 This is a joint work with the Alibian, I will speak about the conditional linear cryptanalysis and I will show an attack on death with less than 2 to the 42 non-planet. So linear cryptanalysis uses statistical approximations that approximate parity of subsets of bits of the plaintiffs, ciphertexts and the sub-keys. We use conditions to discard some of the data, so the bias of the remaining data may increase or decrease. Conditions can be defined by any observable information, plaintext bits, ciphertext bits and a formula of them. There are many kinds of conditions. We will show here only one of them which is highly applicable to phased ciphers. These conditions are based on the fact that the XOR of the output of the f-function in all the old rounds can be computed from the plaintext and the ciphertext. And as we can see here, the left half of the plaintext XOR, the output of the f-function in the first round, XOR, the output of the f-function in the third round is equal to the right half of the ciphertext. I start with an example of such a linear dependency with a single active S-box. The bias of the best non-trivial one-round linear approximation is minus 20 divided by 64, which is 0.312. Once we condition it on the LSB, we get in half of the data with the LSB equal to 0, a smaller bias, 0.156. In the half of the data, with LSB equal to 1, a bias of 0.468, which means it best to discard the values with LSB equal to 0 and increase the bias. In the case of four rounds, we need to use the piling up lemma. So consider four rounds taken from its best linear approximations. As we can see, in this linear approximation, both old rounds have the same active S-box, as fine in this example. And as we can see, the original bias of this linear approximation is 0.0057. It's decreased to 0 when the XOR of the LSB is 1, and it doubles the bias when the XOR of the LSB is 0. As the number of acquired data is quadratic in the bias to the minus 1, it reduces the number of needed non-plaintext by a factor of about four. On the other hand, since we discard about half of the data, we need two times this reduced number of non-plaintext. So the attack requires a total of about half of the non-plaintext than the original attack. Discards about half of them, and then uses the rest to find the key. We extended this attack to 16 rounds with several extensions, and we got higher bias due to conditions. Due to the higher bias, we could use shorter linear approximation of 13 rounds. Compared to Matsui, we got a better 13 round approximation, which led to an improvement in the complexity, which we reduced from 2 to the 43 to 2 to the 41.9. You can see this in the graph, where this is the success rate of the attack, and this is the complexity of the attack. It means the maximum between the number of needed non-plaintext or chosen plaintext, and the time analysis, and the round error is differential analysis. The orange one is linear analysis. In red, you can see our results, different conditional linear analysis, and in between, there are various extensions of linear analysis, and we can see from the graph that our result is better than all previous attack against death. Here we can see three dimensional graphs. This is the success rate, this is the time analysis, and the different colors are different amounts of non-plaintext. The red one is 2 to the 43 non-plaintext. The blue one is 2 to the 42. Thank you very much.