 My name is Zhiqiang Liu. I'm from Shanghai Zhongdong University, China. This work is a joint work with Bing and Winston and some other guys. First day, I will give a brief introduction to the motivation to do this work and some related works and some main results of our work. And then I will give some definitions used in this work. And our work mainly consists of four parts. The first part gives the links between impossible differential in the zero-clutch linear how. And the second part gives the links between integral and the zero-clutch linear how. And the third part builds links between impossible differential and integral. And the fourth part applies the above links to some block-cyfers and structures and get some new integrals. And finally, I give the conclusion of this work. And block-cyfers are considered vital elements in constructing some cryptographic schemes such as stream-cyfers, hash functions, MAC, and so on. And the co-security of these schemes depends on the underlying block-cyfers. Up to now, many cryptanalytic techniques have been proposed to evaluate the security of block-cyfers. And along with more and more cryptanalytic tools being proposed, one may ask if there are some direct links among different cryptanalytic tools. And this topic has been actively investigated recently. In Eurocrypt 1994, some results on the links between differential linear cryptanalysis was proposed and later, in Eurocrypt 2013-2014, these results were further improved to make it more applicable. And some new formulas between the probability of truncated differential and the correlation of linear how was proposed. In Eurocrypt 2012, some results on the links between integral and the zero-correlation linear how was proposed. And it shows that zero-correlation linear how can lead to an integral distinguisher under certain conditions. And a special integral can lead to a zero-correlation linear how. And in Eurocrypt 2013, some results on the links between impossible differential and zero-correlation linear how was proposed and later in Asia's 2014 and FSC 2015, these results were further improved to make it more practical. And from above, we can see that although relations among some important cryptanalytic tools have been investigated, the link between impossible differential and integral distinguisher is still missing. That we aim to fix this gap and establish links between impossible differential and integral cryptanalysis. And in our work, we mainly focused on the links between impossible differential and integral distinguishers because distinguishers are essential points in evaluating the security of block ciphers against the various cryptanalytic tools. To do so, we firstly introduced the concept of structure and dual structure. And then by using this definition, we firstly built the links between impossible differential of a structure E and a zero-correlation linear how of its dual structure, EDUAR. And then we proposed the relation between a zero-correlation linear how and integral. Then we can build the links between impossible differential of a structure E and an integral distinguisher of its dual structure. In the case that a structure E and its dual structure are linearly equivalent, then we can get direct link between impossible differential and integral distinguisher of the structure E. Now we give some basic definitions used in our work. Generally, no matter which linear transformation a cyber adopts, it's always linear over F2 that we have the following definition, that P be a linear transformation over F2M for some positive integer M. Then the matrix representation of P over F2 is called primitive representation of P. And in many cases, when we construct impossible differential or zero-correlation linear how, actually we are only interested in checking if there is some difference or mask of an Xbox. And we don't care about the value of this difference or mask. For instance, the impossible differential or zero-correlation linear how of AES and Chamelea. Let's to say if these ciphers adopt some other Xboxes, these distinguishes still hold so we have the following definition. Let E be a box cipher with bijective or not bijective Xboxes as the basic nonlinear components. Then a structure on F2M is defined as a set of box ciphers E prime, which is exactly the same as E except that Xbox can take all possible bijective transformation or possible transformations on the corresponding domains. And based on this definition, we can define an impossible differential zero-correlation linear how of a structure. Let A be a belong to F2M. If for any E prime, A to B is an impossible differential or zero-correlation linear how of E prime, then A to B is called an impossible differential zero-correlation linear how of the structure. And now we give the definition of dual structure, let FSB be a physical structure with ESP type round function and that primitive representation of linear transformation be P, then sigma be the operation that exchange the left and the right half of a state, then the dual structure of FSB is defined as sigma FP transpose S sigma. And let ESB be an SPN structure with primitive representation of the linear transformation being P, then dual structure of ESP is defined as ESP inverse transpose. Now we give some schematic description of the structure FSB and FP transpose S. Now we give links between impossible differential and zero-correlation linear how. Firstly, we observed that if A to B is an R round impossible differential of FSB, if and only if it's an R round zero-correlation linear how of its dual structure. And here we give some brief idea of the proof. If there exists some E belonging to FSB dual and some linear how del 0 del 1 to del R plus 1, such that the correction of this linear how is not equal to zero, then one can find E prime belonging to FSB and a differential del 0 to del R plus 1 of E prime. Such that the probability of this differential is larger than zero and vice versa. Both cases lead to contradiction, so we prove the theorem 1. Similarly, we can get A to B is an R round impossible differential of ESP if and only if it's an R round zero-correlation linear how of its dual structure. In Indochrypt 2012, some people proposed the following method to find impossible differential of some block ciphers with SP type round function. Here we give a brief introduction of this method. That the input difference of I round function BXI, the difference after applying the S box of diffusion layer BYI and XI plus 1 for given input and output differences. So the corresponding linear system and if there is some inconsistence between XI and YI, then we can find an impossible differential. Actually from the proof of theorem 1 and theorem 2, we can conclude that the method presented by Uwandewang in Indochrypt 2012 could find all impossible differential of the structure, FSP and ESP. Actually this result can be used in the proof of security of block ciphers against impossible differential cryptanalysis. And because we can use this result to find the longest impossible differential of the structure, FSP and ESP. In the case P is invertible, we can change the structure FSP transpose S to FSP transpose. Actually the structures given in this figure are exactly the same. And with this equivalent structure, we have the following result. Let FSP be a physical structure with SP type round function. And that primitive representation of the linear transformation be P. If P is invertible, then finding zero collision linear half of the structure FSP is equivalent to finding impossible differential of FSP transpose. And specifically for physical structure FSP with SP type round function, if P is invertible and if P equals to P transpose, there is a one-to-one correspondence between impossible differential and zero collision linear half. And for SP and structure ESP, if P transpose product P equals to the identity matrix, then A to B is an impossible differential if and only if it's a zero collision linear half. Now we give some links between integral and zero collision linear half. Firstly, we prove the following results. Let A be a subspace of F to N and A to B the dual space of A and F and F is a function of F to N. For any lambda belongs to F to N. A T lambda is defined as FX XOR lambda. Then for any B belongs to F to N, the following equation, Boolean equation holds. And we also get the following lemma. Let A, F and T lambda be defined as above and then for any B belongs to F to N, we have the following Boolean equation. With demo one, we can get further result. Let F is a function of F to N, A be a subspace of F to N and B is a non-zero value. Suppose that A to B is a zero collision linear half of F, then for any lambda belongs to F to N, B in a product FX XOR lambda is balanced on A dual. Actually, this balanced property is a zero sum property. It is a zero sum integral property. It can lead to zero sum integral property. And we have a non-zero, non-trivial zero collision linear half of a block cipher always implies existence of an integral distinguish. If A to B is a zero collision linear half, then if A forms a subspace, then we can derive an integral distinguish from list zero collision linear half. And if A doesn't form a subspace, we can choose a subset A1 of A, which forms a subspace, then an integral distinguish can be derived from the zero collision linear half A1 to B. And in this case, A1 dual is the input of integral distinguisher. From above we can see that a zero collision linear half may indicate different integral distinguishers. And actually, it was mentioned in ASHA CRIP 2012 that a zero collision linear half can lead to an integral distinguisher under certain conditions. Well, our result shows that these conditions can be removed that leads to a more applicable links between a zero collision linear half and integral distinguisher. And by using this theorem, we can also use this theorem to find integral distinguisher of block ciphers. Actually, an A1 zero collision linear half can be used to construct an A1 integral distinguisher. Now, we give the links between impossible differential and integral distinguisher. Based on the links given above, we can establish a link between impossible differential and integral distinguisher. Let E be a structure, FSP or ESP, then impossible differential of the structure E always implies the existence of an integral of a dual structure. And in the case that the structure E and its dual structure are linearly equivalent, we can get direct links between impossible differential and integral distinguishers. And we now give some cases that a structure E and its dual structure are linearly equivalent. Let FSP be a physical structure with ESP round function and let the primitive representation of the linear transformation BP if P is invertible. And there exists a mutation by satisfying the following conditions. Then for this structure, FSP and impossible differential always implies the existence of an integral distinguisher. For instance, for block cipher snake 2, with this result, we can derive an integral distinguisher from an impossible differential of this cipher. And let ESP be an experience structure with the primitive representation of linear transformation BP if P transpose product P equals to a diagonal matrix. Then for this structure, an impossible differential always implies existence of an integral distinguisher. And also we give some example for the block ciphers, Array and Prince, with this result, we can derive the integral distinguisher from an impossible differential of this cipher directly. And specifically for bit permutation, the corresponding matrix P satisfies P transpose product P equals to the identity matrix. And so we have for experience structure, which adopts a bit permutation as diffusion layer and around impossible differential always implies existence of an integral distinguisher. For block cipher present, with this result, we can get an integral distinguisher from an impossible differential of this cipher. Now by applying the above links to some block cipher structures, we can derive some new integrals. Firstly, we can, for the physical structure with round function being bijective, we can get 5 round integral distinguisher of this cipher. And for physical structure with f function not being bijective, we can get 3 round integral distinguisher of this cipher of this structure. Here, actually, for physical structure with f function being bijective, the previously best integral distinguisher of this structure is 4 round integral distinguisher. And while by using the links proposed in our work, we can derive a 5 round integral distinguisher of this structure. And we also build some, build 24 round integral distinguisher of the cast 256 and 8 round integral distinguisher of Chameleon without FL layer, and 12 round integral distinguisher of S4. And all these integral distinguishers of the ciphers are the best integral distinguisher of these ciphers. Finally, we give the conclusion of our work. We have investigated the links between impossible differential integrals. And to do this, we have introduced the concept of structure and dual structure. And established in the following steps. Firstly, we derived relation between impossible differential of a structure E and a zero current linear half of a dual structure. And then we improved the relation between zero current linear half and integral distinguisher of bulk ciphers. That is a zero current linear half always implies the existence of an integral distinguisher. And then we build the links between impossible differential of a structure E and its integral distinguisher of a dual structure. And in the case that E and E dual are linearly equivalent, we can get the direct links between impossible differential and integral distinguisher of the structure E. And our results not only allows to achieve a better understanding and classifying of impossible differential integral and zero current linear cryptanalysis, which can be helpful in designing bulk ciphers, but also improve the cryptanalytic results of some bulk ciphers structures. Thank you.