Hello, everyone. It's your girl, Kenzie here from Layton Sports Guards, and I'm repping the second half of our case here. We got 2022 top stadium club chrome baseball. Hobby eight box break number eight. Pick your team got Andrew B. Dodgers, Billy K. Yankees, Bob C. Debacks, Chris V. Royals, Christian P. with the Rockies, Edward P. Astros, Ethan S. White Sox Tigers, Metz, Fidel G. with the Ace, Harayuki K. with the Cardinals, James P. Braves, Jason P. Padres, Jess G. Marlins, Joe T. with the Mariners and Phillies, John A. Pirates, Joshua B. Brewer's, K.P. A. C. with the Angels and Rays, Michael S. Rangers, Nick A. Cubs, Ryan B. with the Reds and Nationals, Ryan D. Twins, Samuel S. Blue J. Sinvicta with the Orioles, Stefan P. Giants, Thomas V. Red Sox, and Victor F. with the Guardians. All right, best of luck, everyone. Get only one more baseball break going for the daytime, and it breaks next. Let's get that one filled up five to go. Get yourself a whole division. Five teams. 32 autographs coming out of that break on average.  Looking for big rookies, up-and-coming prospects, some nice vet hits and that as well. So overall, really, really nice second product there with a wide range of hits possible. Jose Ciri, we've got orange Tyler Glass now. Here you go. This is a race case here. Two of 25. Good way to start there. Tampa, who's got them? Keith H. Bean team, Raffy Devers. Strowman. Hope that runs off. Two great starts to their Saturday morning. Their weekend. Vladdy Trophy Hunter. Yeah, I think I'm lying. Thank you. Not sure what's going to be on, but okay, we'll find something. Blue, uh, Frankie Montas. Uh, Yankees 21 of 199. What? Brass, straw, Cervino. Maggie, team of the future refractor, Will Smith. Team of the future, Ronald Acunha Jr. Alexi, here you go. Or are they talking about on Sports Center this morning? Who did what now? CJ Abrams, Oni, Bean, Team Rookie Refractor. Washington, Neil Cruz-Rookie. We've got Refractor Andre Dawson. The old school photos on these, too. We've got red, Dwight Gooden for the Mets. There's a red. Five of five. Here you go, New York. Nice red. Mets is Ethan S. That's on that one, Ethan. That's cool. Luke Williams. Marcino. Nice color in this case so far. Pachado, we've got green, Rookie Otto of Juana Paz. Cardinals. Nice. It's not that one really big, too. 59 of 99. And Squall, made it back soon. Don't yell at me. You're wrong. We've got gold of Anthony Rizzo that is 12 out of 50. Yankee's also doing well in this case. Andre Dawson, Matt Sui. This is the first box, then. No, not yet. Manoa, Team, Bean, Team. All right, we've got Correa, Refractor, Voitz, and Josh Bell. All right, next box. Again, y'all, still spots to go on our next break. We need some help getting that one filled up. Bowman's Best, Eight Box, Full Case Break, Random Division Style. There's the link. Christian just dropped for you. Let's get that one filled up. Again, that does break next. Team of the Future, Tatis, Drew Ellis. And after that, we've got F1 as well. Our first F1 is going to be a six-box mixer. Lubaub on the green for the White Sox. That one is to 99. And Cardinals, again, another bonus auto, right? Or no, that was the last one. Brandon Donovan for the Cardinals. Let's see if we can pull two out of this one as well. Griffey and De La Cruz, Rookabase. Teeth, Bean, Team, Acunia, Muncie, Machado. Bean, Team, Tatis, Arias, Hank, Aaron. See another red. That was sick, that first one. Amira's, Trophy Hunter, Freddie Freeman. Abrams, Rookabase. Lattie, Justin Turner. You also got Sam tonight with more group breaks if you don't see anything like during the daytime. He's got more products going tonight. Random Teams, Pick Your Teams. And you got Kyle over on drip, Griffin Personals tonight. Juan Soto, BM team. Personals will only be over on drip tonight. You are able to pre-order boxes on drip, too. Verlander, Trophy Hunter. Seen that quite a bit. Strider, Max Freed, Refractor, Bagwell. Der Jeter, Trophy Hunter. As we've got Blue, Eugenio Suarez for the Mariners. 50 out of 199 on the Mariners color in this case, too. Jeremy Penyer, Rookabase. Ever, Shohei Aotani, Team of the Future. Garcia, Wade Jr. Last pack, Box Two. Torque, Rookabase, Tigers. Cronenworth, Refractor. George Bretz. All right, that will do it for the first two boxes there. Let's see where we are. Still five to go, y'all. Breaks next. Five to go.  Random Division style. Again, 32 autographs coming out of that break. 32. All these nice autos. Nice numbered cards. It's great products along. So like I was saying, it's got a good rookie checklist. It's got a great prospect. Some nice vets as well coming out of that product. Blue, Jim Palmer. There you go, Sim. Jim Palmer on the blue for the Orioles. Oh, wow. And to 199. And how about base card autograph? Green Refractor Parallel of O'Neill Cruz. There you go, Pittsburgh. Nice one there. That's going to be John A. Congrats on that Cruz. Heck yeah. Green should be to 99. Wookiee and Akon. Very solid case so far. Team of the future, Wanderfranco. Rookie. Austin Schmidt, Wanderfranco. Rookie Bice. Team of the future, Tucker. Steph Beer, Rookie. Rookie Refractor, Wanderfranco. You'll raise. Ran Swanson.owski. VM team, Rookie Refractor. Hunter Green for the Reds. Destiny Refractor, Juan Soto. Rookie Refractor, Otto. Ryan Valade. I think the Rockies were the last team taken. Ego Rocks on the Rookie Refractor, Otto. Stay out team of the future, Juan Soto. Cruz. Again, y'all. One more baseball break for the daytime. Bowman's best up next. Refractor, Lance Lynn. Random Division style. Rockies and Little Leagues. Nice, T-Po. Beam team, Mike Trout. Collier Stremsky. I used to play for the Commanders. Well, back in the day, they were the Redskins. My local flag football league. Nester Cortez. That's the only team I can remember.  Beam team, Aaron Judge. All the boys would laugh at me. And then they saw me come up on your center. That's the quarterback.  Ichiro. All right. Last pack. Box three. Got Green Trevor Rogers for the Marlins. 72 of 99. Beninteni, D'Arvish, and Elliott Ramos. All right. Box four. It was always flag football. My parents would never let me play tackle. My mom goes, girls aren't meant to get hit like that with tensing. Whatever, mom. Flag football, it was. All right, y'all. Let's see where we are. Still five to go. Five left in that. And then our F1, it's still at five. Five and five on the next two breaks. Let's get some of those spots filled up, y'all. We've got Gold Robin Yacht. There you go, Brewers. 38 to 50. Some cool old school names coming out of here. Springer, Hernandez, Grille. And five to go. 480, a spot beam team. Say a Suzuki Refractor. Sandberg, Strawberry, Hernandez. Four autographs. Her box on those. Eight total boxes. White Park on the Rookie Refractor. Pirates. Beto. Team of the future, Julio Rodriguez, Rookie Refractor. We've got a Cal Raleigh for the Mariners on the Rookie Refractor Auto. Big dumper here. Seattle. That was a nice break. Blue Gehrig and Julio Rodriguez with the base. Big dumper. We've got Blue Max Scherzer for the Metz. That one is 57 of 199. Metz with some nice color too. Kershaw Refractor. Big hurt. All right. Yup, Big Dumper is his nickname. Beam team, Rizzo. Brandy Johnson. Brandy Johnson. Daniel. She's some help getting this next one filled up. Five to go. Bowman's Best Baseball. Rodriguez Refractor. Looking for prospects, rookies, vets. Great product for all the above. India team of the future. Rim division style. So you get yourself five teams for spots. Ken Griffey, Junior Dynasty Refractor. We've got a Trophy Hunter Wave Refractor. Mariano Rivera. Yanks. Point. Palmer. Stianos. Louise Heel. We've got Refractor Wave. Cabrion Hayes. Pirates. Doing well. Say it's Suzuki. Kirby. Beam team. Mickey. Last pack. Box four. And big poppy. All right. Here we go. Box five. Halfway through this break. See, let's see, let's see. Still five to go. Five to go, y'all. Tweet it out real quick. Appreciate your patience. There is the link for you. Christian just dropped. We've got Wander Fracco team of the future. Rookie Refractor. Chapman. Manea. Ken Zagore. And now one breaks.  Noah Glavin on the Refractor. Beam team. Rookie Refractor. Wander Fracco. Well, Shkulio Rodriguez. Rookie Base. Spado. Beam team. Shohei. Showtime action there. Let's see that dual auto of him and Trout. Have you seen the photo of those? No. Oh, that's sick. Chipper Jones trophy, honey. I don't see too much of their dual autos. Got blue. Zack Wheeler for the Phillies. 118 of 199. Phillies. Dynasty Refractor. Brace Harper. Beam team. Another Showtime. On the Wave Refractor there. Spencer Torkelson on the Beam team. Rookie Refractor. Valkyrie Maté Turner. Shohei, trophy hunter. Got blue. Mackenzie Gore Rookie. Nets. That one is 99 of 199. Say it's a Zookie Rookie. Got green. Jarenda Rand. Nice one there. Boston. 45 of 99. It's green Rookie. Palacios. Do you have a favorite baseball team? Do you have a favorite baseball team? The Rays. Nice. Give me the featured Tucker. Donovan. Ever been to any of their games? Yes. Yeah, nice. Elliot Ramos, Rookie Refractor. We've got a Joe Perez, Rookie Refractor Auto. Astros. Man, Astros had like three or four autos out of this case so far. There's Strauss. McGill and Strasburg. It's been a long time. Last time that I went to a race game. Wasn't it used to be called like Truck Can of Field or something? It's still where they play. When they were the Devil Rays. Buster Posey. That was, that wasn't like elementary school. We went like at a summer camp, trip, field trip. Went to Rays game. That was the last time. All right. Still five left y'all. Still five to go. All right, here we go. Luke Boyt Refractor. Got Shane Boss, team of the featured Refractor. Beam Team. Okay, Betz. Stio Blue, Jack Flaherty. Cardinals. That one is 82 of 199. Stio, Ramos, Jodell. Got Beam Team, Rookie Refractor. Julio Rodriguez. Feeling the big auto coming up here. Raleigh. Mickey Cabrera.  Green Jonathan India for the Reds. 10 of 99 there. Lattie Destiny on the gold. Nice one there, Blue Jays. That's 48 of 50. Destiny. Alonso and Correa. Joey Vado. Thank you, Betz. David Wright Refractor. Wanda Franco, Rookie Base. Team of the Future, Torque Rookie Refractor. Ty Cobb and Plain Park. Where it says Wanda Franco on the Destiny Rookie Refractor. Of course, Santa. That was a nice hit there. Gold Vladdy. It's a nice insert to pull a gold too. Team of the Future, Chizon. We've got Luis Heal on the Rookie Refractor Auto. Yankees. Got a Yankees. Big auto there. Thomas. Nice in. Whereon on eBay. Beam Team Rookie Refractor. Bobby Whit Jr. No. See Salvador Perez. Joe Ryan. Nelson Cruz. All right. Let's see where we are. Still five to go, y'all. Oh, wow. I'm glad you're able to find it. There you go. One second here. Box seven. Try getting a discord. Off the look. All right. Box seven. Team of the Future, Sean Murphy.  Beam Team Rookie Refractor, O'Neal Cruz. Pirates. Christian Yellowch. Badoo. Refractor, Kyle Hengex. Elise was in a safe place. No, I'm not like stuck under a couch cushion or something. Aeronado. Wood. Team of the Future, Austin Riley. Bobby Whit Jr. Rookie. Refractor, Joe Adele. Bobby, Schwerber, Ashby. Oh man, that would not be good. Aeronado, Beam Team. We've got Gold Nelson Cruz. Washington, 42 out of 50. Glen Trophy Hunter, Akunya Jr. Babe Roots. Crawford, Ryan Malkoussel on the blue for the Orioles. 180 out of 199. Another O's hit there for you, Cent. Local kid there. Destiny Adele. We've got Destiny on the Wave Refractor. Got Team of the Future, Hunter Green Rookie. And a Otto Otto here for the Blue Jace. Otto Lopez. Rookie Refractor, Otto. You have Sam with another nice hit there. Toronto. Stewart Fairchild on the Rookie Refractor. Rez. Osmond Beltre. Beam Team Refractor, Pete Alonso. All right, last box here. Let's see, let's see. Still five to go there and five to go in F1. If we can't get this one filled up, we may have to push it to the end of the day. If that's so, we do have five to go in the first F1 break. There is a link for that again. That is a six box break, three chrome lights, and three hobby. Chrome hobby. Rain and Team style on that. You'll get a F1 team paired with an F2 team. 1.15 is spot there. Fractor, Trey Turner. Once in the glass now. Fractor, Jinru. We've got Rookie Refractor Otto of Montero for the Rockies. Rocks taking home his second Otto there. Last Team taken Mojo. We'll go Colorado. Blue Bob, Team of the Future. Yeah, let's get this Bowman's Best Baseball filled up, y'all. Tucker Refractor. Let's get it filled up so we can continue on. Again, it is a random division style. 32 autographs coming out of that break. Yeah, not only looking for Rockies, you get big prospect autos out of that possible. Nice vet hits possible as well. Nice low numbered.  Green, Fetto for the Tigers. 96 of 99 there. Hanager, Castro. Yeah, it's a little bit pricier because it is a random division. So there's only what six spots to that break. Rookie, Blue, Joe Denod. That is six out of 199. You get five teams per spot there though. Five teams at spot. Beam Team Refractor, Freeman. Randall, Blue Bob, McCarthy. Refractor, Jose Altuve. We've got Wave Refractor, Team of the Future. Kyle Tucker. Cini, Torque on the Rookie Destiny. Hashtag left here. Refractor, Cool Hosts. Great. Team of the Future, Rookie Refractor. Bobby Whitjr. Royals. Yautza. Beam Team Refractor, Joey Votto. And Base. All right, let's do a quick recap here. Got a couple oranges. And then our autos. We had the Orange to 25. Tyler Glassnow. Rape's. Red to five. Dwight Gooden. Sweet one there for the Mets. A Ryan Valle, Rookie Refractor. Otto Rockies. Montero Rockies. Otto Lopez. Blue Jays. Louise Heel. Yankees. Joe Perez. Astros. Big Dumber. AKA Cal Raleigh. For the Mariners. Brendan Donovan. Cardinals. The Green to 99. Wanyapets. And then the O'Neill Cruz. On the Redemption. Green Refractor Parallel. Should be the 99. For the Pirates. Nice second half there. We've got Bowman's Best coming up. Once it fills. Thanks everyone.


Auzbillahim Nisheet Wa Raajim, Bismillahir Rahmanir Rahim. Hello, we were talking about early years development and self-management of children. And we like to discuss about self-management at early age. It's very crucial and very important because this one is the age that is the base providing to the rest of the life. And this is the component of the age in which the children's mental health is improving, in which their mental health is improving, in which their physical health is improving, and in which they are getting shelter and they should get the right direction. In this, we see that children learn a lot related to their homes. That is, first of all, they need to learn different small skills that how they manage their things. How they manage small tasks.  And then the push and completion of it is very important for them to get their player. In this, only the activities of the home will not be done. In fact, when they complete the activities of the home, that is leading towards everyday life in which the child is going to interact with the family, with the other persons of the society. For example, on the shopkeeper, how he talks to them, how he talks to them to get his things, how he communicates with them, how he handles them and how he does his work. These are small tasks that they learn from the home and reach society and make their everyday life a reality. In this, when they are well managed in the society, we see that their activities are based on their academic performance. The academic performance means that they go to their institution, maintain their uniform, look at their homework, class work and their academic behavior. How he listens to his teachers, how he reacts to them, how he acts on them. And similarly, there are some things related to the resilience, how he insists on completing his task, and the fact that he creates the strength and endurance for his task. In this, we are also seeing how he does his work. The work that is productive, which can be useful for himself, which can be beneficial for his family, he does his work like this. And he does his work, but the importance of valentine. The work assigned to him or done by him, he does valentine. For example, we say that he brings water and he spends a lot of time to get the water. It is important for him to finish his small task and spend a lot of time on his task. And similarly, how he contributes, and all his contributions, make him self-confident. He believes in his task to complete his task. Yes, I am doing this and I can do this. Leading towards the completion and initiation of the other task. And for the success of the task is based on the confidence of the first task. And it is a greater success of a child, when the child is going to think about that I am able to do this and I can do this and I can take up the next assignment and I can do it, I can perform it very well. In this, we see that the child is reinforced for the good behavior, for good behavior, for good action, for others who like it, for others who are acceptable, he performs it. And in this, there are a lot of behavior problems which he prepares himself to face, to interact with, to resolve. Because he has a lot of patience, he has the ability to control it, he has the ability to understand it, he is able to do it. And in that, we also see that teachers, and parents, and friends, and his family members assure him, they make him confident. Yes, you are successful, you are doing well. If the child got appreciation and also assurance from the all sort of corners, the child manages himself with a complete success in his own way, that is a self-management for the good and successful life. Thank you very much.


Good morning, everybody. So I'm going to talk about our work on quantum security of MNEC. And this is a joint work with FAMZON. And this is my attempt at illustrating MNEC under quantum-supproposed query. And so what I'm going to do is this. I'm going to first talk about briefly about quantum security in general. And then as a warm-up, I'm going to talk about cascade construction. And then finally, I'm going to talk about MNEC. So about quantum security, in a sense, we can say that quantum security is a stronger version of post-quantum cryptography, where the adversary not only has a computational capability, but also the computational communication capability with this environment. Of course, that can be formalized as adversaries' ability to make quantum-supproposed queries to its oracle. So unlike the classical case, instead of making a query X and receiving an oracle answer OX, the adversary can prepare a query as a superposition of different messages, X, and getting, again, superimposed answers. So perhaps one motivation for this is from the quantum-random oracle model. So if we regard a random oracle as an ideal definition of hash function, then we can see that any quantum adversary can evaluate the such hash function in superposition. Why? Well, maybe perhaps in order to do a grover search. But anyway, in that case, we can think that the traditional formulation of the random oracle model doesn't do justice in formulating the adversarial capability of quantum adversary in such setting. So therefore, the correct notion seems to be the quantum-random oracle model where the adversary can make quantum-supproposed queries to the random oracle. In a sense, the quantum security is the full generalization of the quantum random oracle model, and then now the adversary can make quantum-supproposed queries to all of its oracles. For example, when you are talking about encryption schemes, then you would be decryption oracle. And for this digital signature, that would be signing queries. So despite this is a relatively recent area, there are already many interesting results, both positive and negative. And so now there are some constructions that are developing quantum random oracles. And there are some PRFs, MEX, encryption schemes, and signature schemes, and so on. And on the other hand, there are also many interesting attacks. These attacks are especially interesting because they are successful quantum attacks on the classically secure schemes. Examples include Evans-Mannsor-Cypher, Lovirokov-Cypher, and CVCMEG, and other block-cypher-based PRFs. And especially all these works are based on quantum algorithms called Simon's algorithm in a clever way. And especially the last work about CVCMEG and others that were presented in crypto last year. And that actually partially answers the question posed by Bonnet and Zandrii. Can we construct a quantum secure PRF for a large domain from a quantum secure PRF for a small domain? In particular, do the CVCMEG or MEG constructions give quantum secure PRFs? In other words, can we do PRF domain extension in the quantum setting? And so, well, they say that for CVCMEG's case, the answer is no. But in a sense, our work is complementary to that. We have proved that MEG, HMEG, AMEG, and some other schemes are quantum secure. Of course, if the underlying small PRF is quantum secure. The main ingredients we have used for this are first, oracle indistinguishability of functions and a notion we call PRF security under random leakage. So I'm going to first talk about cascade construction. The cascade construction is I start with a small PRF where the key space is equals the core domain. And we can build a larger PRF simply by processing, iteratively, process each message block one by one. The result is the cascade construction. Here, I'm illustrating the three block case. And classically, the cascade construction is known to be secure if the number of message blocks are fixed. And the result is done by Bellary, Carnegie, and Grosig in 1996. And the proof uses a two-level hybrid argument. In one level, it's over the message blocks. And in another level, it's over the queries. And I will briefly show the outline of the proof. So the proof consists of a successive games, indistinguishable games. And all of them are identical, except how the oracle is prepared. Of course, in the original game, we have the cascade construction. And we move to the next game where the first PRF instance is switched to a uniform random function. Of course, this change is indistinguishable due to the PRF security. And in the next game, we are going to eliminate one more PRF instance by the uniform random function. And we are going to do this once more. And we finally arrive at the game where the oracle is uniform random function. But in order that this outline works, each successive game should be indistinguishable from the previous one. So we can see that each oracle query to this left-hand side part should be indistinguishable from the oracle query to the right-hand side part to allow this switch. But if you look at this carefully, then we can see that this does not involve just single PRF instance, but actually many PRF instances. Because whenever the adversary makes a query of z of x, that will produce a randomly chosen PRF key, row of z. So therefore, if the adversary makes total Q queries, then there are Q keys are involved. So there are Q PRF instances. To handle this situation in the classical proof, a notion called multi-oracle security was given. So this is not complicated. It simply says that if you have a polynomial number of independent PRF instances, that will be indistinguishable from the same number of independent uniform random functions. And of course, that can be proved by a simple hybrid argument. So now the multi-oracle setting is ready. Now we can argue that we can carry out the outline that I have explained. So whenever the adversary makes total Q queries, then we can prepare Q instances. And then using this multi-oracle indistinguishability, we can simulate the transition from this oracle to that oracle. So that's more or less the outline of the classical security proof of the cascade construction. Unfortunately, that doesn't really work for the quantum setting. Because obviously, if you look at this proof, then it is assumed that each individual queries are unsuperposed. And of course, that's not true in the quantum security setting. But one interesting thing is that at least one special case of the cascade construction was already proved to be quantum secure. That is, in fact, the GGM construction. Given by Goldreich, Waldwasser, and Michali, this is a way to construct a PRF out of a length doubling PRG. And in 2012, Zanderi showed that GGM is quantum secure if the underlying PRG is quantum secure. So one simple observation we can make is this. If we modify the notation a little bit, we can immediately see that GGM is in fact a special case of the cascade construction when the underlying PRF can process only one single bit. So in fact, that can be readily extended to the case if the underlying PRF has a polynomial-sized domain, because such a PRF is in fact PRG. So what we need to do is to remove this restriction to the general case. So to do that, let me briefly review Zanderi's approach for proving quantum security of GGM. So first step is to repackaging the classical GGM security using a new notion called oracle indistinguishability. And then he proved the oracle indistinguishability using new techniques suitable for quantum setting. And so let's talk about oracle indistinguishability. Suppose we have two probability distributions, D0 and D1. And of course we know what do we mean that these two are indistinguishable. So it is hard to distinguish one sample of D0 from the other sample from D1. In that case, we say that these two are indistinguishable. Then we can say that these D0 and D1 are oracle indistinguishable if it is hard to distinguish arbitrarily sized indexed family of independent and identically distributed samples from D0 and from the same kind of samples from D1. And we are going to eventually apply this to PRFs. So we need to talk about IID samples of functions. So let's be a little bit more formal. Suppose I is an index set. And suppose D is a function distribution. Here this notation y to the x is a notation for the function space from x to y. And imagine y and x are like the bit strings, space of bit strings. And then I'm going to define this D to the i. This is a distribution of random functions of type i to D, y to the x. So how do we define it? Each image f of i is chosen independently according to the distribution D. Remember that this distribution is a function distribution. So therefore, each f of i is in fact a random function from x to i. And in fact, we can take a slightly different but equivalent point of view by considering the hiring isomorphism. So simply y to the x to the i is isomorphic to the y to the i times x, y. Because as I told you before, fi is a function from x to i. So this can be evaluated on any point x. But the effect is that this gives you a function of i and x together. Because these two viewpoints are completely interchangeable, we can regard this D to the i as a distribution of random functions from i times x to i. So now we are ready to talk about oracle indistinguishability of functions. Suppose i is an index set, and we are given two function distributions. And I'm going to define that they are oracle indistinguishable if it is hard to distinguish one iid sample of D0 from another iid sample of D1 by any quantum adversary who can make quantum queries. And also, we can talk about oracle security of PRFs using this. We say that PRF is oracle secure if it is oracle indistinguishable from a uniform random function. And in fact, that turns out to be exactly the notion required for carrying out the security proof for the cascade construction. Let me show you why. So here we have an index at i. And for each index i, we need to pick a uniform random instance, independent random instance of PRF. And to do that, we need to pick a secret key for this particular i that in fact gives us a uniform random function kappa from the index at i to the key space of f. And we need to compare this oracle with another oracle chosen by choosing a uniform independent random function for each index. But if you think about it, that's simply a uniform random function of i and x together. So in fact, oracle security gives us this indistinguishability, which exactly is the right shape for carrying out the security proof for the cascade construction. So the only remaining problem is, is the PRFf oracle secure? The answer is yes. In fact, it can be more, slightly more general. And if we have two efficiently sampleable indistinguishable function distributions, then we can prove that d0 and d1 are oracle indistinguishable. In the classical setting, the proof will be even easier. So it can be done by simple hybrid argument over queries. But of course, in the quantum setting, that is not possible. But again, we can rely on a technique developed by Zandri for the context of the GGM security that we can switch to small range distribution. So unlike the IID distribution, in the small range distribution, each image fi are not chosen independently. Instead, we fix a small number r, and we are going to first choose r number of independent samples. And each fi's are chosen to be uniformly one of those r samples. So there will be necessarily lots of duplicates, and only there are only r genuine independent copies. And what Zandri showed in the security of GGM setting is that it is indistinguishable from switching from the IID distribution to the small range distribution. So here, what we need to do is to compare small range distributions of d0 and d1. And in fact, now what we can do is we can do the hybrid argument over those r independent copies. So gradually, one by one, we can switch those r samples from d0 and d1 to finish the proof for the ORACLE indistinguishability. Well, now we are ready. Everything's not essentially done for cascade. So if f is a secure PRF, then according to previous argument, f is ORACLE secure, then using the ORACLE security, we can carry out the hybrid argument for the cascade construction, which proves the quantum security of cascade construction. OK, let's move on to the MMAG. MMAG is simply a cascade construction with additional post-processing by additional independent PRF instance. And so it requires two keys, one for the cascade and another for the post-processing. And that post-processing prevents the extension attack. So unlike the case of the cascade construction, it allows processing variable length messages. And classically, of course, the security of MMAG is proven. And when you try to adapt those classical proofs to the quantum setting, we weren't able to do that. So we have devised a direct hybrid argument using an extended version of ORACLE indistinguishability. And for do this, we need an additional property of a secure PRF. But before that, the first step in our proof is to replace this outer PRF instance with a random ORACLE H. Of course, this is possible due to the PRF security. And so from now on, I'm going to pretend that, so here is an illustration again for a three block case. And from now on, I'm going to pretend that this is the definition of MMAG. OK. So this post-processing random ORACLE is very helpful because it prevents the extension attack. But on the other hand, this is not helpful because it prevents using PRF security. The reason is this. The adversary can make different message block queries. So if the adversary makes zero block query, then the cascade will simply output the security k and which will be post-processed by H. And the adversary now has access to H of k. Of course, this is problematic because what is PRF security? After all, that's simply ability to substitute one PRF instance with a random function. But in order to guarantee that, the security k should be, well, completely secret. And so now the adversary knows H of k. This is an information leakage. However small this might be. So what we need is that this PRF instance should remain secret to the random, even when H k is leaked for a random ORACLE H. So now we can expect that because the amount of information leakage is too small, intuitively it is almost clear that if F is secure, F should be again secure even under random leakage. And in fact, that's I'm going to say that. So anyway, I have defined this notion, formalized this notion, security under random leakage as follows. So imagine two games. In one game, the adversary is given PRF instance a random ORACLE and a hash of the security k. And in another game, the adversary is given a uniform random function and a random ORACLE and a fake hash value. And if these two games are indistinguishable, then we say that PRF is secure under random leakage. And of course, so classically, it is not that hard at all to show that a secure PRF is secure under random leakage. And we were able to do the same in the quantum setting. And the techniques we have used are Dominic Unruh's 1A to hiding lemma, and also PRF security against key recovery. So by invoking a 1A to hiding lemma, we were able to bound the advantage of the adversary under random leakage by this right-hand side term. So you can see that, basically, if the function f is secure, then the right-hand side is negligible. Well, this is a very weak bound, but still, as enough to prove security under random leakage. But what about the I mentioned security against key recovery? But what about key recovery? Isn't it obvious? So if key is recovered, then all bets are off. But contrapositively, if your scheme is secure, then it should be very hard to recover the key. And of course, in classical setting, there is a very easy proof. And let's briefly see how it works. So if you have a key recovery attacker, then using A, you can build a distinguishing attacker. B runs this key recovery attacker until it outputs a candidate key, k. And what Bnext does is to check if this answer is right or not by verifying this key at an uncured point, z. So you'll see if this equation holds or not. And this B will output 1 if and only if this verification checks out. And in fact, this is fine in the classical case, because if this oracle is a PRF instance, then B will output 1 with non-negligible probability, as large as the success probability of A. And on the other hand, this is a crucial part. If all is a uniform random function, this all z, because z is uncured, so this left-hand side will be independent from the right-hand side. And this is really from random. So therefore, the verification may check out only with a negligible probability. So that's how classical proof goes. But as you can see, in the quantum setting, the problem is that even one single query may potentially probe all the points in the superposition. So in other words, there may not exist any point z in the domain where all z is independent from the right-hand side, fk of z. So the classical argument doesn't hold here. So of course, the obvious way out is to instead of verifying at an uncured point z, we can verify at a random point. And intuitively, we can see that this should obviously work, but still analyzing this may not be completely trivial. And in fact, we are able to prove that if the PRF is secure, then it is secure against key recovery by reducing to a variant of quantum search problem. So now, we know that PRF f is secure on the random leakage. And this can be looked in a slightly different way, an equivalent way. So consider two function distributions. In a one-function distribution, key is chosen and hk is concatenated by a PRF instance. So in this function, the first part is essentially random constants. And in D1, again, a random w is chosen, which is concatenated by a uniform random function. So what PRF security on the random leakage says is that these two distributions are indistinguishable. If f is secure, the question is, are they automatically indistinguishable? Well, almost, but not so fast. Look at the definition of D0. This construction depends on h. And the adversary also has access to h. So therefore, we need actually one more update to the notion of autocorrect indistinguishability. So in fact, that's possible. And now we can say that D0 and D1 are autocorrect indistinguishable relative to h. And we can essentially say the similar things. So now these two distributions are autocorrect indistinguishable. What do they mean? So given any index at i and any index i, we can pick a random key, kappa of i. So due to this autocorrect indistinguishability, in short, we can safely pretend that h of a random function kappa of i and f of kappa of i and x can be swapped with the independent uniform random functions of i and ix respectively. Actually, this substitution is enough to prove quantum security or NMAC. So I'm going to show you briefly.  And again, all the games are identical except how the oracle is prepared. Of course, in the original oracle, we have NMAC. And first thing we are going to do is to substitute this random key syntactically with a random function of a singleton domain. Of course, they are the same thing. It's only a syntactical change. And now that's done, let's look at this. So this part is h of random function and f of random function, same random function and argument and so on. So from the oracle security, we can see that we can substitute these two parts independently to arrive at this. And of course, we can do one more same substitution. So again, this is h of a random function and f of the same random function and some other argument. And again, we can substitute these with two independent random functions once more. And of course, we can repeat this until we get rid of all of PRFs. And finally, we arrive at a game where the oracle is uniform random function. And essentially that proves the quantum security of NMAC. And so I have shown you the proof that cascade construction and NMAC are quantum secure. And using some additional assumption, the quantum security of HMAC follows immediately. And using similar techniques, we were able to also prove quantum security of augmented cascade and NMAC. Thank you for your attention.