 Hello everyone, I'm Lorenzo Grassi and I'm going to briefly present this paper about the security of truncated permutation without initial value. So maybe if motivation and overview of this work, it is well known that a truncated permutation applied to the concatenation of an input value with a fixed initial value is indifferenceable from a random function up to a certain bound. In this paper we prove that almost the same bound holds if the fixed value is replaced by a randomized value and based on this we propose some concrete application in the context of parallel, viable and digested generation. So in a bit more details, our goal is to set up a construction that allows for efficient parallel digested generation and the reason of this is that evaluating several permutations simultaneously in modern CPU is faster than evaluating them in sequence. Now in the case of PRF, this goal can be achieved by making use for example of the Parfali construction proposed by Bertoni et al. in 2017. In the case of Eschink, this goal can be achieved by making use of the mass generation functions. For example, here we have the chain MGF construction which is defined in this way. So we have an esch function h, we return an output of a fixed output length. And the construction is defined as a one-way function applied to the concatenation of the output of this esch function with an index i. So there are several ways to set up this one-way function and one possibility is to make use of the truncated function. So the truncation function takes an input b minus m bits and returns n speed and this is defined in the following way. So we take an initial value of m bits and we concatenate it with the input x of this truncation function. Then we apply a permutation to this concatenation that is defined by b bits and finally we truncate the output of this permutation. So we just return the n left-most bits. At Eschink 2019, Cioietto proved that this goal's action is indifferential from a random function up to a certain number of queries, which is given by this bound. So I'm not going into the details, I just would like to point out this vector to the power of m, where m is the size of the initial value. For example, if m is equal to zero, then this number is equal to one, which means that this construction is easily you can easily differentiate this function from a random function. So the initial value is crucial for the indifferential ability, but at the same time it is overkill because there are some scenarios where we can prove that this construction is secure even without this fixed initial value. And this is exactly what we do in this paper. So we consider a modified version of this truncation function, where we replace the fixed initial value with a randomized one. So we define this randomized truncation construction that takes an input 2 element and mx, which is defined in this way. So first of all, we apply the esch function h to m. We concatenate the output of this esch function with the other input x. We apply the permutation p defined as before, and then we finally truncate. So in the paper, we prove that this construction is indifferential from a random record up to a certain number of queries. And the interesting thing is this number is very similar to the one proposed by Schrodinger 2019. The main difference regarding this last vector that as you can see is to the power of m alpha in this case. And the reason is that since this value is not fixed, we can potentially have collision at the output of the esch function. So that's the reason of this fraction. Now, based on this, we propose a new MGF construction, the cascade MGF construction, which is defined in this way. So we basically concatenate the output of several randomized truncation construction, which are applied on a message m and on an index i. Whereas before, the randomized truncation construction depends on a public random permutation p and on a fixed output length esch function h. My surprise, so this construction behave as a variable output length random article, if h behave as a fixed output length random article. And more interesting in the paper, we proved that this construction has concrete practical advantages with respect to other MGF construction, including counter MGF and chain MGF. Thank you very much for your attention. If you're interested, I invite you to read our paper or to attend my presentation at Ejecrete. Thank you again.