 Hello everyone. I'm Xiao Yangdong. I'm talking about automatic classical and quantum rebound attack on AS like hashing by exploiting the related key differentials. The others are Xiao Yangdong, Zhi Yu Zhang, Si Wei Sun, Tong Mingwei, Xiao Yunhua and Lei Hu. On quantum core analysis, we really have two models. They are Q1, Q2 model. In Q1 model, the attackers can make only classical queries and use the quantum computer to perform the attack. In Q2 model, the attackers are allowed to make quantum queries. For block cipher, Q1 model is more practical than Q2 model, but for hash function, we are ready to make quantum superposition queries. On quantum clear attacks, we have three generic algorithms summarized by Hosomada and Sasaki. The first one is the BHT algorithm. It needs very large quantum random access memory. It achieves optimal when the size of Q RAM is 2 to N device array. The second one is the parallel row algorithm. It doesn't need Q RAM. The third one is CNS algorithm. It outperforms the birthday attack when we have a large classical memory. In quantum computation, we can make superposition queries with a quantum oracle. For example, UF acts on a superposition and output a superposition. Growers algorithm is a quantum search method to achieve a square root speedup than classical search. This paper is focusing on AS like hashing. It's built on pledging AS like cyphers or permutations into the famous PGV models, such as DM, MMO, and MP modes. On clear attack, we have three settings. The first one is the standard clear. It uses the standard initial vector IV to find a clear pair M and M. The second one is the semi-free start clear. It uses a different initial vector. The third one is a free start clear. It uses a pyro initial vectors. In AS like hashing, the setting of the free start clear allows the attackers to make to use the degrees of freedom from the key. It should be noted that in MUC diagram, security reduction, all the three types of clear should be avoid. Rebound attack is a basic method to build clear attacks on AS like hashing. It is proposed by Mandel at FSE 2009. The rebound attacks includes two phases, they are inbound phase and outbound phase. In the inbound phase, a meeting middle approach is applied to generate the pair conforming the inbound trail with very cheap cost. Those pairs are named as start points. In the outbound phase, the attackers verify the outbound phase differential trail with those starting states. Suppose the probability of the outbound phase is PR. In classical clear attacks, we have to traverse at least one divide PR starting points to possibly find a clear. To be better than burst attack, PR should be larger than square root of 22-N. At Euro corrupted to BL to DL, Jose Mandel and Satake discovered that in quantum setting, one can use the growers algorithm to traverse those starting points using square root of one divide PR. To be better than generic quantum clear attacks, PR can be significantly lower than that in classical setting. For example, to be better than BHC algorithm, PR should be larger than this number. To be better than Rousseau algorithm, PR should be larger than 22-N. To extend the rebound attacks, Gilbert and Lake Landberg proposed the super S-box technique to build a two-round inbound phase. Later, Satake at all introduced the non-full active super S-box to reduce the memory cost. In quantum setting, these two can, the super S-box technique is converted into quantum one. At FSE 222012, Jin at all introduced the three-round inbound phase. Later, Jose Mandel and Satake also converted into a quantum one. To adopt related K differential in the rebound attack, there are three steps. First, to find a related targeted differential for EK. Second, choose a K pair that meets the differential of K schedule. Third, perform the rebound attack with K pair. To find a good related K differential, we first consider previous tools in single K setting. Look at example 1 by enumerating the cancellations of MC and AK. We can estimate the probability. However, we have different situations for related K setting. For example, in figure B, when only enumerating the cancellations, the probability is 2 to minus 2 C. However, there is only one active S-box. We can choose a valid differential from XI to YI by accessing the DTT of S-box. And then choose a K to cancel the two-cell difference in WI. The total probability of the trial will only be around 2 to minus C, larger than before. So, by consuming the degrees of freedom from the K, the probability of the differential may increase. We introduce some symbols as constraints to calculate the probability of the related K differential. The consumed degrees of freedom in the K should be no more than the cases. We have different objective functions by assigning two wrongly in-bound phases or three wrongly in-bound phases. When applying to separate, we have to deal with the incapabilities within many wrongs due to the very easy K schedule. For example, we can deduce two equations regarding to MR operations. By adding them together, we find the days contradiction. We use property of MDS matrix to fast filter the impossible solutions derived by our MRP model. That is, if there are at least four same-cells in the two-input output vector or MC, all other cells should be the same. For example, in finger A, we use the inner product of SI and SG to calculate the number of same-cells. It is four in finger A, so all the differences in Y and YG should be the same. However, they are different, so it is a contradiction. Finger B shows a possible case. With MRP model, we find an in-run related K differential trail. The in-bound phase covers two wrongs. The probability of the odd-bound phase is 2,2 minus 2,1,1. We gave a quantum-free start-clean attack on 8-wrong saturated with time-compensity to 1,2,2. We also find a 9-wrong trail for also standard harsh. Different from previous 8-wrong trails, the rebound attacks happen in both the K-schedule path and data-encropping paths. The trail is given here. To perform the quantum attack, we first prepare some functions. G is a function to compute the 3-wrong in-bound phase. F is to mark a red K-pair that can form the differential trail or the K-schedule path. Then, run grower's algorithm on F, where one can find a bandage. Tell F is to mark a homic-6 that leads to a clearing or not. By calling the functions defined for, we run algorithms, grower's algorithms on UF to find a collision. These are the thumb-race of our attacks for workflow and saturated harsh. Thank you.