 So our next talk is linear structure, implications to crypt analysis of round the reduced K check by in Chinese Guo Jian, Liu Meicheng, Song Lin. So our speaker is the Meicheng. We talk about a list of action and with the application to the privacy of non-reduced to check. Malense is Meicheng Liu. This is the geoworker with Jian Guo and Lin Song. First, Jian and Lin have this platform. This platform contains four parts. First, I will give you some introduction and then I will show what is the linear structure. And then we show the two applications of the linear structure. Let me give some introduction to the action function. I will now, the action function is a map, function map adapt into the bit with a swelling with a fixed size. And then under this hash function you have to surpass three properties. The first one is collision or resistance. The second one is the pretty major collision. And the third one is the second pretty major resistance. When all the stress rate hash function condition is from the 2007 to the 2012. And then in 2012, you check when the condition. There is an official web stat of the good check. In the web stat, we can find every current latency to on the web stat and we can also find the representation of the good check. In last year, Niston asked that the SHA-3 have been to a harshing standard. The SHA-3 contained six versions. The first four versions it almost stands as the good check or good check two to four, good check two five six, good check three, three eight four, good check five, five one two. And there are another two versions including the SHA-1 to eight and the SHA-2 five six. These two versions are a term for output fractions. I will really explain what it is. These six versions, later, they are the four members of the good check team. There is a brief application of the good check. There is a good check used to sponge, sponge, sponge to contractions. The sponge contractions contains two parts. The first part is absorbing and the second one is squeezing. The message is divided into N parts, P1, T0, P1, PI, each part. For example, PI has an I bit, but the F here is a preparation. The F is a preparation on three parts, PI bit. So, in the future, the three bit is competitive. Competitive is fixed for, in the first run, the three and the PI bit are fixed to zero, but up first block, the first block P1, is S of the one, then and so on. This is the absorbing phase. Then, but in the output, H there is output, I bit, until all the output is needed, then, for example, if we want to output L bit, then if L is bigger than I, then we will, we need to, we need I divided, L divided, divided I blocks, in case the L is less than I, then we just need one block, the first I bit of the first block. The project, project used a designer, project F preparation. So, the preparation F has 24 runs, and it, it wrapes 1,000 under 16 bit to 1,000 under 16 bit. It, each run has five steps. The only, no, no, no linear operation is K, and they are the purpose of the six versions of the SHA-3 function. For example, SHA-3 are beautiful, the I cross the, as I show in the table, I cross the 1,000 under 152. So, compared to this thing, it, it tries, it tries of the output length, but it, it's not all the case. In, in the design, the thing much, much larger than the trust of the labor, the particular labor. For example, for example, in, in the bottom of the table, if, if L equals to, equals to 256, then the capacity, then the, if the L equals to, equals to 50, if L is, if L equals to, equal to 412, then the security level of the collision if 250, 256, then see a master large term, larger than, double of the 250, 256, so, in here. SHA-100, 200, and the 50, 50, 6, 3 equals to 1, 200, 450. Now, let, let us, let us show what is the new structure of the K-check application. Some, no, no, it takes a based on the, this, the technology of the, the, the larger of one round K-check application. For, for example, zero sum, if, if you question, and the people take lack of capacity of the kids around of the K-check. We found that two of, of, on three rounds, K-check African became a linearized. In the first step, we used the one plus one, and then, in this case, the, the freedom, that the degree of freedom is 412. In the second test, we used the one plus two, tough. In this case, the, the, the degrees of the freedom is 100, 19, 4, in our, to mountain a pre-major attack. We often use the, the, the first test. That means, use the one plus one test. The reason is that we can use the large, large linear space. Okay, let us show the detail of the K-check application. The K-check application contains the five steps. The first step is theta. In the theta which are theta, or in the theta step, each, each bit was, was summed to 11 bit to one bit. If, if three equals, if we impose the three equals zero or constant, then, then D equals zero or constant. Then, A, after the first step, after the step theta, A, X, Y, if we, we cross the A, X, Y, or constant. Then, in this case, after the three steps, including high low, as I'm showing you this last, A just sticks, just sticks of the words. And then, pay just a calculation of the words. Then, it does not, it does not subtraction the bits. You know, if, if we just read some A, X, Y, B, some variables, we impose the, we impose the three X equals to a constant of zero. Then, after the first steps, then, if each of the first steps, the output of the first step will be a single linear, will be a, will be a single variable or a variable past constant. But, I'm showing the slides. The K, the K step is a nonlinear. The K step is just a degree two, just a, just a, and here, the, the not just step, you, you're just a, plus a, plus a, X, O, a constant. This constant does not affect our text. There's a discussion about the, the detail of the, our, our linear of the, the structure. First, we will keep one, one, one, forward of the linear. We will keep one, one, one, one, one, one, one, one, one. I'll show you in the future. We, we, we impose, impose the, of variables just for in the yield, the end. And we impose that each column of the yield part is sum to a constant of zero. Then, after theta, the, the variables cannot, cannot affect the other, the, the other piece. So, I'm a theta, I'm showing the picture is the same. But, after the step low and high, we can show that the inflation of the, these two steps. Namely, every, every two, every two, every two bits in the same low, just in those levels. So, after the step k is real linear. I will show you in this, in the step k, it's just b x, b x plus one, and b plus x plus two. So, x one, x, x plus one, x plus x plus two. They are levels, but in the third one, in the third areas, each, each, each, each two variables in one low are not levels. So, after the step k, they are not, they are linear. In this case, after one run forward, you know that the input, the output of the one, every bits of the output are linear on the input. Now, we, we show how to keep the one run backward linear. We just linearize the inverse of the k. We use the, we use this preparation of the inverse of k so that the nth of the inverse k can be such as equation one. If we impose the p3 equals zero, p4 equals one, then we have this, this five equations. I show you the equations, we can see that all the a are linear on p1, p0, and p2. That means that if p3 equals p1, and p4 equals one, and if the p2, and p1, it takes p1 in any constant, then h bar degree of the inverse k becomes. So, I'm showing the future, the first error of the future. The last column are composed to p4, and the first column composed to this way, we impose the, the, the great part, the, the last column refers to all the ones, and this way of the all, there was, then in, at the discussion, if we inverse the, inverse this, this step, then the, the inverse of k is linear on this step. So, one one, for one backward, it's the linear. So, to get together with this two parts, we can keep one part one, one in the linear. Let me show you how to keep in one part two, one in the linear. This slide, we need to impose the first, the input of the, of the step k to be the sum of each column to be constant, or in, in, in this case, we need to impose it to be, for first, for example, the first column near to be all one, or all, yes, all zeroes, and the, the, the third column near to be all ones, each, each length of the, of, in this picture are linear, variables. Then we have 10, 60, thinking, thinking for, I think for variables, but we need to fit up step of, in the first one, we need to fit up two times six, four equations. In, in the third one, we need to, in the third, in the third one, we need to impose the equation, is the, the sum of this column to be any constant. This column two, yeah, five columns. Other, other way, we impose this equation, linear equation. Then, the nonlinear, the, the variables in no change. So, then with, with what is that constant? And the yellow or orange are just linear. So, after the second line of low and high is just changing. I'll show you in the future, we can, we can see that in every, every low, the variables of the linear part are not levels. So, after the circumference is still linear. So, we have 10 times, times six, 34, we need to fit up two times 64 equations in the first step, and the five times 64 in the second step. So, totally, we have a low, seven times 64 equations then we, they, they have leave three times 34, 34 degrees. But after we serve the, the total equations, we have found that there are two equations are linear, depending on the other equation. So, the total, the weight of the freedom is 100 and the same at 194. For the case, for the keep the one, one backwards in linear is same as the one, part one, one, which showing a, this column are all zero, this column are all ones, and this just constant for the one, one, backwards is still linear. Now, let me show you the, the first application of the linear structure, the zero-strand integration on KJF, this is just the input sum to zero and the output sum to zero is true. The provision, no zero-strand integration can benefit this two. Now, we can use this step. For this step, just one, one, one for three. In backward or in forward. Now, we can use these two steps. We can use the first one, one in backward and forward. We can also use the one on backward and two on forward. That means we can just, we can improve the previous result without increasing the capacity by two runs, it releases our data here. For example, for 11 runs, which our distribution are practical. For 12 runs, our distribution is tomorrow, then true to 100 on the track in the 28. This is useful, this is interesting because for the 12 run KJF provision or KJF three-compact provision is used in KF on KJF. But this is just the distribution on the provision. Which just here, our distribution does not affect the criteria of these two samples. Now, we will show the second application. Three major attacks. We just leave a example on the check 128. First, we can leave it at two runs, I'll show it before. And we have five to the 12 variables and use the one part of one part. In addition, we can use this two runs, the new instruction to impose the steps, compose a legal message. Then we lose the, we will lose the, the compatibility is two, five, six, and six, six padding for padding. So we lose the 200 and take it to new instruction. I mean, equations. Now we leave, we are left 250 free variables. We will use this structure to mount from three major attacks, three run. For three run, we just use two runs and then we will use the linear structure of KJF and three runs. And then we, for the four runs, we use this one. The partition, linear run, linear structure. Then we can use three, three runs. And then we can mount on four runs of text. This will just, this will because this, this was our text, the full text, and we'll draw the picture. For three runs, we, our text are practical on these three variables. For four runs, our text are almost, almost a practical text. Now, in little bit, we are cut down the, the time to practical text. This is some example for the three runs, primary challenge. For one, we just, first we find the, primary with two to be different with the, with the challenge. And little bit, we find that the real, we have, have showed the property of the two, the test operation and the, it's reversed. And we also show the new structure and then show the two applications. So we left three minutes to shift the sessions. So you can go or you are on the questions. Okay, let's thank speaker for this session and they can contact us afterwards. Excuse me, may I see the next two speakers? Please.