 The presentation is composed of six parts, introduction, description of RAPM D160, calculate the step differential probability, solve this equation, clean attack, and improve standard freestyle clean attack. As we know, most published hash functions are based on the Merkle-Dengar paradigm by generating a compression function with fixed input size and output size. Therefore, a hash function can compress out-train load messages and output a fixed load of hash value. For a hash function, there are three best-called security requirements. There are clean resistance, pre-image resistance, and second pre-image resistance. Since a hash function compresses out-train load messages by generating a compression function, the compression function itself should also satisfy some security requirements. There are same freestyle clean resistance and free-stop clean resistance. A same freestyle clean means two distinct messages and the same chain variables lead to the same output of the compression function. And a free-stop clean means two distinct messages and two distinct chain variables lead to the same output of the compression function. This is the history of the analytical results of MD-SHAR hash family and shows our motivation to quick-tangle as RAP-MD160. Also these long results form RAP-MD160 in this table. The number of marks in red at the steps column means the attacks are not from the first step. Our results are marked in green. We improve the same free-stop clean attack by a factor of 2 to the power 15.3. We also give the first clean attack for the first 30 step RAP-MD160 with some complexity 2 to the power 67. In this part, I will give a brief description of RAP-MD160. The compression function of it is composed of two branches, the left branch and the right branch. Each branch consists of 80 steps divided into five rounds with 16 steps per round. And this is the step function used in both branches. XI is the internal state used in the left branch. YI is the internal state used in the right branch. Also, I introduce a temporary state QI for later use. To calculate QI, we need to know M, K, Y minus 1, Y minus 2, Y minus 3 and Y minus 5. To calculate YI, we need to know QI and Y minus 4. Okay, this part, I will introduce the open problem and give our method to solve it. At Asia Quick 2013, Mendel proposed an open problem to calculate the step differential probability of RAP-MD160. Since the step function in both branches has the same form, we only consider the right branch and the left branch can be processed in the same way. Then, the open problem is how to calculate the probability that both the bit conditions of YI and the model difference of YI are specified under conditions of all conditions of Y minus 1, Y minus 2, Y minus 3, Y minus 5 are specified. In fact, in previous work, people only considered the bit conditions of YI. Therefore, it is difficult to give an accurate value of it. For simplicity, I will introduce two notations. New and new. New represents the event, the model difference holds, and new represents the event, the bit conditions holds. Our method to solve the open problem is to calculate the probability of an equation at first, which is used to ensure the model difference can be correctly propagated. Then, we calculate the probability of the bit conditions under conditions that the model difference holds. In the world, we solve this problem by introducing the conditional probability. Now, I will describe how to construct an equation to ensure the model difference can be correctly propagated. Showing this figure, to ensure the model difference of YI delta holds, we can construct an equation 1. By simplifying this equation, we can finally obtain the equation 3. Give a differential pass, the value of delta YI minus 5 delta F delta M are all now delta and delta I minus 4 are all now. So, in this equation, C0 and C1 are non-constant, and QI is available. Therefore, we can convert this problem into calculating the probability. T satisfies this equation, where C0 and C1 are non-constant, and QI is available. Our rule of thumb has supported in 205 in his PhD thesis. We try to reconsider this problem from a different perspective, and our new method will not only give a value of this probability, but also reveals some useful information of T. For better understanding, we use a figure to describe the calculation of T plus C0 to the left by S bits plus C1. Then, the target is to calculate the probability R0 equals to R0 prime, and R1 equals to R1 prime. To ensure R0 equals to R0 prime, there are two cases. The first case is the high S bits of C0 equals to the low S bits of C1. The second case is that the high S bits of C0 plus 1 equals to the low S bits of C1. To ensure R1 equals to R1 prime, there are also two cases. The first case is the low 32 minus S bits of C0 equals to the high 32 minus S bits of C1. The second case is that the low S bits of C0 equals to the high 32 minus S bits of C1 plus 1. Due to limited time, I only give an example here, and the general case can be processed in the same way. For example, we need to calculate the probability T65, this equation. Firstly, we write the constants in binary. To ensure R0 equals to R0 prime, carry R0 must be 1. To ensure R1 equals to R1 prime, carry R1 must be 0. To ensure carry R0 equals to 1, there are several cases. For example, the 19th bit of T equals to 1, or the 19th to the 80th bit equals to 0, 1. To calculate the probability carry R1 equals to 0, we can firstly consider the probability carry R1 equals to 1. To ensure carry R1 equals to 1, there are also several cases. For example, the 21st bit of T equals to 1. These are the details of how to calculate the probability carry R0 equals to 1 and carry R1 equals to 0. We call the 19th bit of T equals to 1 a possible characteristic of T. We call the 31st bit of T equals to 1 an impossible characteristic of T. In total, there are 17 possible characteristics of the low 20 bits of T and 3 impossible characteristics of the high 12 bits of T. Now, I will describe our method to calculate the stamp differential probability. For better understanding, I will use this figure to describe the calculation of yi. Given the differential path, the big conditions of yi and y-4 are fixed. In other words, some bits of yi and y-4 are fixed. To ensure the model difference can be correctly propagated as stated before, we can construct a portion of qi and can obtain the characteristics of the high aspects of qi and the low such 2 minus aspects of qi. The characteristics of these two paths can be considered independent. Therefore, we can also divide the calculation of yi into two paths, the high such 2 minus aspects and the low aspects. The only link between these two paths is the carry, so we consider two cases. There is carry, there is carry and there is no carry. For each case, we then can consider two paths independently and the problem can be reduced to calculating the probability c equals to a plus b, where some bits of a, b and c are fixed. For example, to calculate the 4-bit conditions on c-hole under a condition that all bit conditions of a and b-hole, we can consider from the high bit to the low bit. It is an easy mathematical problem. We will further increase the readout of paper for more details due to a limited time. Next part, I will give our master to solve this equation. Firstly, we convert the right part of this equation into another form by introducing a temporary variable c2. Then, given a condition c1, c2 can only take the following four possible values. It is even to verify this operation according to our master to calculate the probability, the model difference holds in previous part. Then, based on this operation, we can simplify the calculation and finally obtain the equation 6. By adjusting 2 to the power such two possible values of t, we can pre-compute the solution to the equation 6. Therefore, both the time complexity and memory complexity are 2 to the power such two. To evaluate the efficiency of our master to obtain the solutions, I will firstly give the expectation of the number of solutions. Given a fixed c0, one value of c1 will correspond to several solutions or no solution. For simplicity, I will introduce four notations. If no represents the number of the solutions, I will present the probability there are i solutions during the equation and I will present the number of c1 which corresponds to i solutions and will present there are most n solutions to the equation for k of c0 c1. Then, we can obtain the three following equations and finally, we can calculate the expectation of each node. Its value is 1. Now, at the end of this part, I will describe our master to obtain the solution. It can be divided into four steps. Given a fixed c0 c1, firstly we can calculate four possible values of c2 and the corresponding c3. Secondly, according to the pre-computing solutions and the value of c3, return all possible solutions. The expectation is four possible solutions. Thirdly, we can check all the possible solutions t since t specifies this equation with probability. At the last, return the correct solution. The expectation is one correct solution. Therefore, the time complexity of our master to obtain the solution is four times of checking on average. I have to stress that in previous work, they always construct a table of tutorial power such 2 plus tutorial power such 2. Therefore, our master to obtain this equation is improved the previous master by a great factor. In this part, I will give the clear attack on the first 30 steps of M1.6.0. Due to a fast diffusion of the x-all operation as the first round in the left branch, we exert a difference as the magic word M15 which is used as the last step of the first round in the left branch. Our strategy to find a differential path is that for the left branch, we deduce that hand. For the right branch, we search by the automatic tool invented by Mendo. To ensure there are only a few big conditions on the left branch, it should be very fast, and for the right branch, it should be as fast as possible. The strategy of the clear attack is that we only apply the method modification techniques on the right branch until Y23. For the first round in the right branch, we apply the single step modification. For the second round in the right branch, we apply the multi-step modification. We don't introduce the method modification techniques here. Instead, I will introduce our method to control to ensure the model difference can be correctly propagated as the phase of method modification in the next part. As stated previously, not only the big conditions, but also the model difference should be satisfied to ensure the model difference can be correctly propagated. We can add extra big conditions on the internal space to control the characteristics of QI, which will always have the model difference of YI holds. Then we can also use the method modification techniques to ensure the model difference can be correctly propagated since the big conditions can be corrected by this technique. For example, we choose two possible characteristics of Q13 to ensure the model difference of Y13 can hold. In other words, we impose two big conditions on Q13 to ensure then by adding four big conditions on Y9, the two big conditions on Q13 can hold with probability Y. In this table, you will present the big exchange from 1 to 0 and N will present the big exchange from 0 to 1. Then, by applying the method modification techniques to correct all the big conditions on Y9 and Y13, the model difference of Y13 can hold with probability Y. All the extra big conditions are listed in this table. Since we only apply the method modification techniques until Y23, we don't control the characteristics of QI, while I is greater than 23. Also, you may observe that we don't control the characteristics of Q20. The reason is that to control the characteristics of Q20, we need to add several big conditions and it is difficult to correct all the big conditions so we make a trade-off and leave Q20 holding probabilistically. Now, I will give an example to explain the importance of controlling the characteristics of QI. To correct the fourth bit of Y13, we can change the 27th bit of M6. To achieve it, we can change the 27th bit of Y9 by modifying M13. Then, modify M6, M15, M8, and Ym to ensure Y11, Y12, Y13, and Y14 stay the same. Then, in this way, the fourth bit of Y17 can be corrected. However, at this space, Q9 and Q13 are changed. Each time the natural Q9 is changed, since there is no constraint on it. However, Q13 has to specify its corresponding equation to ensure the model difference of Y13 holds. If we don't control the characteristics of Q13 and it is changed at this space, it may not specify its corresponding anymore. Therefore, however, in other words, a probability was introduced at this space and this is bad for message modification. However, if we have controlled the characteristics of Q13, it doesn't matter it's changed. And this is the importance of controlling the characteristics of Qi. At the last, I will give the probability of the clear attack on the first such step, Rmd1, 6, 0. For the left branch, we don't apply any message modification techniques and the holds with probability 2 to the power of minus 29 for the right branch after applying the message modification techniques. It holds with probability 2 to the power of 38. In total, the probability of our clear attack is 2 to the power minus 67. The last part, we improve the semi-free-stop clear attack on the first 36-step Rmd1, 6, 0. We use the 36-step differential cast discovered by Mendel-Irpacianquip 2013 and the method proposed at Euroquip 2013. The method can be divided into three steps. The first step is to find a starting point. It means we choose internal states in both branches and fix some message rules to ensure the nonlinear parts. The second phase is merging. It means we use the remaining three message rules to merge both branches to ensure the chain variables in both branches are the same by computing backward from the middle. The last phase is verification. It means the rest of the differential paths in both branches are verified probabilistically by computing forward from the middle. First of all, I will describe the difference between our work with Mendel's previous work at H22 2013. The difference is that we leave the message word M3 as a free message word. It means M3 will be used as the face of the working face rather than the face of finding a starting point. In this way, although the lateral part of the right branch won't be fully specified anymore, the successful probability of the merging phase can be improved by a factor of 2 to the power 32, and this is a trade-off. As the merging phase, we need to compute backward. First, I will show the modular difference that can be correctly propagated at this phase as well, and seems that such an influence was neglected in previous work. I'll show you this figure. To ensure the modular difference can be correctly propagated, we can alter an equation of qi, and then we can convert this equation into a form we have discussed previously. In order to eliminate the influence of the modular difference, we can pre-compute value M9 and the corresponding M2. The details can be seen in our paper, and then the only influence is the probability delta yi minus 2 equals to 0. Its value is 2 to the power minus 0.4. This is the details of the merging phase. Step one, we choose a value M9 and use x6, x7, x8, x9, x10, m8 to compute x5. Step two, we use x4, x5, x6, x7, x8, x9 to compute x4. Step three, we choose a random m7 and compute until x2. Step five, we choose a value M2 and compute until y0. Step seven, and this. Step two, we can construct a time equation based on x minus y equals to y minus y and x minus 2 equals to y minus 2. According to our method of terms and solutions, we can compute x minus 1, y minus 1, x minus 2 and y minus 2. Then we can compute x minus 3, y minus 3, m14, and last, we can compute x minus 1 and y minus 4. The probability x minus 4 equals to y minus 4 is 2 to the power 32. And this is an instance of terms about running the above algorithm. At the last, I will give the probability of the standard free-slap layout. The probability of the merging phase is 2 to the power 32.4. According to our method, to calculate our control probability, the left branch, the probability is 2 to the power minus 8.1, the right branch is 2 to the power 17. Also, for the given spending point in our paper, I also test the actual values of it. For the left branch is 2 to the power 8.8 minus 8. For the right branch is 2 to the power minus 16.68. In total, the probability of our standard free-slap layout is 2 to the power minus 57.5. That's all. Thank you. Just a quick question. You said all the time that you are calculating the exact probabilities, but at various steps, I got the impression that you are calculating a lower bound on the probabilities, where you control the... used the bits to control the characteristic. Are you sure that you computed the exact probability or only a bound on the probability? I think it's not an accurate probability, yeah? Because everywhere you write, equal. Since the bit conditions on the... Yeah, I use this table. In fact, we think this bit is a free bit, and in fact, it is not accurate. That could be even better, right? So that's according to our experiment. I think it's very close. A quick question. Do you think this method, and we apply it to the shower? Maybe. I don't have... I haven't done any research on shower. Sorry. Any more questions? No, let's thank the speaker.