 Hello everyone, I'm Su Weicheng. The title of my report is on relationships between different measures for degree evaluation. This is a joint work with Zhou Junxiang, Xiang Yongzhen and Sha Sha Zhang. This report is composed of four parts. First, we will give a brief introduction on the background of our work and then discuss the degree evaluation of FPM and NFS are based several in Part 2 and Part 3. And finally, in Part 4, we conclude our work. The output of symmetric ciphers can be regarded as pulling function over the input variables. So, if a cipher at this low algebraic degree, distinguishing attacks or curvy-curvy attacks can be achieved, such as integral attacks, cube attacks, higher order differential attacks, and some algebraic attacks. So, it's very important to estimate a test bound on the algebraic degree. There are four effective long-time methods to estimate algebraic degree. First, for the FPM method ciphers, there are two formula-based bounds. One is provost by Bohr and Kandit. We call it BC bound. Another is provost by Khalid. We call it Khalid bound. This example shows the effectiveness of the two bounds. The trigger bound, which is the maximum degree at round four, however, the two bounds give the degree of 29 at round four, which is more accurate than the trigger bound. For NFS are based ciphers. NEO proposes a numeric mapping method, especially for trivium-like ciphers, and efficient algorithm based on numeric mapping was given. The last one is division property. It's a generalized method. This is a definition of word-based DP, and this is a definition of two subsets, bit-based DP. In the application of DP to search for integral distinguishes, we usually fix the input DP of cipher E, and to judge whether the output DP of cipher E, sorry, to judge the minimum of the output division property is no more than one or lot. When estimating the edge-bridge degree, it's a result process. We need to fix the output DP to one and maximize the input DP that propagates to one. Then the maximum of the input DP can be regarded as an upper bound on the edge-bridge degree. Note that this DP is bit-based DP. For the sake of convenience, we call it BDP method next. Let us first focus on the SPN ciphers. From above introduction, we know the BDP is a whole process, and the two bounds is an interactive process when estimating the degree of SPN method. So we cannot compare them straightforwardly, so we have to construct the bridge to link them. Okay, this is our bridge. Based on division property, we propose the bound on the composite function. FT deletes the composition of t-function of f. Wt omega f deletes the weight of minimum of output division property of FT when we fix the weight of input DP to omega. Thus, the degree of this composition is upper bounded by the minimum of this site. It's simple to prove it. First, let W be this set. Assuming that for an arbitrary method set X, it has division property of Q0, and the Q0 of analysis 1 belongs to this set. Net X is the input of FT, and Y is the output of FT, and it has division property of P1. Moreover, let Z be the output site of G, and it has division property of K2. From the definition of site W, we have the division property of K1 is larger than the degree of G, and according to the propagation rule of division property through function, we have the division property of K2 is low less than 2. Note that the division property of K2 can be calculated as follows. So, we can deduce the degree of this composition function is less than K0, because the degree is actually an integer, so the degree of this is no more than K0 minus 1, because of the arbitrary needs of site X and K0. So, the degree of this is no more than the minimum of site W. That is our conclusion. Note that in this new bound, T is flexible. So, now we set T to 1. We can have this conclusion is that our new bound is tighter than BC bound in order to prove this conclusion. We need this lemma. It indicates the relation between the division property and the algebraic property of S-books. Now, let us prove the proposition 2. It's equivalent to prove the BC bound actually belongs to this site. Furthermore, it's equivalent to prove when we fix the weight of input Dp of f to BC bound plus 1, the output Dp of the f is always more than the degree of function g. So, assuming that the victory of K2K star is the world-based division true of function f, thus for any S-books Sj, Kj to Kj star is world-based division true of S-books Sj. Thus, the weight of output Dp of f can be written as this form. Note that eta j is always no more than gamma. So, we replace eta j by gamma. We can obtain this inequality. Furthermore, we replace this sum by the left equation. So, we finally have the weight of output Dp of f is actually more than the degree of function g. That is, if we fix the weight of input Dp of fg to the BC bound plus 1, then the weight of output division property of f is more than the degree of g. So, our conclusion holds. Similar, we can obtain the same conclusion when comparing the carded bounds. Here, we omit the proof of this conclusion because the detail of this proof is similar to the proof of Proposition 2. Now, we can compare the BDP method with the BC bound and the carded bounds on the degree evaluation of an R-round sufferer. This is our bridge. By fixing t to different value and considering different type of division property, we have three models from this bound. In model 1, we consider the BDP and the g is an identical function. We fix t to R. In model 2, we consider word-based Dp and g is an identical function. We fix t to R. In model 3, we consider word-based Dp and set t to 1. This time, g is always varying with the round increase. Apparently, model 1 is equivalent to the BDP method. And from previous analysis, the model 3 is more accurate than the two bounds. Moreover, BDP is a more accurate Dp and word-based Dp. Thus, model 1 is more accurate than model 2. Furthermore, model 2 considers the influence of linear line on the division property propagation, but model 3 does not. So, model 2 is more accurate than model 3. As a result, we know BDP is equivalent to model 1. Model 1 is more accurate than model 2. Model 2 is more accurate than model 3. Model 3 is more accurate than the two bounds. Finally, we have BDP method is more accurate than two bounds. We apply the BDP and two bounds to the underlying permutations of k-chop and the k-load surface. The results show that BDP method can obtain the tighter algebraic degrees than the two bounds. Now we focus on the NFSR-based server. Assuming that there is a simplified stream server based on N-bit NFSR, this is the update process of interstate. G and F are the update function and output function. The encryption process can be simplified as this. We first propose two bounds on the DP degree of AND and XOR operations as listed in Proposition 4 and Proposition 5. Proposition 4 indicates that the DP degree of a monomial is no more than the sum of DP degrees of the involved states. Proposition 5 indicates that the DP degree of a polynomial is equal to the maximum of the DP degree of the content monomials. Both conclusions seem trivial, but not trivial to be proved, which is complex. So we omit the proof here. If you take some interest, you can report to our paper. Now we compare the BDP method with numeric mapping on the division property on the simplified stream server. The conclusion is that for any state-bit SI at any clock T, its DP degree is no more than its numeric degree. Here we give a brief proof. Note that when T is equal to 0, the state is initial state. So both of the DP degree and numeric degree are equal to the exact degree. After one clock iteration, the DP degree can be read as this form from Proposition 5, and this can be also read as this form from Proposition 4. So we have DP degree of SN at clock 1 is no more than the numeric degree. Similar, after T minus one times iterations, we have the final conclusion. That is, for SN at clock T, its DP degree is no more than its numeric degree. We apply the BDP method and numeric mapping to T and C stream servers. We can see that the DP degree, which is red, is always tighter than that of numeric degree, which is blue. And we can see the gap between them are more and more distinct with round increasing. Both for tree view and creeping. Okay, in this work, we give an argument on the relationship between the different long-term measures for algebraic degree evaluation. And we conclude that the BDP method is the optimal one from the accuracy perspective. Additionally, moninomial prediction and three subset division property methods can be utilized to compute the exact degree. But they are time-consuming if you use lots of optimization strategies, because both of them need to enumerate the truth from input propagating to the output. Therefore, for symmetric server, if you're expected to explore some special optimization strategies to get the exact degree, you can consider the monomial prediction for three subset division property methods. But if you only want to have the overview on the degree of this server, the two subset division property methods will be the best choice. Okay, that is all my report. Thanks for your listening.