 Very happy to give this presentation improved security evaluation of SPM block ciphers and its applications in the single key attack on Skinny. I am Wen Yingzhang from Shandong Normal University. This is a joint work with Li Chuncao, Jian Guo, and Anne Paslik. Along with the development of Internet of Things, some new symmetric key cryptographic schemes have been proposed. The security evaluation of these schemes against some well-understood cryptanalytic techniques is an important task. There are about eight distinguishes for block cipher. In these people, it just affects on the first five distinguishes. This work is motivated by the work of Sun Bing and Skinny Cryptanalysis Competition. Sun Bing proposed a matrix-based approach which extracts and deals with binary information, measuring whether words appear or not. More sophisticated distinguishes taking into account the exact number of occurrences cannot be deduced from the matrix-based approach but can be derived using R method. For example, for Skinny, by using R method, one can identify that the 8-bit of the X7 is balanced when the 12th and 13th row of plaintext traverse over F2 to B. On the other hand, the matrix-based approach will only identify it as an unbalanced one. The aim of Skinny Competition is to motivate agitensive public scrollty of the cipher. The goal is to recover the secret key from a given encryption of a known book with 2 to 20 randomly selected plaintext and ciphertext pairs. So it is given plaintext to a text. So far, the maximum number of a text round are 12 and 10 rounds correspondingly. One of our contributions is that we introduce a rather simple but novel approach for checking the resistance of a cipher against some distinguishes. The core idea of our approach is a useful representation of the round function as a multivariate polynomial of plaintext rows. The main approach based on counting the occurrences in a multivariate model gives a simple and intuitive description of SPN block ciphers. Our method improves the work of Sun Bin in Cript 2016 because the counting process in our case takes the number of occurrences into account and not only whether a certain word appears at the output or not. Skinny is a family of lightweight block ciphers. Proposed at Cript 2016, it adopts the SPN structure, just like AS. That is, S bobs add constants and add round key, shift row, and mix column. This figure illustrates the structure of Skinny block cipher. We represent the words of the first round by the plaintext words in formula 1. By iterating this representation, we get the expression of the s word of round 7. The expression can devise into two parts. In the first part, p12 appears once, and p13 appears five times. In the second part, p12 appears twice, but p13 appears once. Our integral distribution is based on the following theorem, that S1 and S2 be permutations. Then, the sum of this formula over this set is 0. Let's divide the sum into two parts. In the first part, we take sum over x first and then for y. In the second part, we take the sum in another order, that is, y first and then x. The inner sum are all 0s, which proves the theorem. This figure illustrates the process of building an integral distribution. Let's start from state 2. We encrypt it till it achieves 4 diffusion, and we decrypt it till there is at least one word that is independent of it. Hence, we get an r dEc minus 1 plus rEnc round integral distribution. Here is a 10-round integral distribution for skinny. We use the 7-round integral distribution and add 3 rounds on the top of each. Similarly, we can build impulse ball differential distribution. Here is a 4-round impulse ball distribution for AEs. For skinny, we found 16 11-round impulse ball differential characteristic. We turn to zero sum differential. Assume the expression of one word around r is of the form. There are two sub-functions. Pi is independent of f1 and pj is independent of f2. Then the cycle has an r-round zero sum distribution. For skinny, after 5 encryption rounds, p14 doesn't occur in the 7th word of x5, and p13 doesn't occur in the 10th word of x5. First of all, we have this formula. So the sum of this word over four plain texts from s, p13 and p14 from s, this and the other words be constant. It's zero. We can also use occurrences of the linear combiner. Add the first equation to the second one. We can get the third word and the fifth word of x6. The sum of the third word and the fifth word of x6 equals to s of x512 plus k12 plus k15. That is, this sum is dependent on x512. And since p15 doesn't occur in the expression in x512, so it is independent of the linear combination of the two words. This is a strong-conquited differential requiring a single plain text, self-text pair for distinguishing skinny from other block ciphers. We can also extend the distinguishing one more round in the backward direction. Suppose that we vary x1, 15 while keeping the other words fixed. From equation 1, we have x17 equals to sp3 plus k3 and x1, 15 equals to sp3 plus k3 plus sp9. And we need x17 be fixed, so p3 is constant and p9 is active. Except that x1, 15, there are two words, x1, p3, and x1, 11 depends on p9. So we have to add two constants. To sum up, we have the following theorem. Suppose that the two different plain texts are selected so that pi equals to pi prime, except for the sixth, the ninth, and the 12th word. And additionally, we have the two constants. Then, the difference of the third word and the fifth word is equal. The last part of this talk is the practical attack on skinny. Recall that for our seven round integral distinguishing on skinny given as before, when p12 and p3 go through f228 while keeping the other words of plain texts fixed, the word with coordinate 8 sum to 0 after 7 encryption round. We apply the four round at the bottom of its integral distinguishing and achieve 11 round attack on skinny. We represent the eighth words of x7 by the self-text. In this expression, they are 6 by k. So the time complexity is 2248. We can also attack 12 round and 13 round skinny by adding 1, 2, 3 round on the top of the seven round integral distinguishing. We can get serial total attack on 14 round, 15 round, and 16 round skinny. The open problem is, of course, the practical attack on more round skinny. Thank you very much for listening.