 The next talk is about Relative Tweak Statistical Saturation Cryptanalysis and its application to Karma, and the authors are Muxiao Li, Kaihu and Meiqin Wang, and Muxiao is going to give the talk. Good morning, everyone. Thanks for the introduction. I'm honored to have the chance to present my paper on this special occasion. The title of my paper is Relative Tweak Statistical Saturation Cryptanalysis and its application on Karma. This paper is our joint work with Kaihu and my supervisor, Muxiao Wang. Previous statistical saturation checks proposed by Colored and Standard are all implemented under single key sightings, and there is no public check model under Relative Key or Relative Tweak sightings. In our paper, we proposed a new cryptanalytic method, which is called Relative Key or Relative Tweak Statistical Saturation Check, and we have proved that distinguishers used in this new method are conditional equivalent with those utilizing their key or tweak difference in variant BIOS technique. Hereafter, we will call the key or tweak difference in variant BIOS technique as KDIB or TDIB technique for short. Our automatic searching algorithm for KDIB or TDIB distinguishers is also proposed. At last, we mounted Relative Tweak Statistical Saturation and TDIB checks on reduced round Karma. At first, let me briefly recall the KDIB technique in Keart 19 ciphers proposed by Bogdino Veta. The definition of Keart 19 block ciphers was proposed by German and Weimei in the AS Book. As we can see, each round key key i is x-warding to the state at the end of round i, and a round key key zero is also x-warding to the state before the first round. We use key to denote this column vector, where each round key key i is derived from the mass key caper. Epsilon theta i minus 1 theta i denotes the BIOS of round i, and the BIOS of the linear trail theta under caper is Epsilon theta caper, which can be denoted as this equation. And then the bouse of linear hole gamma lambda under caper is Epsilon caper, which can be denoted as this. From this equation, we have the following conclusion. If this equation holds for all linear trail theta with Epsilon theta not equal to zero in the linear hole, then biases under these two keys are equal to each other. And this is called KDIB condition in our paper. With this KDIB condition, we can give the definition of a KDIB distinguisher. A KDIB distinguisher contains minor linear holes, as well as a fixed key difference data, but it can be called as a KDIB distinguisher, only when there exist a pair of keys. Just as their difference is data, and they satisfy their KDIB condition for each linear hub. For trick alternative methods, we can give a similar check method, which is called TDIB check in our paper. TDIB is similar with KDIB, since trick has the same effect on the bouse of linear hole with key for trick out 19 ciphers. Therefore, we have the following conclusion that if TDIB condition holds, these two bases are equal to each other. Now let me introduce our new proposed method. Related trick, statistical saturation crypt analysis. Assume the block size of the target cipher is n in the statistical saturation crypt analysis. One fixes a part of plaintext bits, which means these R bits are fixed, and then he or she ticks all possible values for the other S bits. After obtaining their cipher texts, he or she considers their distribution of our part of their cipher text value, which means he or she will check the value distribution of these t bits. In our new proposed method, we also fix this a part of a plaintext base and ticks all possible values for the other plaintext bits. But we encrypt this plaintext under related key or related trick pairs. After obtaining these two sets of cipher texts, we compare value distributions of these two parts. In this method, the adversary can encrypt this plaintext under different key or trick pairs, as long as they have the same difference delta. Besides, we also found that related key or related trick, statistical saturation distinguishes a conditional equivalent with key DIB or TDIB distinguishes. Since we will apply this method on the trickable block cipher camera, we will only introduce the conditional equivalence between related trick, statistical saturation distinguisher and TDIB distinguisher. For the other conditional equivalent property, we will omit it, since it has nothing different with this one. Before giving their conditional equivalent property, we make a decomposition of their target cipher. Denote their target cipher with unbit block and cabit trick as h. And then we split their input into two parts, x, y. Their r-bit x is their part fixed in our check, and their s-bit y is their part ticking all possible values. The output of h is also divided into two parts, each one each two, and we only focus on the value distribution of each one. Besides, we also define a function TI, where TI is actually a function h1 when x equals to their constant value i. With this decomposition, we can give their following theorem. Let gamma parameter be their linear whole of h, with gamma separated into two parts. Their first part is their r-bit gamma in, and the mass values on the other s-bit is zero. The output mask lambda is also divided into two parts. Lambda out is their r-bit value, and it cannot be zero. Under this condition, when given a fixed difference data, we have the following conclusion. If the bias is invariant under related trick pairs for all possible mask pairs coming in lambda out, then these two values, these two TI values, will have some value distribution. And what's what's up? This means some values implies some value distribution, and some value distribution implies some values. Given an R1 round distinguisher, we can mount key recovery or checks by adding R2 rounds after it. At first, we chose a set of plaintext p, where x is fixed to bi and y ticks all possible values. And then we can obtain these two sets of, these two sets of ciphertexts by encrypting these plaintexts under these two ticks. And then we guess corresponding key bits to obtain these two TI values. If they have some value distribution, the guessed key bits are taken as red key bits, otherwise they will be discarded. The probability to reject red key is zero, and the probability to accept a round key fulfills this equation. This equation implies that the probability is sufficiently small. In practice, when finding a related trick or a related key, statistical saturation distinguisher directly is extremely hard, but a KDIB or TDIB distinguisher can be easily discovered. Hence, we can first find a KDIB or TDIB distinguisher, and then we convert it into related key or related trick, statistical saturation distinguisher by following the way introduced in the conditional equivalent property. Now, let me introduce how to choose for KDIB distinguisher with STP for Key Outer 19 servers. The other search and algorithm for TDIB distinguisher is similar with this one, thus we omit it. STP is a decision procedure to confirm whether there is a solution to a set of equations. So our job here is to build some equations. From previous KDIB attacks, distinguisher were derived at reward level for linear masks and bit level for key difference. Hence, in our search and algorithm, we focus on world-level mask propagation property in the round function and bit-level difference propagation properties for the key schedule. In practice, when aiming at finding R-round KDIB distinguishers, we always have to describe mask propagation properties from two sites, and their meeting point should have some active pattern. Our whole algorithm can be divided into four parts. The first part describes the world-level mask propagation properties. For the substitution operation, the active state of the output mask set out equals to the active state of input mask set in. For the XOR operation, denotes active states of these two input masks as set in one and set in two respectively. And the corresponding active states of output mask set out equals to set in one equals to set in two. When describing world-level mask propagation property of three branch operation, we always have to decide one of these, or decide the active state of one of these three branches according to mask active states of the other two branches. Assume that we have known active states active mask active states of these two branches. Denoted as set one and set two respectively. Then the mask active state of the other branch set three will equal to one if set one equals to one or set two equals to one. But this word is potentially active or definitely active. The linear layer can often be represented as a matrix multiplication to specify its world-level mask propagation property. We have to introduce the definition of a deterministic pattern. Let the column vector m in amount, respectively, denotes the column-wise mask active states of input and output of m. Then the peer m in m out is called to be a deterministic pattern if m out is unique given I mean. And we use site g to record these deterministic patterns. With this site g we have the following conclusion. If the column-wise active state of input belongs to the site g, then the column-wise active state of output mask set out will equal to the corresponding m out. Otherwise, all of the outputs will be potentially active, which means set out equals to this vector. The first part is used to depict bit liable different propagation properties for the substatution operation. Let ddt represent its differential distribution table. And Darlene-Darlot respectively denotes its their respectively denotes their input and output differences. If the corresponding propagation probability is p, then we have this equation and p cannot be 0. For the XOR operation the output difference equals to the XOR value of these two input differences. For the three branch operation these three differences will equal to each other. Part three describes their KDIB condition. Given an R-round linear whole, theta 0, theta r and their difference on key we have the following KDIB condition, which is this equation holds for all possible linear trills with epsilon-theta not equal to 0 in this linear whole. Since theta variables are 1-bit values and the dart variables are specific differences, we have to rephrase this KDIB condition into what level? Which means if this word is active then the corresponding key difference should be 0 otherwise we will have no restriction on its difference. The last part part four describes some necessary restrictions in order to exclude trivial solutions we have to require that at least one-round key difference is non-zero. Besides equations describing their active states of input and output masks are also included in this part. For ciphers containing S-box in their key schedule equations restricting their total propagation probability are included in this part. Compounding all these four parts and then input these equations into STP we can obtain KDIB conditions. Now we will apply our new analytic method and our 13-algorithm on KAMR. KAMR is a trick-able block cipher and this is its structure. It has about two cans of block sizes 64 and 128 denoted by KAMR 64 and KAMR 128. The key size is 2 times n which is separated into two parts w-their-raw-key-their-raw and their trick size is n bit. KAMR 64 has 16 rounds and KAMR 128 has 24 rounds. Utilizing our 13-algorithm we can obtain seven different 8-round TDIB distinguisher for both variants and this is one of them for KAMR 64. In this distinguisher these two input masks should have same mask value as well as these two output masks. Since we will only add several rounds after their distinguisher when mounting related trick statistical saturation checks, the first round of the distinguisher should be a reduced round. Hence, these two input masks can take all possible values but these two output masks should have same value. Since the output mask cannot take all possible values we have to introduce the following theorem to obtain invariant value distribution property. The theorem 3 tells us that if the output mask satisfies the restriction that these two mask values should be the same then we have the following conclusion. If we fix these two words into a fixed value i and takes all possible values for y then the X or R value of these two words will have same value distribution with the X or R value of these two words. Utilizing this 8-round related trick statistical saturation distinguisher we come on to key recovery of checks 11-round camera 64 and this is our result. This check is the longest check result considering outlining key. Besides we also mounted TDIB attacks on 11-round camera 128 and this is also the best result considering outlining key in terms of rounds. My report is finished. Thanks for your attention. Any question? Did you try to apply to any other cipher or is there any specific reason to apply to Karma? Well we didn't apply this technique to other ciphers and I think there is no specific reason to attack Karma. We have to read their document camera and apply to this method. Thank you. Let's sing to speaker again.