 Hello everyone, we now here to introduce the paper, Differential Attacks on Craft, exporting the inventory at boxes under two conditions. We will introduce our work from Bell Pass, Motivation, Specification of Craft, Containing the Differentials of Craft, Key Recovery Attacks, and Conclusion. First, we introduce our Motivation. For most block cipher with SPS structure, the decryption function is the inverse of the encryption function. In this case, we need two circuits to realize the encryption function and the decryption function. Well, in many lightweight block cipher, they use involuntary components, which means the encryption function can be transformed to decryption function with a low cost. Besides, for lower consumption, many lightweight block cipher use very simple case guide, and there are even no case guide for some block cipher. Well, this involuntary and simple component may provide convenience for attackers. Differential attack is one of the most powerful techniques to attack the block cipher, and there are two hypotheses of differential attack. Moncroft cipher and the hypothesis of stochastic equivalence. The Moncroft cipher says that the differential probability will not be influenced by the truth of the context, and the hypothesis of stochastic equivalence is that the differential probability will not be influenced by the truth of the case. Well, in fact, both of the two hypotheses will not always hold. We focus on the hypothesis of stochastic equivalence and show how to use the video of case to find the more effective differential characteristic. In this paper, we found some features of croft. Croft is a lightweight straightforward block cipher, using many involuntary and simple components, include simple max column, involuntary S-box, and a linear level, and simple case guide. And croft is a capable block cipher, so the attacker can control the take. All of these features provide convenience for attackers. Using these features of croft, we found the 16-round distinguisher with probability 2 to the power of minus 55, and a 20-round with k differential distinguisher with probability 2 to the power of minus 663. And we performed a catered carrier type of croft for the first time. We noticed that the number of rounds of croft is 32, so our result is far from stressing the security of the full croft. Now, we introduce the croft. Croft is a lightweight take for block cipher, proposed by FSE in 2019. The block size of croft is 64 bits, and the case size is by 100 and 28 bits. The master case is divided into two 64 to 64 parts, case of zero and case of one. The take size is 64 bits, take is public and can be controlled by attacker. There are five operations in my round function. That's column mc, and round constant rc, and take, will enable pn and sbox sb. mc is a simple linear transformation, and there is a special property that the last two rounds are unchanged. It allows the critical properties of our type. In rc, a constant only acts out on the yellow cell. The round constant acts out on these two cells will not influence our type. So, we'll miss this operation. For add2k, tk tmod4 is xr on the state, and the take is scheduled as that. tk0 is k0 xrt, roundt is the take, and tk1 is k1 xrt, tk2 is k0 xrqt, where q is a permutable on t, and tk3 is k1 xrtqt. We can see that the take is scheduled is very simple. pn is a permutable, and we can see that the last two rounds of zet are transformed into the first two rounds of wt, and the first two rounds of zet are transformed into the last two rounds of wt. It is another critical property of our type. sp is a slayer with 16 forward erotatory xbox. From the ddt of craft xbox, we can see that if the input difference is a, then the output difference is a 4-phase provision, found a dn. So, if they are two independent input difference a, then the probability of the output difference is one-quarter, but not one in 16. From the features of this component, we can see that if the last two rounds of tk are all zero, then we can deduce that the last two rounds of xt are equal to the last two rounds of wt, and equal to the last two rounds of zet, and equal to the first two rounds of wt. We then apply this property to a two round craft and find a translated differential child of a craft. We now introduce the translated differential of craft. Consider the two round craft. First, we focus on the red cell. We assume that tkt plus one cell, namely the orange cell as zero, then we can deduce that the value of this red cell is equal. As I see, that will change the last two rounds, and tkt plus one cell is zero, so yt plus one cell equals zt plus one cell, and pn that will change the value of the cells. So, the value of these four red cells is equal. And in this case, zt one through two xbox to xt plus two one. So, we have xt plus two one as zt plus one zt one. And we have known that xbox is imaginary, so we have zt one as equal to xt plus two one. And notice up to now, we are focusing on the video by note difference. Besides, we find a special property of craft xbox. It is that if the difference zt one is a, the difference of this is a, then the output difference zt plus two one is a, if tkt plus one cell is a. Now, we focus on the difference. Under the condition tkt plus one is zero, we have known the value of zt one is equal to the value of z of xt plus two one. And so, we have that the difference of zt one is equal to the difference zt plus two one. And if this two blue cell with difference zero, then we have this the difference on this cell as equal to the difference on this cell. So, we have that zt one as equal to zt plus two one. Under the condition tkt plus one is zero, and the third xt nine is zero, which is an invariable property of the two drunk craft, and it is the foundation of our work. Notice that using the special property of craft xbox, we can deduce that if tkt plus one cell is a cell, and the third xt one equals a, then we can deduce that the xt plus two one must be a, using the invariable property. Compared with mnrp, we found the 16-ground contented differential distinguisher of craft with the probability two to the power of mnrp is five. And the probability of random representation is two to the power of mnrp is 56. The figure of the distinguisher as listed below, we show a simplified figure of the 16-ground distinguisher. We will show that the probability of the pair x15 satisfied the fully familiar is two to the power of mnrp is 55. And this cell is an active cell, and the difference of this cell and this cell can take only four possible videos. As the difference on this cell and this cell is a, and we can get third x15 from the cell for test x16, so we have a 13-ground differential distinguisher. And the condition of the distinguisher is that we need tk1, 9, 10, 13, and tk3, 9, 10, 13 to be 0 or a. In fact, we don't know the case, so we can let the tk satisfy in this condition. But we can change the video of tk. So we can change the video of tk. There are six cells condition on tk. And in fact, we can test two to the power of tk to enumerate the tk cells. And in this tk, there must be 8 tk satisfying our condition. In this case, our distinguisher is whole. Besides, using the nnrp, we found a 20-ground vk differential distinguisher with probability 2 to the power of mnr6t3, the figure at this below. In fact, the differential characteristic we found is dirt x0 to dirt x18. And we can extend it to a tk-ground differential distinguisher, dirt x-1 to dirt x19. The condition on k exists. k1, 9, 10, 13 is 0 or a. And on k0, 0, 9, it belongs to a set. And if we can control the tk to enumerate the k1, 9, 10, 13, then the condition on k is only k0, 0, 9, belongs to a set. And in this case, the vk space is 2 to the power of mnr27. Our distinguisher requires the probability to control the tk, which is similar to relative tk time. Well, there are some differences between this two tk. First, our method will not influence the differential count. So, the control of tk will not separate the difference. And we can apply this method to calculated differential tk. Second, the method we used and the related tk, depending on tk schedule in different ways. Third, for related tk distinguisher, the tk they used in the head of the distinguisher is not always tk0. Well, in our method, we can use any tk i on the head, just use light adjustment on tk as needed. Fourth, the k recovery attack is different between this two tk. Now, we introduce the k recovery attack. We use the 15-round distinguisher with probability 2 to the power of mnr74 in our k recovery attack. The simplified figure at this below. The input difference exists as the probability of the tk, w14. W14 satisfying this formula as 2 to the power of mnr54. And the conditional trick is tk110 equals tk3tile equals 0 or a. We propose two methods to make a k recovery attack. Occurism 1 use the probability that only under some conditions, the differential child as a whole is a head probability. We'll forunke the differential child as a whole with a negligible probability. Algorithm 2 is similar to traditional k recovery algorithm. We'll add our distinguisher as a whole only under some conditions. We need to test some trick cells to ensure there is a tk satisfied our condition. The algorithm 1 is here. The basic idea of algorithm 1 is that if tk112 equals tk3tile equals 0 or a, then the traditional differential child holds with probability 2 to the power of mnr54. Else, the probability adds 2 to the power of mnr56. So, we can guess all the 16k12 and let t6 and t12 equals the guess. Then, we guess several test pairs and we check whether the output difference is right pair. If so, then the counter plus 1. And we can guess that k. Algorithm 2 is similar to traditional method. We extend the 15-round differential distinguisher to 19-round and try all the 16 t6. Then, there must be two tests satisfied our condition. We suppose every guess of t6 is right and take a k recovery type for all the 16 t6. There must be a take makes the distinguisher hold and then we can recover the correct okay just like the traditional method. We set the data complexity as n and the time complexity as this. Then, the successful probability at 80%. Now, we summarize this paper. In this paper, we analyze the features of net weights of several crowds. Includes the inventory as well, simple 2k schedule and the inventory and simple linear level. Thanks to these features of crowds, we found a two-round invariable property of crowds. Using this property, combined with mnrp, we construct a new distinguisher of crowds. And found a 16-round differential distinguisher and a 10-round weighted differential distinguisher. For small, we firstly make a k recovery type to 19-round crowds. Thank you for your attention.