He broke out of a groove or rut that the physicists were in about white being a wave, not a particle, but I'll skip that because we're running well on time. To understand with public key cryptography, let's start with conventional cryptography, which is the old form where you need a single secret key to communicate. This is a more modern picture of Whit and myself, taken at one of the awards ceremonies. I have a message I want to send to Whit. The trouble is my wife, Dorothy, is listening in. Maybe we're planning a surprise birthday party for her. What I do is I generate a red, remember, this is conventional cryptography, not public key. I generate a random key K, I get a courier to take it to Whit. Notice the courier is a secure channel. It's not the channel that Dorothy can listen in on. So Whit gets the key. I then can encipher my message using the key that I know and Whit knows. I can send it to Whit. Unfortunately, Dorothy gets it, but that's not a problem because Whit can decipher it, but Dorothy cannot. She does not know the key. Conventional cryptography. Now, most people, when they think of conventional cryptography or cryptography at all, think in terms of privacy. Dorothy can't see the message that Whit and I, she can't understand the message that we're sending. But authentication is at least important. So we get both because Dorothy does not know the single secret key, and she's therefore unable to either end, to decipher the message I send Whit. That's privacy. She also cannot encipher a message and send it to Whit and make it look like it came for me. That's authentication. So the important thing is authentication is actually more important in the digital economy than privacy, even though most people don't think about it. Think about banking. If I'm writing checks on my bank account and you can read all the checks I wrote, you're violating my privacy. I'm annoyed. But what happens if you can write any check on my account? Then you're violating the authentication and stealing money. So authentication is at least as important as privacy. Now, what are the problems with conventional encryption? The first is that we need couriers or registered letters or something to send these messages. Let me see how I'm doing. 21 minutes. Yeah, doing OK. The second problem is that conventional encryption can protect against third-party forgeries, like Dorothy injecting a message to Whit, but they don't prevent Whit, because he's a very dishonest character in case you don't know this, from encrypting a message and sending it to himself and claiming that I sent it. Like, if he's my stockbroker and I'm a client and he's trading in my account for his own purposes and he loses money, he wants to make it look like I sent the message, because we share a single secret key. And public key cryptography can provide what we call a digital signature, and it's message dependent, which is very important. And this also is what's used for secure software updates. Well, let's look at how public key cryptography solves the first problem, that of couriers. It allows the seemingly impossible. And let me talk in terms of the room. I want to communicate with Whit, and we have not prearranged a key, have we, Whit? I hope he cooperates. We haven't. So if I call the message out to him, Bob Tarjan there, we'll hear it, and I don't want him to hear it. If I tell Whit the key, Bob will hear the key, so I can't have a courier. But, of course, if Bob has, or Dorothy, has unlimited computing power, they can understand anything Whit and I are saying. That's why it sounds impossible, but nobody has unlimited computing power. And so that's the trick. Can we come up with a system that Whit and I, and actually I'll pretend Dorothy's sitting there since I use her on the sides, and plus I don't want to make you the bad guy. And Dorothy doesn't mind. So can we exchange messages with just a fraction of a second of CPU time that would take Dorothy millions of years to understand or to forge? Well, let's first consider messages written on pieces of paper, because that's easier to understand. So here we are again, me and Whit and Dorothy's in the middle. So every message I pass to Whit, Dorothy gets to hold it. So I put my message inside a strong box, and I lock it with a lock that only I know the combination to. ML is Marty's lock. I then give the box to Dorothy. Can she open it? Nope. She gives it to Whit. Can he open it? Unfortunately not. I wish he could. But I made the box big enough for Whit to put a second lock on. Whit's lock. He then passes the doubly locked strong box back to Dorothy. She cannot take off either lock. When I get it, what can I do? Take off my lock, leaving only Whit's. I then pass it back to Dorothy, who gives it to Whit, who can do what? She can't open it, but Whit can take off his lock and get the message. Now, it's important in this that the operation be commutative. Addition, by the way, is a quick reminder is commutative, whereas subtraction and division are not. Now, what's commutative about the lock analogy? The locks could be put on and either order and taken off and either order. It didn't matter. It's commutative. Removing it would not be commutative if only one lock could fit on a box, as shown in this picture. Let's say that I had made the strong box like a normal strong box, where only one lock fit on it. When Whit got it, he could put my strong box in a bigger strong box and put his lock on the outside. But when he passed it to Dorothy back to me, I can't get inside to take off my lock. It's not commutative anymore. Now, the discrete exponential function that we used in what's now called Diffie-Hellman key exchange is a commutative one-way function. And I sometimes try to get this called Diffie-Hellman-Merkel key exchange, because this part of the invention, we actually came up with a Merkel system. I won't go into the details, but Ralph deserves credit here. So the function that we used was y equal alpha to the x-mod q, where q is a prime number, and alpha is some base. Now, you can quickly compute exponentials, like alpha to the ninth. You don't have to do eight multiplications to get it. Square alpha, that's one multiplication, squared again, squared again. That's three multiplications, and you get alpha to the eighth. And the numbers don't get bigger and bigger and bigger because you're doing this mod q. You can always reduce down after each phase. And so you got alpha to the eighth with three multiplications. You get alpha to the ninth by multiplying by alpha to the first. In the same way, if you have a thousand-bit prime, it takes at most 2,000 multiplications mod q to do the exponentiation, which is fast on a personal computer, for example. On the other hand, going in the reverse direction, which is known as the discrete logarithm function, is hard. By the way, there's no proof of this. There's a lot of indications, but no one's proved that someone could break this. And so if you want to win a Turing Award, you know what to do. Now, when I was playing with this one night, the discrete exponential had been suggested to me. Let me see where we are. Yeah, not bad. Had been suggested to me by John Gill, who I'll have a picture of him in a minute. And I said, let alpha and q be fixed. Everybody knows it. And then, if which could be secret and which could be public, we needed a secret key and a public key. X had to be the secret key and Y the public key, because it's easy to go from the secret key to the public key, but hard to go from the public key to the secret key. If it's easy to go from the public key to the secret key, the secret key is not really secret. And now, OK, then what I came up with is, after playing around, I realized that when two users, like you and I, want to talk, I use your public key and my secret key, you use my public key and your secret key, Bob can't get it. When Bob and I want to talk, we do the same thing and you can't get it. And so what is it? If you raise yi to the xj power or yj to the xi power, one uses public key, the other uses secret key, you get the same result. Oh, sorry. You get alpha to the xi xj, because it's commutative. Whether you do alpha to the xi and then xj or the reverse alpha to the xj, then xi, you get the same result. It's a commutative one-way function. So how did we discover public key cryptography? One of the things Witt and I realized as we were working is that there was a taxonomy. In fact, in privacy and authentication, our 1978 tutorial paper, we call it the taxonomy of cryptography. And the simplest function of cryptographic interest was a one-way function, then a conventional crypto system. And we didn't yet have public key, but we did see that a trapdoor cipher would be wonderful for a general. Because if I'm a general and I have an army and I'm fighting Bob's army, then I want a really secure Dorothy's army. OK, you're right. It's nice that she stayed home. I want a secure cipher system for my troops. But if Dorothy's army captures it, I don't want them to be able to use it. And so if there's trapdoor information that I know that allows me to break it quickly, if they use it, I can break it. Now, Witt and I never came up with a really good trapdoor cipher system. But we realized from trapdoor cryptography to a public key system was a small step, which I won't go through here. Wow, I will. I generate a trapdoor cipher. I tell it to everybody. Witt, who I want to talk to, then generates a random key. And cipher's a message to me with that key. I can get it because I know the trapdoor information, but none of you can. Public key cryptography. Trapdoors, many people call public key cryptography trapdoor ciphers. But as this example shows, trapdoors are used everywhere in cryptography. In fact, they're essential to all cryptographic problems. I'll skip that one. It's closely connected to Stephen Cook's P equal and P question, is basically if P were to equal and P, roughly speaking, there are no secure cryptographic functions of any type. I mean, you get into problems because it's polynomial versus non-polynomial. And n to the 100th is a pretty big polynomial. But that's roughly speaking the case. So what was John Gale's contribution? By the way, if you were very observant, you saw his picture on the first day. Dave Patterson, in his talk, showed the Stanford Berkeley crew that created the risk processor. John was there. And he looked pretty much like this. This is John in 1976. And so I went to John. I started. I said, oh, why did I go to John? He had a PhD in mathematics. He worked with Manuel Blum, by the way, at Berkeley. And so he could have done it in computer science, but he did it in mathematics. He was a better mathematician than me. So I went to him and asked him for the simplest cryptographic function. I said, John, what functions do you know that are easy to compute but hard to invert? He suggested factoring, which we'd already thought of. Unfortunately, we hadn't played with it enough. Once we had public key cryptography, oh, we would have gotten the RSA system. But we missed that. And so then he said, what about indices? I said, what are indices? John's a mathematician, remember? And what we call discrete logarithms, mathematicians, at least in those days, called indices. So sometimes just asking people for simple advice can be really helpful. Now, Ralph Merkel, who was in that earlier picture, was an undergraduate at Berkeley and then a master's student. And he took a CS 244, a information security course, in the fall of 1974. And he had to do a term project. We were working independently, by the way. We didn't know about Ralph at this point. He didn't know about us. And he proposed the privacy part of public key cryptography as project number one, establishing secure communication between separate secure sites over insecure communication lines. That is public key distribution. It's the privacy part of public key cryptography. Notice what the professor wrote in blue. Project two looks more reasonable. The mundane project may be because your description of project number one is muddled terribly. Talk to me about this today. So what did Ralph do? He dropped the course and did public key cryptography anyway. Unfortunately, the CACM rejected Ralph's paper. They eventually published it. The editor wrote, I was particularly bothered by the fact that there are no references to the literature. Has anyone else ever investigated this approach? No. She sent it to an experienced cryptographer, is the way she described him, because the referees are anonymous, who wrote back, the paper is not in the mainstream of present cryptography thinking. I would not recommend that it be published. So if you get a paper rejected, do what Ralph did. Keep at it. And by the way, I also had a paper rejected. And at one of the dinners, I think, I was talking to Ahmed Queshi, I think, is his name, from Pakistan. But he's at UC San Diego, if I remember. And he said, oh yeah, my advisor and I had a paper rejected from a conference. And we submitted the exact same paper the next year. And it was awarded the best paper award or something like that. So reviewers are not perfect. Public key, I'm going to skip this, I think. Let me see what we're doing on time. Yeah, I'll skip that. Yes. Go back one point. That second, the experienced cryptographic expert, I haven't been able to identify that person. OK. Other repreying actions. I think that was an NSA guy whose purpose was. OK, so Whit, since you couldn't all hear it and it's not on the tape, Whit said, he's tried to identify who the reviewer was. He believes he's someone from NSA, which I also agree with. And he thinks that he may have been trying to kill the paper. That's a possibility. But that would be really, really nasty. NSA does not stand for nasty security agency. OK. I'm going to skip this because we're running a little short on time. And I know that I'm between you and lunch and bathroom break. And we didn't have the coffee break. So to summarize, what are the secrets from 50 years of research? This is repeating what I said. The wisdom of foolishness. Don't be afraid of appearing like a fool. I was at Tom Kylat, some of you know him. He's won the National Medal of Science. President Obama bestowed it on him. And at his 80th birthday party a few years ago, a woman asked what I was doing. And I told her my wife and I were working on a book on creating true love at home and peace on the planet. And she said, she was polite, but she said, you're barking up. You're on a fool's errand. Instead of getting mad, my face lit up and I said, thank you. That's the best compliment you could pay me. And fortunately, Jim Omura, who some of you may know, he'd been a professor at UCLA, was standing about six feet away. I said, Jim, come tell this woman what you told me when I first started working in cryptography. And he said I could quote him on this so I knew that he would tell her that Marty, you're crazy to do this. Embrace your fears. Notice how Dorothy embraced her fear of terror rather than running away. And I've had that happen too. There was some Richard Chropell's analysis of factoring algorithms which showed the sub-exponential behavior. Initially, I felt, well, I can't understand that. And finally, one day, I sat down and just worked away at it. And it was easy. By the way, now it seems impossible again because I've forgotten how to do it. Beginner's mind, don't wait until you know everything that you think you want to know to do research. And embrace the irrational. There's an interesting interplay between the rational and the irrational in doing research. If we only did it rationally and linearly, we'd never get breakthrough results. And even great papers are sometimes rejected. So don't get dejected. So I'm going to end instead of with an equation, with a picture of a gorgeous glider. What does this have to do with all this? Well, it has to do with the wisdom of foolishness. The first time I was talking about the wisdom of foolishness many years ago, I stopped in the middle of the talk and I said, well, of course, when you're brainstorming, embrace foolishness. But when huge sums of money are going to be invested, when lives are at stake, you need to bring cold, hard logic to bear before you go forward. And as an example, I just picked out of the air I hadn't thought it through. I said, for example, if someone proposed a solar-powered airplane, I would tell them, that can't happen. You can look at the wing area, how many photovoltaic cells you could put there, what the maximum efficiency is, how much power the plane needs, and see, it's impossible. And as I'm interrupting myself to say this, I stopped and I said, wait a minute. I fly a solar-powered airplane all the time. I don't now, but I did back then. I flew a glider just like this. This is not me, and this is someone else doing this maneuver. But it doesn't have photovoltaic cells on the wings. Rather, the sun heats up a big valley many square kilometers, and it creates a bubble of hot air that then rushes up in a concentrated thermal. It's concentrated. And so I was stuck. Even when you try to be a fool, you sometimes will miss it. So keep that in mind. Thank you very much. So Andreas, do we have time for some questions? Oh, yes, absolutely. Thank you, Martin, for your very illuminating personal talk. First question. Well, I've been doing research for a long time now. I'm 85 years old. Oh, even a little longer than me. And I disagree with much of your advice. Oh, good. But there is one piece of advice I'd like to reinforce. It has to do with getting discouraged. I started graduate work in 1954. My first publishable paper, or so I thought it was publishable, was finished in 1955. And just after I finished it, I went to the library to see what's new. And there, in an Italian journal, was an article about my stuff. It was written by Alexander Oztroski. And at first, I thought, well, I've been scoped. But then I looked him up. He's been publishing papers since 1911. Aha, I thought, I'm catching up. So by the way, I have one school of thought about how to do research. You have another. Neither one is right, neither one is wrong. Try them both. Questions? OK. I love this portable microphone. Yeah, I did. Yeah, anyway. So I don't actually do research in cryptography, but I think about it a lot. And quantum cryptography, and you were talking about, all these crypto systems are based on trapdoors. And something I often think about is, aren't there heaps of trapdoors? I feel like I'm always, like I do maths research. And I'm always doing these things that I feel can't easily be reversed. And then I'm like, is there a crypto system that could naturally somehow arise from that? But I don't know. What do you think of the main obstacles to turning a trapdoor that you see into a cryptosystem? Or is it just that you can't verify that it really is a trapdoor? I think luck is the main obstacle. And you never know. Like the Traptor and Apps Act that Ralph and I worked on turned out not to be so good. Ron Rivest had a MDE, let's see, Ron's algorithm. He's had systems that have been broken. So you have to not be afraid of having systems broken, is what I'd say. And just try it and take it to somebody else and see what they say. Because you need a fresh mind. When Adelman has often said he doesn't think he belongs on the RSA paper because he didn't actually come up with RSA, what he did was, he was the guy that kept shooting down all their previous algorithms. And this one, he couldn't shoot down. And that's when they decided it worked. But that's critical. OK, is there another question? Other questions? Somebody over there, bring your microphone. It's probably faster. So you talked to us about the fine line between courage and arrogance. Where is that line? Where is that line? So by the way, you can download the book that my wife and I wrote free of charge at annumap.com. If you go to my Stanford home page and look, I think it has a link there, certainly, if you then look for publications. And what I realized, there was a man who impressed me as an arrogant Jewish professor from New York. The full story is in the book, so I don't have time to do it here. I'm Jewish. I'm from New York. I'm a professor. And arrogance was too much. I hated him. I didn't even know I hated him. But there's a way that something happened that made me realize I hated him. He was my dark side made incarnate. The dark side is the side of ourselves that's so important to our conscious minds that we cannot accept that it's there. And if we push it down and don't face it, don't embrace our fears in this case, it runs us around. And the story explains it more. I came to realize that he was my dark side made incarnate. And I actually had to face it. And so then I realized that arrogance has stood me in good stead. When Witt and I took on NSA almost singlehandedly in the late 70s over the data encryption standard and over the freedom to publish papers in cryptography, I remember my mother calling me and saying, what the hell are you doing? You're going to get yourself hurt, killed. And it wasn't just NSA. It was their foreign equivalents that were probably unhappy. And so I realized that that's when I realized that there's a fine line between courage and arrogance. And the one thing I came away with from this is, first of all, I need to be open to the fact if Dorothy, my wife, she's the best one for telling me this. She says, Marty, I think you're beginning. I think you're getting a little arrogant here. Rather than like 30 years ago, I would have said, not me. And I never would have taken it. Now, she might be right. She might be wrong. It's also a matter of perspective. Let me dial back a little bit and go back, make sure I'm on the courage side, not the arrogance side. OK. One more question. Oh, I can't possibly throw it back there. Somebody in the middle of the room will help me. Really? Without killing any of the young researchers. Thank you. Sorry for any casualties along the way. So my question is about the information sharing that we were doing. Like you send the key to the Diffie through Dorothy, and he puts a key, and he returns you, and you take off the key. But what if Dorothy puts a fake key with the name of Diffie, and sends you back, and you perceive it as, you got the question, right? Yeah. He just described the man in the middle attack. What if when I passed the strong box with one lock to Dorothy, instead of giving it to Witt for him to put his lock on, she puts her lock on. I can't tell the difference between her lock and Witt's lock, and she gives it back to me. I take my lock off, and I pass it to Dorothy. I think it's got Witt's lock, but it's really got Dorothy's lock, and she can open it. It's called the man in the middle attack, and there are ways to deal with it. I don't have time to go into it here. So SSL 3, which is very much like TLS, the transport layer security, that guards against man in the middle attack. It's a very important attack. Thank you for mentioning it. I actually thought about saying something, but we were running well on time, and so I'm glad the question came up. OK. We are exactly on time. Thanks again, Martin, for your presentation. Thanks. I was glad for attending. Thank you.
of this year's Heidelberg Lord Forum is Martin ingredients for successful research. Martin, over 50 years of doing research myself and also the talk is embrace the irrational, which sounds exaggeration. This is the work, by the way, that exaggeration to say that all of my colleagues so foolish, as you can see from the Turing Award. beginner's mind is coming in here. I had no idea Beginner's mind. I did it in the diffusion my best work in cryptography. We came up with public key cryptography when I knew maybe one-tenth of the relevant mathematics that I now authentication is actually more important in the Turing Award, you know what to do. Now, when I Don't be afraid of appearing like a fool. I was embraced her fear of terror rather than running is not me, and this is someone else doing this paper, or so I thought it was publishable, was always doing these things that I feel can't