 So we have two talks here and the first talk is entitled Include Conditional QV attacks on KJIT modes with MILP. So the authors are Chen Li, Wen Zheng Li, Xiao Yan Feng and Xiao Yun Wang and Chen Li. Thank you for the introduction and I'm happy to share our works about improved additional QV attacks on KJIT mode with MILP method. First I will introduce KJIT modes and their great analysis results. The KJIT modes use KJIT P for communication as external for mutation and it has seven choices for its list. From 25 to 16 times as the six can be represented as three dimension states co-ordinated as X, Y, Z. So the round function has five operations. The first is this operation. This operation adds the sum of colors to its neighboring bits and rule operation rotates the list. High operation permeates all the lines and K operations provides multi vacation in the round function. And so that's the addition to the zero zero round constant. In our attack we omit the tall operation. The KJIT mode constructions KJIT MAC, KJIT MAC, under previous key we can control message and get message, see for attack time for our analysis. And KIA, KIA is AAE. We can control NOS and get NOS, plan types, see for attack time for crit analysis. So this is summary of crit analysis results. For KJIT MAC, for the two variants, we have improved the attack by wrong. And for KIA major we explored the shorter lengths and for the same rounds we have improved the time complexity and also for the KIA minor. Then I will introduce some related works. In cube attack, a safer algorithm is represented as polynomial and T is a product of public variables. So the monomials in F which is divided exactly by T is put in T times P and the others are put in Q. So when they sum up F over all the values in CT, they can find that the sum is just P. Then T is simple such as linear. The equations can be solved and get the solution of K piece. Conditional cube attack, they give definition of conditional cube variables and ordinary cube variables. Conditional cube variables can choose in the first round with speed conditions. The speed conditions are about K piece and NOS piece. Then the requirement is that in the first round all the cube variables do not multiply with each other. And in the second round the conditional cube variables does not multiply with all the ordinary cube variables. So we use the simple case that there is only one conditional cube variable. So after several rounds the public term of all the cube variables will not appear. There is the red key guess in the other polynomial. So in the first round the product term will appear. So the red key guess can be found. And linear structure means that if the first four piece in a color is the first four piece has variables in it, then the last one piece be the sum of the first four pieces. This operation will be an identity. Can true that the sum of five pieces in a color to be constant, then this operation will not diffuse the variables in it. They notice this property as a safety light kernel. In fact to reduce the diffusion of ordinary cube variables, we set them as safety light kernel. Then I will introduce our works to reduce the number of guess in piece. Usually they like conditional cube variables in one color, in one color like the blue piece in the figure. So the base conditions are beside the obvious conditions. And the key is put in the first two lines. So the three lines are padded with zero. So the white lines are the space they can search for ordinary cube variables. So to find enough ordinary cube variables are the key points in our attack. And we introduce a new MILP model to find enough ordinary cube variables. For each piece, AX, Y, Z, we set a sample AX, Y. AX, Y, Z, and if there is the variable in it, the sample is Y. If there is no cube variable, the sample is zero. To model the safety light kernel, there are two cases. One is that there is no cube variable. And the other is that the number of bits containing cube variable is no less than two. So we can add a linear equation to control the diffusion in this operation. And the constraints they should require us to do is to avoid the number of bits containing cube variables in each color from being one. And they should also record this color containing cube variables. And for each color, they use D to record whether it contains cube variables. It is similar to the bits of samples. So for each color, if there is the cube variable one bits, D must be one. And the sum of bits of samples must be no less than two. So these equations can constrain that the states obey the safety light kernel. For each color, if there are cube variables, then they need a linear equation like a proof. If there is cube variables in a column, they should be one for the number of dependence variables. So for one this dependent cube variable objective, the objective function is like this. This just records the number of cube variables in the whole state. And to model the first round, when though the condition, any of cube variables do not multiply with each other in the first round. So if two bits multiply, they add the constants that the sum of them must not be more than one. Then to avoid them to appear at the same time. And for the condition that conditional cube variables do not multiply with ordinary cube variables in the first round. So if the bits multiply with conditional cube variables, the corresponding bits symbol must be zero. For the second round, it's similar, but before model the second round, we must add the conditions in the first round. And after that, for the new states, if one bits multiply with conditional cube variables in the second round, we let the bits symbol to be zero. This is the application for the above model. First the two lines are quibis and these are conditional cube variables. White ones are the space to search for ordinary cube variables. So according to the modeling search strategy about, we will search the next single number of independent ordinary cube variables. This is the objective function and the constants are added for modeling safety like kernel. And using symbolic computing, we can add the constants for the first round and the second round. If any v zero, v i exist, then the single form of v i must equal to zero. If v i, v j exist, then the sum must be no more than one. Also for the second round, after adding the bits conditions in the first round, if any v zero, v i exist. So the corresponding bits symbol must equal zero. So we get the MILP model in the letter. This is the objective function and these are constants. With the help of Ruby, we get the optimistic results. We can say the objective value is 66, so we can select the variables which are assembled with one. At last we can select 64 cube variables from v zero to v 63. v zero is chosen at first in the beginning and v one to v 63 are selected by our MILP search strategy. So with the correct K guess, the product will disappear. So cube variables are zero, but with the wrong K guess, the product appears. So the cube sum is non-zero with high probability. So the correct K can be selected. This is the application to k i major. 7 round conditional cube attack on k i major needs 64 variables. And the 6 round conditional cube attack needs 32 variables. So in the table, we can find the person of the 2 round conditional cube attack. 4 round is more than this. 7 round attack can be performed. And 4 round is no less than this. 6 round conditional cube attack can be performed. These other applications for k charge back k i major, they are similar. And we have 2 sum tests. Like 5 round attack on k i major and test for cube sum in 6 round attack. And our source codes are online. Thank you for your question. Questions? I have some questions. So did you try to search for another 1 more round? For k charge back, we have improved by 1 round. But for k i, we... I mean, did you try to improve more? Or you can't find solutions or you can't search for a space because it's too large? I think it should use new methods. Requires new methods. So actually, can you go back to page 20? So your search says that the objective value is 66. So why do you select 64 cube variables? What's the gap in there? It's based on the k charge p communication for our property. The launch function is degrade to 7 round. And in the first round, it will not mount the time. And in the following 6 rounds, it will be 64 degrade. Thank you. So, any questions or questions? We'll see if we can walk on. OK, so maybe the last question. So do you think this can be done? This can be searched by another 2? Like the SAP software or constraint programming? So is there any particular reason that you chose MLP? That's a small comment. I see. OK, so thank you very much. So let's thank the speaker again.