 OK, thank you for introduction. First, my oral English is not good, so maybe I need a speaker slowly. My name is Jun Xu. I'm from Chinese Academy of Sciences. So this paper is about modular invention hidden non-probable and evasive conclusion generator. So I will introduce the five parts. So the first part I need to introduce the modular invention hidden non-probable. This problem is introduced in 2001, Berlin, Helaway, and Hargrave introduced. This is edge bra, complexity assumption. In order to design, so the random number generator and the MSC code. Next, I will introduce the definition. Definition is about given prime p. Consider a cigarette alpha. Alpha is belong to prime field p. And given n plus 1 ti. So ti is non. And given 1 over alpha plus ti, MSB. Given MSB, in other words, 1 over alpha plus ti is unloy. But given MSB, MSB means most significant bits. So our goal is to recover the hidden number alpha. So previous works in Berlin, Helaway, and Hargrave give the deeper analysis about this problem. And two bonds were given, heuristically. And also he give conjecture. MIHMP, in short, is hard whenever data over log p is smaller than 1 over 3. Then Ningshan, it all give a rigorous proof for the first bound. OK, this paper, we give a new bound. This bound is about data over log p, larger than 1 over d plus 1, where d is only given positive integer. So when d is larger than 2, so our bound is 1 over d plus 1 is smaller than the previous bound, 1 over 3. In other words, we disprove a conjecture. OK, I will transformation this problem. And this problem, we can emulate alpha. Why we need to emulate alpha? Because alpha is an unbound problem. Alpha's bit size is similar to p. So we need to emulate alpha. We can get these shapes equations. Where alpha oj, b oj, c oj is now x0, x1, xn total unlawing. Moreover, this is small compared to p. So this problem could write this. So our new goal is find the recover x0, x1, until xn in polynomial time such that the bound x is as large as possible. What is bound x? x is equal to p over 2 to data. And if the desired root is recovered, we can recover the hidden alpha. So we can solve MIHMP. Moreover, x is bigger and implies data is small. So we want to x is bigger and bigger. Yeah, this paper, we can use the tool is the Copsmith technical. The Copsmith technical is proposed by Copsmith in the 1906. This technical uses many applications, such as the critical analysis of RSA, so the random number generator and computation had a problem, and so on. So now I will introduce the Copsmith technical. So overview, this technical, we can divide four steps. The first one, we can collect several polynomial such that the desired root is a common modular root, is the step one. Step two, we can construct the net is L. L is dependent on the coefficient vector of a polynomial. This big x is bound, is bound, is value. That's step three. We can use the lattice reduction algorithm, such as LLL. So in order to obtain n plus 1 polynomial, such that the desired root is a common root over integer. So the last step, we can use the global basis to compute the desired root. But the last step, we need the following assumption. Sorry, this is the assumption. It means the ideal by the n plus 1 polynomial ideal is a dimension zero. It means these equations' roots, the number is a philite. So in this paper, we justify this assumption using computer experiments. OK, the Copsmith method or the technical method is a common idea in the Hemphol polynomial. It's very important to this paper. To get n plus 1 polynomial, we need the following simplified condition. This is a determinant L, power one over dimension L is smaller than p power d, 2 power d. So the left side of the condition is the geometric mean of all diagonal of the basis matrix. Yeah, so the polynomial whose corresponding diagonal elements is less than, is smaller than p to d is called a Hemphol polynomial. So the Hemphol polynomial, the more the bound x is big, it's a notch and a notch. Why? Why? It works. So I need to explain the last page. So consider a triangle basis matrix b, b dimension w. You determine that it is p to alpha times x to beta. OK, if we add a new linear independent GI into b, so we can get a new triangle basis matrix b plus. So b plus is dimension is w plus 1. If GI is a Hemphol polynomial, so d plus determinant is equals determinant b times gamma i. So gamma i is smaller than p to d. So before n GI, we can use this condition. We can get x is smaller than this one. After under the GI, we can get a new bound. This is a new. So this bound is bigger than this bound. Why? Because gamma i is smaller than p to d because gamma i at GI is a Hemphol polynomial. So if we can end m polynomial, sorry, this is a Hemphol polynomial, we can get this bound. This will be very, very big because this is about exponential about m. So we want and m is very, very large. So I will introduce our work. We add the new n-chose d plus 1 Hemphol polynomial into the netis compared to the previous work. But the number of all polynomials is n-chose d plus 1 is 1 plus 0 1. So this means that the Hemphol polynomial is dominant. So the method is very efficient. This is the behind reason. So we can get the new bound. x is smaller than p to 1 minus 1 over d plus 1. This is imply this bound. So this bound is x is smaller than p to 2 over 3. This is the boundary. So the conjecture. So the new bound is an improved conjecture. So we can give an example because this is netis. We can triangle netis. We can choose the 11 polynomial where g9, g10, g11 is a Hemphol polynomial because his diagonal is smaller than p to d, p to d. Compare the previous work. He just choose the 8 polynomial. He don't choose the g9, g10, g11. So his bound is p to 1.3. But the new bound is p to 1.375. So the new bound is better than old bound. The reason is Hemphol polynomial are anti-mine netis. Our netis, sorry. So this is an experiment. We can verify this. We found the experiment bound is a better bet than the theoretical bound. We do the 100 experiment every time. So you must have a conclusion generate. It's another problem. It means that given a cigarette seeder v0, we can output. So the random sequence m plus 1 outputs. And from the attack view, we can find the seeder v0 given m plus 1 outputs. This problem could also be translated into this shape, this shape polynomial equations. Because this shape of polynomial equations is the same shape as miHMP. So we can also use the algorithm to save the icg in short case. After more than 15 years, we improved the bound for the saved miHMP for the first time. Moreover, we also obtained the best tank result on the icg to allow. Thank you. Two questions, really. One of them is can you say a few words of what are these health polynomials? How did you get them? And the second question is, is there an idea there that can help you improve on the copper smith methods in other contexts? Sorry. You mean the first problem is the polynomial equation. What are these helpful polynomials that you are adding into the lattice? I mean, you have more polynomials than most of these. This is a very technical detail. So I didn't write the detail in these slides. You can read the paper from the crypto 29 or the eprint. If you can, some problem or trouble, you can write me and other authors. It's a very technical detail. So it's very long. So I need to adjust the high level. High level tells you the helpful polynomial is very important. OK, so the secondary problem, what's this? Can the technique that you're using be applied to copper smith technique more generally and other attacks? Sorry. Can this technique be used more generally in other copper smith style attacks? Style attacks? Other copper smith attacks. For example, the attack on RSA, for example, using copper smith technique, can that be improved using your ideas? So you mean, could you use this idea to improve the other bound? A lot of bound. I think this method could be used in liquid, sorry, my English was good. So I didn't know how to say. Maybe I need to change here. To change hidden numbers. So the other virus of the hidden number problem, maybe use this method. Yes. In the example you showed, you had nine original polynomials, and then you added three helpful polynomials, number 10, 11, 12. Yes. Could you add more? The more you add, the better your attack will become. So why did you stop at three helpful polynomials? Is it all you can find or are there all that exist in the example? Yeah, this one probably is very important. So we need proof, the linear independent. So you can catch the more and more helpful polynomial. But this helpful polynomial is linear dependent, then the previous is no use. So what is the general bound? So I think the three polynomial is just the linear independent. So we need proof. At most the number, he is a linear independent. But do you have a general formula for how many linearly independent helpful polynomials you can find or how many exist? So yeah, so I give this one. So it's n choose t plus 1. n choose t plus 1 is a linear independent. OK, this always exists. Yeah, yeah, I think it's the most. Yeah, this one I can show you. So this is I think the linear independent. Because we can prove it's a triangle net species matrix. So it's a linear independent. Thank you. We have time for another question or two? OK, let's thank the speaker again. Thank you.