 Okay, so we move to the last talk of this session, which is a title partial collision attack on the run-reduced compression function of Skynet 256 by Hongbo Yu. She has a chain, and she'll use one, and Hongbo Yu will give the talk. This is the joint work with Jia Jun Chen and Xiao Yu Wang. My title is partial collision attack on the run-reduced compression function of Skynet 255. This is online. We first give brief description of Skynet, then give previous results related to air clearance or partial clearance on Skynet, and finally, we give our text. Skynet is one of the Shanshui finalists. Even though the Shanshui competition is over, the Kachak is the winner of Shanshui, but Skynet is still a strong Shanshui candidate. Skynet is designed by Neil Ferguson. Then, Stafford Lucas, Bruce Shawnee, says, Skynet uses unique block alteration based on block Cypher 3 fish. It poses international state size 256, 512, and 1024. Skynet 512 is a primary proposal. It's also the Shanshui version. The Skynet 256 is a low-memory version, also a Tony version of Skynet. In this paper, we give some air clearance attack for Skynet 256. The compression function scheme is designed in the MMO model based on block Cypher. It's designed HI equal to E or plus M. Where E is the block Cypher 3 fish and M is the plant text, the block size can be this kind of... The H is the P with the same size as M. T is the twig. The 3 fish block Cypher consists of 62 rounds. Its curve is M-x functions. The 3 fish do not use S-box. The linearity mainly comes from the addition, the addition rotation by a constant and the SOR opposition. The MIS function is opposite of 264 words to another 46-bit words. The key schedule generates subkey from the mass key key and the two values. The subkey key consists of three contributions. The key, the turns and the counters. Nuclear and partial clays. From the handbook of applied cryptography, the nuclear resistance is defined by... It should be hard to find any two-input M and M star with M dot equal to M star, such that the HM and HM star are different in only a small number of bits. I think maybe the small number should be... should be smaller than one-third of the full... the full size maybe. The general complexity of near-clearance is given in the first report of this morning. In this paper, we find W-based near-clearance is a pair message M and M star. They collect such... they collect N in W-based of the full size. That is the HM outclass HM star. The HM weight is equal to N minus W. This is a general attempt. The lower bound of the time complexity is smaller than two... to the W over two. But the memory is more than two to the N minus two. So if we attack the complexity is larger than this lower bound, we use another notion to express it. The partial clearing. A W-based partial clearing is a pair message M and M star. Client is a fifth W-based. The general attempt of complexity is two to W over two. First near-clearance attack is presented... provided in Asia Crypto 2009. MC, etc. So it's around the near-clearance with practical complexity. In Kansu 2012, they proved the near-clearance by stressing this differential path in the backward and forward. And the complexity is not practical. And the heavy weight in the near-clearance is very heavy. It's about a half of N. In FSE 2012, Lee, etc. gave some free-style clearances to 100 chill. This is for harsh function version and this is for complexity version. They converted the pre-attack on skin to the clear attack on skin. But the complexity is much lower than the exhaustive search. In this paper, we give several results on skin 256. Firstly, we give a practical attempt for 2K4 round skin. The active piece is only two active pieces. Then we give 28 round practical near-clearance. The active piece is about 34. Another 28 round near-clearance. Finally, we give a partial clearance on the 32 round. Why we call it partial clearance? Because the complexity is bigger than the lower bound of the general attack. So we call it partial clearance, not near-clearance. The basic idea of attack, the previous work related to the differential path usually uses a simple differential path. Only eight round local differential path is built, usually a zero path. Then stress the path in the backward and forward to get a path. In this model, we know in the first path, in the top path, the difference in the near-clearance is very high. As an example, in 2002, a part of the piece is active. A natural idea is how to connect the two simple paths into one, a long one. In this way, if we can connect it, then we can get a long differential path with no heavy weight in the first one and the last one. In order to connect our differential path, we firstly select the sub-key difference. We select a difference in the significance base in K3 and K2 zero. Then one can construct four zero differential paths in the middle for the first differential path and four zero paths for the second path. This is our differential path. The first path consists of 20 rounds and the second path consists of 12 rounds. The divided path into three paths. The first path is a simple differential path. It only uses linear expression. And the second path is in the bottom of this path. It also uses linear expression. In the round, in the middle, we use the eight rounds differential characteristic to connect these two path simple paths. We first select round 20 as the connection point because in this round, the sub-key is evolved. If we want to connect the two paths, the only thing is in the modular differential in H20 is equal. If we select another round, that's only the modular differential, but the modular difference, but also the XOR difference, both should be equal. So we select round 20 as the connection point. Firstly, we connect A20 to N20 and C20. We adjust the difference from H21 to H24. Then we connect B20 and D20 by adjusting the difference from H60 to H90. In our text, we use two kinds of differential models, the XOR difference and the internal modular substitution difference. It's the process of our, the connecting process of our text. Firstly, we connect A20. We select the top N20 as the target. In order to get the same difference in the bottom path, we give a big carry by B20. The big carry will cause the big carry to A21 and D21 and if we connect D21 to get the big carry, then we have to continue to expand B22 and C22. In this way, we can adjust the difference of A20 by adjusting these words in the bottom, these words. In the same way, we can connect C20 to match this C20 in the bottom. Once A20 and C20 are decided, we connect B20 and D20 by adjusting these words on the bottom, these words. For example, B20 can be updated by D19 or A19 and D19 can be updated by B18 or C18. What's in assistant is a peer. We have to jump back to the earlier step and make a different decision. The process of connecting is a hard work. Fortunately, Garrett Lawyer also gave an automatic method to generate the differential path and recently got a similar result with our attack. This is our differential path. From the different paths we know, even in the middle rounds of paths, the difference in our paths is very small. Use the modular differences in these positions. That is to say, the position after the key is involved in A and C positions because in this position, it is not included in the XOR operator, only in the modular addition operator. It's the condition distribution. Once we get a differential path, we have to deduce a theory of sufficient conditions. We divide the sufficient condition into three groups. The first group is mainly from the conditions in rounds 16 to 20. In group 2, the conditions are in round 20 to 22. The second group is determined by P5. In group 3, the conditions in group 3 include the other conditions in the other rounds. There are 216 conditions in group 1 and 168 conditions in group 2. 104 conditions in group 3. In table, we also know the first condition is only consistent with H20. The conditions in group 2 are related to K5 and the other conditions are related to K4B and K4D. We can divide our paths into three paths. The first phase is such a 256 base H20. To fulfill the conditions in rounds 16 to 20, we use the message modification technique. After the message modification, the time complexity is about 2 to 42. In the second phase, we search for 256 base K5 to fulfill rounds 20 and 24. Under the conditions in stage 16, we also use the message modification to cancel most of the conditions. The complexity in this path is only 2 to 18. The first phase is such a 128 base K4B and K4D to fulfill other rounds. We use the message modification to fulfill the conditions in 12 to 60 rounds and the other conditions can be searched. Based on our formula, we can complete the complexity of our formula. For the 32 rounds differential paths, if we want to get partial clearance with 15 base differences of near-clearance, we can... The complexity is the addition of these three paths. It's dominated by the third phase of the complexity. In the 10 of the 24 rounds, the complexity is 2 to 42. In this pattern, in fact, the two and the three are cooperated because in this pattern, we don't need the degree of freedom from the trick. That is to say, the trick can be arbitrary. In the 28 rounds of near-clearance, the complexity is dominated by the final path. We give the analysis of the degree of freedom. The total degree of freedom comes from the message, the mask key and the trick. All together, 640. The number of conditions in our differential paths, in our 22 differential paths is 288. So it's enough to carry out our attempt. Let's see the local degree of freedom. In the round of 16 to 20, the freedom is 256, come from 820. The number of conditions in this path is 216. The degree of freedom in round 20 to 24, in this path, the number of conditions is 168. So it's enough to search P. In the third pattern, the degree comes from trick, but come from K4, K4B and K4D. The number of this path is 104, so it's sufficient. In order to verify our differential paths, we give three examples. The first example is the near-clearance is having weight only 2, from round 4 to 28. In this example, the trick is fixed. In fact, it can be any arbitrary values except the difference in the most significant bits. This is a clear example from round 0 to 28 and the trick is a select trick. This is a clear example from round 4 to 32. Thank you for your attention. Okay, so unfortunately, we are quite late on the schedule, so I don't think we have additional questions. So let's thank our slides speaker and all the speakers of this session again.