 The name of the presentation is More Accurate Differential Properties of LED64 and Midori64. We will start with the background and contribution, following that we will introduce the related preliminaries. And then we present an automatic tool for the search of differential. After that, we provide more accurate differential analysis of LED and Midori. At last, we will give a conclusion. Differential cryptanalysis is one of the most fundamental techniques targeting symmetric key primitives. Since its introduction, many investigations managed to achieve a prurable security against it. Among these works, many researchers want to provide more accurate distribution of the fixed key differential probability. Apart from the theoretical research, another strong trend in the field of differential is the automatic tool for the search of differential trail or differential. However, most of the techniques focus on the search of differential trail. Although we are able to obtain a large number of differential trails, how to use this trail to launch more accurate differential cryptanalysis is an open problem. Based on this observation, we focus on these essential problems. Firstly, we consider the fixed key probability of a differential trail. And then in order to deal with differential effect, we consider the fixed key probability of a differential when multiple trails are available. We also consider the vector ratio of a differential since it reflects the effectiveness of differential cryptanalysis. The contribution of this paper can be divided into these three parts. The first one is we provide an automatic tool for the search of differential. We know the previous techniques based on SMT can realize the same task. However, since we want to use SETS over to handle differential effect in the following, so we also prefer to use SET here to finish the searching task. And the second contribution is we provide an automatic method for the search of red pairs of the step function. With this method, we found many iterative and non-iterative differential. And with the new differential, we improve the previous differential attacks. The second part is we provide two models for the estimation of the VK space and we apply these models to the analysis of Midori 64. Before we move on to our results, we briefly recall some related preliminaries. The concatenation of differences for R plus 1 internal states constitutes an R-round differential characteristic or we say differential trail. The differential probability of a differential with input difference alpha and output difference beta equals to the probability that a pair satisfies the input difference and output difference simultaneously. For a K function, we can define the K differential probability accordingly. The expected differential probability equals the average value of the fixed K differential probability over the whole K space. The weight of a differential or a trail equals to the negative binary logarithm of the EDP. Markov's cipher is an ideal iterative cipher. For this cipher, the average differential probability over one round is independent of the input. So in the differential analysis, with the assumption of independent round case, the EDP of a differential characteristic equals the product of the EDPs for each round. And the EDP of a differential equals the sum of the EDP for all differential trails within the differential. Since Markov's cipher is an ideal primitives, this kind of evaluation may deviate from the real differential probability. Many designers want to make their ciphers achieve provable security against differential cryptanalyze. Modern ciphers are designed to withstand the existence of the dominating trail. For this cipher, we can use the hypothesis of strategic equivalence to finish the proof of security. It claims that for most values of the K, the fixed K differential probability equals the EDP of the differential. Afterwards, Damon and Raymond reconsidered the distribution of the fixed K probability. They proved that for a K alternating cipher, the number of thread pairs under a fixed K follows a poison distribution. The parameter of the poison distribution is related to the EDP of the differential. It's well known that when the parameter of the poison distribution is sufficiently large, it can be approximated by a normal distribution. For the approximated normal distribution, we know the probability that the K satisfies this condition is about 50%. We call the case for fulfilling this condition, the fixed K, since when this K is used in differential analysis, the attack is more likely to succeed. We donate the set of fixed Ks as WK. Now, we present the first contribution of our work. It is an automatic method for the search of differential. The automatic search is based on the set problem. It considers the satisfiability of a given Boolean formula. We use cryptomaniaset in all our search. One reason is that it is compatible with XOR operation. The second reason is that it supports the usage of searching for multiple solutions. The key step to realize the automatic search is to construct a model for the components of the primitive. We transform the differential propagation rule for these components into set problems in conjunctive normal form. And then invoke set solver to search for the differential trail. In order to search for differential, we need to invoke the set solver for several times. We want to remark that the number of solutions handled by the solver is determined by individual set problem. According to our experience, 2 to the 33 is an upper bound. Although with this method, we are able to obtain a large number of differential trails, but the crucial problem is how to use this trail to conduct differential cryptanalyses more accurately. With this problem, we move on to the differential analysis of LED. Since we target the differential with high probability, so we need to generate a method to accurately evaluate the differential probability. Since the step function of LED is public mapping, we find that the problem of computing the differential probability is equivalent to the problem of searching for the right pair of a given differential. So we turn to the problem of search for the right pairs of a given differential. The first step is to search for many trails within the differential, and then we generate constraints on the value of the right pairs. And then we convert these constraints into set problems and use set solver to search for the right pair of the trail. And the right pairs for all the trails constitute the right pairs for the given differential. So the remaining problem is how to generate these constraints for the right pair. They first introduce a closely related conception. For a differential, we combine all the input values of the right pair into a set F, and the output values of all the right pairs are organized as a set G. And the differential is called a planar differential if F and G are fan subspaces. And the mapping is planar if all the differential over eta planar. And it's easy to prove that the S layer composed of the parallel applications of S boxes is planar when all the S boxes have differential uniformity of 4. So for the K-operating cyber, if the S layer is planar, for any differential trail with the input difference delta X and the output difference delta Y, we know the set F and G are fan spaces. So we can construct metrics and vectors so that for a vector, if a vector falls into the fan space, if and only if it satisfies this equation. And since the structure of the step function follows the K-operating cyber and LED utilize S boxes with differential uniformity of 4. So with the previous two equations, we can derive the first constraints for the right pair of the step function. This constraint is come from the difference of the differential trail. Apart from the constraints from the differential trail, we require the internal states of the right pair follows the encryption rule. So these three constraints can fully determine the right pair of a differential trail. And then we transform these constraints into set problem in conjunctive normal form and call set forward to search for all the right pairs corresponding to a differential trail. To sum up, in order to obtain the right pairs of a given differential, we need to firstly search for many differential trails within the differential and then generate metrics and vectors corresponding to the trail and apply in set forward to get the right pair. With this method, we have found many iterative and non-iterative differential for LED and with improved differential, we improve the previous related K attack. Now, the last part is about the differential analysis of Midori 64 considering the K schedule. In this part, firstly, we will say for each differential trail of the differential, we can derive a subspace of the K space and this space covers the VK space of the differential trail. And the union of this set is related to the VK ratio of the differential. And then a K forced into more than one space, the corresponding fixed K probability will increase since the corresponding trail will hold simultaneously. So, from the view of the designer, we want to minimize the VK ratio and from the view of the attacker, we want to detect the maximum number of compatible characteristics and the case validates all the compatible characteristics might be used in a VK attack. So, in this part, on the one hand, we want to give a method to evaluate the VK ratio and on the other hand, we want to determine the maximum number of compatible characteristics. For the K alternating cypher, when the S layer is planar, we can derive a linear confidence on the involved subcase. The necessary condition for a differential trail for a differential trail have red pair is the S subcase forcing to the fan space. And otherwise, if the subcase falls out of this fan space, the differential trail will have no red pair. So, for a differential consists of multiple characteristics, if a particular K leads all characteristics to be impossible trail, the differential under this fixed K turns into an impossible differential. And we donate this case as an IK and clearly the VK space is covered by the complementary set of IK. So, in the previous description, we know the VK space of each trail is covered by the set VK. So, the VK space of the differential is covered by the union of this VK. And this probability constitutes a major upper bound for the VK ratio. So, we turn the problem of evaluating the VK ratio into a problem of estimating the stress of this set. And since we found that handling the intersection set is more convenient than the union set, so we applied the Morgan's law here to transform the union set into intersection set. And then we proposed an automatic method to evaluate the stress of this set. The main idea is to convert the constraints on the set into clauses in conjunctive normal inset problem and invoke steps over to solve the search and task. As a result, we provide full run differential with VK ratio much lower than 50%. And in order to validate the theoretic results, we do some tests with random K and the experimental results face very well with the theoretic value. And from the view of the designer, if this kind of differential is utilized in a differential analysis, the attacker will probably fail since he can't find red pairs under the red key. The last problem is the maximum number of compatible characteristics. Firstly, we introduce closely related problems. The max puzzle problems, given a set of polynomial functions, the max puzzle problems is to find x such that it satisfies the maximum number of polynomials in the function set. And in the previous description, we know K falls into the VK space of the trail if and only if K satisfies this linear constraint. And we donate this linear constraint as FG. We find that determining the maximum number of compatible characteristics is equivalent to finding K such that the number of functions following this condition is maximized. To solve the max puzzle problem, there are many automatic methods and we use an automatic method based on set to settle this problem. As a result, we apply this method to the analysis of a full run differential of Midori. We find the maximum number of compatible characteristics and since the case validates all the compatible characteristics, we'll have a higher differential probability. We find that on each subspaces, the EDP of the differential is improved from about 2 to the minus 24 to 2 to the minus 16. And we also find that the probability that K with this enhanced probability is at least 2 to the minus 12. All the theoretic results are validated with random tests. Now we finish all the contents of the paper and give a conclusion here. Firstly, we propose an automatic method based on set to search for the differential and then we propose a method to search for the right pair of the step function of LED64. And at last, we propose two models to estimate the VK space of a differential. We want to remark that all the automatic methods can be generalized to analyze other samples. And the results in this paper illustrates that for some lightweight block samples with a simple K schedule, they need to pay more attention to the analysis of the differential. An open problem is how to utilize these automatic tools to provide more precise evaluation for the linear high effect. That's all for the presentation. Thank you for your attention. Christian, do you think these techniques can be applied to S-box which are not Blainer? To do this, you need to add some more techniques to handle that. For example, when the input space is not a fan space, maybe the union of the fan space, you can use other techniques to deal with that. Okay, thank you. And thank all the speakers of this session. And next is the coffee break. And the next session, we'll start at 11.30. So let's come back at 11.30.