 Hello, everyone. My name is Mei Chen Liu. And I'm a social professor at Chinese Academy of Science. I will give a talk about our craft people, titled, Differential Linear Cropness from our Edgebrook Prospective. This is a joint work with Xiao Juan Lu and Dong Dai Lin. Xiao Juan Lu is a PhD student and Dong Dai Lin is a professor at Chinese Academy of Science. This talk consists of three parts. First, let's begin with a brief introduction of the research background. Differential Cropness and Linear Cropness are two of the most important analytical tools in symmetrical choreography. Differential Cropness was proposed by Bihang and Shamir at Cropter 1990. Using the differential cropness, the same also broke their full D.S. at Cropter 1992. Linear Cropness was proposed by Matruh in 1993 and broke their full A.S. at there. One year later at Cropter 1994, Matruh showed the first experimental Cropness of D.S. by Linear Cropness. One year later, after Linear Cropness was published, Landford and Hermann proposed a Differential Linear Cropness. It is an ingenious combination of Differential Cropness and Linear Cropness. Differential Linear Cropness is the chosen, preemptive two-stage technology of Cropness. The first stage is covered by Differential Cropness and the second stage is then performed from the middle of the software to the sub-test using the Linear Cropness. Let P be the probability of a differential from data in to data out and the linear explanation from lambda in to lambda out as the base of Q. Typically, the differential linear explanation from data in to lambda out is supposed to have a theoretical base 2 times 2P times Q22. It's really true. It may not be. In the literature, there are few methods to estimating the base of a differential linear explanation in the middle part, where the differential and linear trails connect. A natural method is an experimental method. However, it is of course limited by the computational resource. A tactical method is a mere interpretation. The process is tedious and complicated. And the theoretical base may be greatly different from the real value. Another method is the differential linear connectively table. That is DST. It was proposed by Adria, Bayon, and others. Eurocraft 2000 and 2019. It was inspired by Van Brunne Connectively Table, proposed by Adria. Eurocraft 2018. DST is more accurate for many instructions, including ASPO, DES, SERPENT, ESCO, and SO. Although they are still gaps between the estimated base and the experimental value, in this talk, we study differential linear equivalency from a different perspective. That is the edge-break perspective. A basic fact is that the base of a differential linear experiment is determined by the edge-break normal form of the difference of the output. Nevertheless, it is computationally feasible to compute the edge-break normal form for a software to make it feasible when it simplifies enough of the difference of the output of a software. That is, compute the edge-break transitional forms rather than the edge-break normal forms. More exactly, we compute the differential edge-break transitional forms of the internal bit as the very out-bit of the software. And then, estimate the differential linear bias with the help of the DATF. Then, we can try to find good information by exaltive search over all the low-harm-weight input difference and output masks. Our final goal is to mount a key recover tag. To this end, we impose some conditions on the internal bit of a software to make a certain difference determined in the first ones. And then, search good as permissions. So process is an organic combination of this integration search and the case guessing. This is the main idea of our paper. Now, let's go to the details. To simplify the edge-break normal form, we use the edge-break transitional form. Here, we define a simple transitional rule for a boolean function u under a binary variable x. The ATF u related to x is defined as ATF u double prime plus ATF u prime. Moreover, for a boolean function, omega z does not have the binary variable x. If it involves two or more variables, then the ATF is defined as a new transitional variable. Otherwise, it remains unchanged. This rule ensures that ATF fx is an ATF of f in a very simplified way that keeps x unchanged. For a software e, it can be considered as a rectory boolean function. The differential linear approximation from data to lambda can be related as a parameter. Here, data is an input difference, and the lambda is an output linear mask. If not by f, then in the product of lambda and e, then the aspiration can be rewritten as fx plus fx plus data equals 0. On the other hand, if we introduce a new binary variable, small x, then big x plus small x that is equal to a sum of two parts. The first part is a multiple of x, and the remaining part does not have the variable x. We compute the polynomial first, and then calculate the coefficient of x, then obtain the differential linear approximation. The differential edge break transitional form is compute as shown in the picture. The big x is a vector of binary variables, the small x is a binary variable, and the data in is an input difference. First, we compute the edge break normal form of rx plus x data in, then apply the transitional rule to it, and then compute the edge break transitional form of the second one, and apply the transitional rule to the result, and then repeat the steps, and finally obtain the difference edge break transform form of the software. So both steps, it describes as this algorithm. The algorithm requires the edge break normal form of the circle of the run function, and add to the DATF y under a expression set Q. F and beta are vectors of variables. From the differential of ATF, we know each component of the F and beta has at most one binary variable. In step six, we preserve the original expression of the transitional variable in the set Q. The worst-case capacity is o22d times i times tr, where t i is the number of terms in the NF of the run function, and the D is the edge break degree of the run function. For the most, for most, a left-winged surface, D and i are usually small, and then the capacity becomes oti, given the DATF of a surface, we are able to estimate the differential linear price. Our algorithm for estimation of a bus is depicted here. The burning polynomial E is the edge break expression of the differential linear expression. We divide the polynomial E into two parts, one part without any isolate variables, and the other part with only the isolate variables. For the first part, we estimate the bus directly from the edge break expression. For the third part, we substitute the expression Q into it, and update E with the new S polynomial. Then repeat the bound procedure until E is zero. Finally, we obtain an estimated value for the bus. If E has no isolate variables, then the capacity is o222m. When well, m is the size of the xbox. To refine the estimation, we can also pre-estimate the probability distribution of the transitional variables. Next, let's show the application. As the illusions, we applied our theory and the techniques to three different type of symmetric surface, including the authenticative surface S cone, the bulk surface surface, and the string surface grain v1. S cone is a C-cell furnace, as well as the LWC furnace. Serpent, the AS furnace, and the string surface grain v1 in the ischium furnace. The result on the differential linear brass of S cone and the serpent, and the differential brass of the grain v1 are summarized in table one. Well, CdL means conditional differential linear, and Cd means conditional differential. Compared with the DLCT tool, our techniques can be applied with more runs and provided more accurate estimation of the differential linear brass. Besides, our techniques can also be applied to differential equivalency. Compared with the differential edge method tool made for the green neck surface, our techniques are more joined and have a much better performance. Compared with the experimental approach, our edge bracket at top necklace are more formalized and internecose for conditional text and in particle, much faster when the brass is low. This helps us find better conditional experiments for S cone and the grain v1. Our collateral analytical results of S cone, serpent, and the grain v1 are summarized in table two. For S cone, our tech up from the provision differential linear one, but not the cube tech for serpent to the best of our knowledge. We provided the first correct attack on its 12 rounds variant and the first differential linear attack on its 11 rounds variant with 112 and the 28-bit key. To the best of our knowledge, our techs are that far the best on low equivalency of serpent, as well as the best differential linear equivalency of S cone under the best in the international analysis of grain v1. The result have been fully verified by experiment. Not great. Security analysis of serpent is one of the most important application of differential linear equivalency in the last two dedicates. The result in this paper updates the differential linear equivalency of serpent 128 and serpent 215.6 with one more one. After the work of B.Hamm document and the T.L.U. in 2003. In this talk, we have shown a new theory of differential linear equivalency from our edge break prospecting, including the estimation of the differential linear bias and the technical for kilocalorie. We have applied it to the CISAR finalist and the FWC finalist, the AS finalist serpent and the extreme finalist grain v1. And again, the most accurate estimation of the best as well as the best in low differential linear or differential attacks. In particularly, the result in this paper updates the equivalency of the serpent with one more one. Our techniques for kilocalorie is the organic combination of the distinguishing research and the key guessing. And that outperforms the provision kilocalorie in the differential linear equivalency. We believe that this new cryoparticle analytical tool is useful in both the equivalency and the design of symmetrical cryoparticle systems. Thank you for your attention. If you have any question, please feel free to contact me.