I'm the Comic Weekly Man, the Jolly Comic Weekly Man. And I'm here to read the funnies to you happy boys and honeys. Yes, boys and girls, it's comic weekly time.  Right out of the pages of Puck the Comic Weekly, straight into your living room, your friend the Comic Weekly Man, the Jolly Comic Weekly Man. Hello! Well, little Miss Sally, how are you today? Oh, I'm just fine. And I'm supposed to tell you hello from four of my friends. Four of them? Mm-hmm. They told me to tell you that they just love the Comic Weekly. Isn't that wonderful? What are their names? Well, they're three brothers and their sister. And their names are Susie and Jean and Lenny and Bird. Well, just for that, we'll have to read the funnies for them, especially today. So now here we'll read Puck the Comic Weekly in just a moment. But before we do, let's listen to this nice man. Now here we go with Puck the Comic Weekly. And on the top of the first page, Hopalong Cassidy. Oh, this is getting so exciting. Oh, you bet it is. So here we go with Hopalong Cassidy. Magic words for the music, please. Very well, my lady. Six guns blazing as he thunders along. Give us music for Hopalong. Hopi, California and Lucky have miraculously escaped from the outlaws hideout when they set it afire. They're taking Felipe toward his father's hacienda, a Spanish word for home. Slote and his henchmen have spotted them. And they've written into a town called Rio Vista and have told the sheriff there that Hopi, California and Lucky have kidnapped Philip.  Slote replies, That's right, Sheriff. Meal it out with the poor boy as soon as they saw us watching him. The sheriff grabs his gun and heads outside saying, We're round up a posse. I'm deputizing you, gents, to point out the kidnapper's trade. First picture, second row, Hopi and California and Lucky are leading Felipe home. Felipe, who has lost his eyesight from being blinded by the sun, hears the sheriff's posse behind him. And he stops and says, Wait, whoop beats coming this way, Senoras? California looks back and sees the posse approaching and exclaims, Hey, they're behind us. Slotes me and hanged if he hasn't brought a whole gang to run us down. Well, that's all Hopi needs to hear. And in a second, Hopi leading Felipe's horse and his pals are burning leather. First picture, bottom row, they come to bend in the road. Hopi sees a path leading through the trees and he yells back to California. We're splitting up. You and Lucky lead him astray. I'll try and get Felipe out of this. Hopi leading Felipe gallops off into the underbrush beside the road. There they dismount and hide in the bushes and wait for the posse to pass.  Hopi says, they'll be doubling back once they discover we've tricked them. Let's clear out. They come out of the trees and seeing a wall ahead of them. Last picture, Hopi exclaims, Ah, we're in luck. We'll be safe till night behind this wall. What Hopi doesn't know though is that behind the wall stands a Mexican rancher gun in hand waiting for Hopi to gallop through the gate. It certainly looks that way. I wonder who that Mexican rancher with the gun is. Well, next week we'll find out, I'm sure. Who this here? Huh, huh. Now should we read Prince Valiant? Oh yes, please. And I'm sure he must be. Well, turn over the page and let's... Yes, here he is on page three. Yes, tell me so he could get warm furs for the monks in the monastery. And just as he was starting off her home, loaded down with the furs an arrow whizzed through the air and landed at his feet. And when Val looked up, he saw Lully. Well, let's find out more about this. So here we go with Prince Valiant in the days of King Arthur. Heckard, Bracket, Grey Malkin and Quince music romantic for a fair, fair prince. Prince Valiant looks at his late attacker at the position of the sun, the surrounding rocks, then at the still quivering arrow at his feet and the group of men swarming up the valley. He strings his bow and last picture top row with the advantage of shooting downhill, Val sends an arrow whistling toward them. A second later, they respond with a volley of arrows but the distance is too great for accuracy. But at the price of three arrows, Val collects 24 and first picture next row, which his opponent still fire at him, Val quickly picks up the arrows and stuffs them in his quiver. And now, well supplied with ammunition, he loads the skins on his shoulders again and leaves the valley. He starts diagonally up the ridge, climbing over the rocks. The valley falls away below him and the barbarians try to head Val off as he passes above them, clinging to the narrow ledge in the rock wall last picture second row. But the steep sides of the valley and the soft snow hinder their climb and they can't get to Val hard as they try for his picture bottom row. Who knows what these squat men are. One of the wandering tribes perhaps from the distant steps forced ever westward by the pressure of more savage tribes to descend like birds of prey on hapless Europe. Val up above last picture is finding the way he's become steeper and the melting snow makes the rock ledge more perilous. There's no place to rest. Val must go on. And a new enemy confronts him. Behind him are the savages. And below is a drop of a hundred feet if he makes one single misstep. And night is coming on. Yes, he's in a dangerous spot having to spend the night on a thin ledge on the mountain side. He certainly is. We'll find out more about this next week. Now, how would you like to read Uncle Remus? Oh, I'd love to read Uncle Remus because he's my favorite, favorite. Well then, let's turn over the page and go past little Iodine and Snuffy Smith. Then turn over another page. There, in the middle of page seven is Uncle Remus and his tales of Brer Rabbit. Say the magic words with me. Hippity hoppity, make it a habit to give us music for old Brer Rabbit. Uncle Remus says when Brer Rabbit was teach in school the young ones was getting good notions. Yes, Brer Rabbit is teaching school to some of his little rabbit friends and he's drawn a picture on the blackboard of Brer Fox and a rabbit. He's worked out a arithmetic problem which says that one fox plus one rabbit equals no rabbit. This means a fox will eat the rabbit up because the fox is bigger than the rabbit. Below that, he's drawn another picture of a fox plus five rabbits equals no fox.  In unity, there is strength. That's all for today, children. And all the little rabbits dash out of school on their way home. When they get outside, one rabbit says, hurry up, hurry up, I know what to do. And down the road they go following the leader. A little later, we're out on the edge of a high cliff beside an old hollow log and the leader of the little rabbit has taken a firecracker out of the log and is about to light it. All the other little rabbits are lined up and the leader rabbit says, everybody ready? And his friend replies, yep, everybody in place. Here it comes. And the leader touches a match to the fuse. The fuse starts to burn and quickly, last picture, top row, the rabbits hand the firecracker from one to another until it gets to the last one at the edge of the cliff, first picture, bottom row. And that little rabbit tosses the firecracker over the cliff and it heads straight for Brer Fox who is sound asleep at the foot of the cliff. And a second later, there is a... And last picture, Brer Fox his clothes blown all the tatters, holds his aching head and moans Why in the world did that come from me? And Uncle Remus says Clubbed together and you get unity. Individually, you get clubbed. I should say it so.  And you stick together with a lot of other little friends. The big fellows are going to leave you alone. Yes, that's very good because I don't like bullies. No, neither do I. And now I believe it's time for Dag-Win and Blondie. And here they are on the first page of the second section of Puck the Comic Weekly. Very well, here we go with Dag-Win and Blondie. Ram-a-foo, Ram-a-fum, Zim-Zim-Zombie, Conjury Music for Dag-Win and Blondie. There's a knock at the door. Blondie answers it. And a workman says, Well, repair in the water, I mean, we have to turn up the water for the whole street for two hours. When Blondie tells Dag-Win they won't have any water in the house for two hours, he exclaims, What, I was going to take a bath.  So Dag-Win dashes up to the bathroom and runs water in the tub. And he exclaims, Hey, I got the tub filled just before they turned it off. First picture next row, Dagwood's in the tub, enjoying his hot bath, and he says contentedly, My nerves have been on the ragged edge. This sizzling hot bath is just what I need to soothe them. Suddenly the bathroom door opens. Cookie and her pals come in, each of them carrying a little pan. Cookie says, I haven't even watered Daddy. We're making my pie. And they scoop water out of the tub. And out of the door they go, leaving Dagwood looking a little surprised. He settles down in the tub again. Suddenly the door opens again. The dogs come running in and jump up on the edge of the tub and begin to lap, get up really. Blondie says, The pups are terribly thirsty, dear. Can they have a few sips? The dogs finish with their drinks and trot out of the bathroom with contented looks on their faces. Leaving Dagwood looking quite disturbed. First picture next row, Blondie quickly dashes in, dips a pail in the tub and says, And I'll just need a bucket full to finish mopping up the kitchen. And walks out of the bathroom with a smile on her face. Thanks, Dagwood. Leaving Dagwood looking very angry. A moment later, a neighbor lady rings Blondie's doorbell.  I just started my laundry when they turned it off. Blondie looks upstairs, and then... Last picture of the row, all the women in the neighborhood are running toward the Bumstead house carrying pots and pans because they've heard there's water in Dagwood's bathtub. First picture of the row, they're all upstairs in the bathroom, dipping water out of Dagwood's bathtub. As one lady says, Well, what became of Mr. Bumstead? He doesn't seem to be in the tub. Well, Dagwood is hanging outside the window from the sill without any clothes on, except the bath doll around his waist.  The ladies have all gone, and they thank you. Dagwood climbs through the window mournfully. And last picture, we see him sitting in the bathtub, but you can't see any water. And as he sits there, hating people, a little boy comes in and says, I mean, I feel my water at Mr. Bumstead. No, there wouldn't be any left for me. That's the funniest thing you ever saw, any water in it. Yes, poor Dagwood. Everyone takes advantage of it. Yes, in the tub. Well, look underneath Dagwood and Blondie. Oh, it's a exciting adventure. Well, I'll read to Roy Rogers in just a moment, but before I do, here's that nice man again with something interesting to say. Now, here we go again with Puck the Comic Weekly. And on the first page of the second section, Roy Rogers, King of the Cowboy. Oh, I'm anxious to find... When he went into the blacksmith's shop, that convict that escaped from Roy jumped on Roy and knocked him out. And then he closed the door to the blacksmith's shop and set fire to the hay inside and was going to leave Roy to burn to death. But then Trigger kicked open the door and pulled Roy out with his teeth. Now let's find out what happens with Roy Rogers, King of the Cowboy. Magic wits for the music, please. Very well, my lady. Now here we go with Roy and Trigger. J. Lucian Dangerfield, Roy's friend, has really put Roy in the spot. In order to get publicity in the newspaper about his Wild West show, he had told the newspaper man that Roy Rogers would deliver the escaped convict Handel's Baldwin to the sheriff right in the ring of the show. Now, this is something Roy didn't know about. Today's the day of the big show when Dangerfield is out front announcing. Step up, folks. Behold the world's most depended show. See Roy Rogers in the center arena. Roy, who was recovered from the blow when his head given him a Baldwin, rides up and says, Hey, hold everything, Dangerfield. What's the idea of this crazy story? Are you plumb local? He shows Dangerfield the front page of the Sarapute newspaper, which has big headlines reading, Roy Rogers promises to deliver the convict to sheriff at Wild West show today. Dangerfield says proudly, Yes. A sensational publicity stunt day. What, Roy? Oh, look at this crowd. Roy replies, a fine pickle you've got us in. I don't even know where Baldwin is. But I do know that he's gunning for us both. Dangerfield exclaims, Roy, you think that Handel in Ruffin is here? Roy grabs him by the arm and heads him toward the inside of the arena saying, You get into that arena and tell the crowd that story is something you dreamed up. Dangerfield protests, Oh, but my booze and friend, you can't do this to me. They'll want the money back. Oh, no, no, no, Roy. Please, no, no. Last picture, top roll. Handel's Baldwin, who is disguised as a cowboy, sees Roy in Dangerfield walking toward the arena. And Baldwin says to himself, I'll fix that bragging Rogers so that all he'll turn into the sheriff today is himself on a slab. First picture, bottom roll. Dangerfield is stopped beside a pen holding a huge bull and he says, Why, Roy, I've even imported the Pampers Killer, the world's most voracious bull. I'll go bankrupt if the crowd demands this money back. Roy have pity. Roy replies, get going. You should have thought of that before planting that false story in the newspaper. As Roy leads Dangerfield toward the gate into the ring, Baldwin slips around to the pen saying, So you're the Pampers Killer, huh?  Go get Rogers. And he opens the pen, freeing the bull. The bull trots out, sees Dangerfield and Roy walking into the arena, and he lets out a bellow and gallops toward them. Somebody in the crowd yells, Hey, look out, the world bull is loose. Roy turns around, last picture, sees the bull coming toward him and he claims to run Dangerfield. I got to stop before you hurt somebody. He certainly is and heading straight for Roy. I wonder what Roy will do to stop him. It looks like the crowd will see something they didn't expect. That handle's balling. Well, next week we'll find out more about that. Now let's turn over the page and see who's there. Oh, look, it's Flash Gordon. And you remember, he defeated the mean wizards and he was very kind to Queen Suni. Oh, he was. He destroyed the magic ray machine by which the wizards had kept everybody's slaves on the planet. And he showed Queen Suni's people how to build modern machinery. And then he began good. That's right. So he'd be able to get home again. Let's see what's happening now. Very well. Here we go with Flash Gordon. Regga regga dune dunes. Ask him a task. Let's send music for heroic Flash. Flash finishes his space rocket and bids his friends farewell. He tells Dale, we'll head for Earth. It's a long trip in an untested ship. But I promised I'd take you home at last. Last picture, everything is in readiness for Flash's departure. He and Dale settle down in the cockpit of their new rocket ship. And Flash's ship blasts itself free from the small planet's gravity and drops its used up takeoff rockets. And last picture, top row, Flash is off on the long curving course toward Mother Earth, which he and Dale haven't seen for years. First picture, bottom row, Flash is looking through his telescopic navigation glasses. It's much later. He pauses in his star navigation and looks at Dale with quiet triumph and says, that's it, Dale. There's our Earth. And it makes Dale so happy, she begins to cry. She can't even see it as much as she wants to. As they're near the Earth, Flash reaches for the rocket controls and says tensely, fasten your belt. A meteor's crossing our path. Gravity's pulling us together. I've got to change course fast. This is a tense moment because the meteor which is a shooting star falls swiftly toward them, a fiery blaze. Straight toward them, it roars. Separately, Flash pulls at the steering lever and not a second too soon, he dodges the meteor which falls past them toward Earth. Last picture. But all Flash's landing plans are ruined. He's plunging into the stratosphere at a speed that will quickly turn the rocket into a white hot shooting star. I'm afraid not. You see, when he had to change his course quickly, the atmospheric pressure sucked him out into the stratosphere, a layer of air outside the gravity pull of Earth. You mean that? That's right. I'm afraid it's pulled him so swiftly he can't slow his rocket ship down. Well, where will he land? Hmm, that's something we'll find out next week. Wait to hear about that. Oh, and neither can I. Well, now... Oh, it's going to happen to Dick. Well, Dick had brought General Afriat and Baron DeKalb to help General Washington in his fight against the British, remember? Yes, and just as the British were about to attack, George Washington met his army to a place outside the town of Philadelphia. Yes, a spot called Brandywin Creek, and there they dug in, waiting for the British attack, which is expected any minute. Regret. Very well. Here we go with Dick's adventures and say the magic words with me. Regretty-pack-a-zack-a-zick. Let's have music for adventurous Dick.  Matt Anthony Wayne, one of the most famous generals of the Revolutionary War, fighting at a place called Chad's Ford on Brandywin Creek in Pennsylvania. Last picture top row, the British seem to be preparing to smash through at Chad's Ford, but it's only a faint, because instead, Dick sees first picture second row a mighty British force led by Cornwallis. Cleverly marches up the Brandywin, crosses it unseen, and makes a surprise reappearance behind the American line. Dick is dismayed when he sees the British army coming at them from behind, but then at the same instant, last picture of the row that the Redcoats attack from behind, they have battalions on the opposite bank, waiting this signal starts swarming across in an overwhelming rush. The Americans are caught between two walls of British forces that are closing in on them, and the battle rages furiously, becomes a hand-to-hand combat. The Americans are atnumbered in men, guns, and ammunition, and in this instant of real panic, Dick and the men around him, first picture bottom row here, Anthony Wayne yelling above the roar of muskets and cannons. Fight, boys! Fight! Wayne himself is fighting like a madman. He and his men hold off the British while Washington's army manages to get away and regroup for a battle at a later date. A retreat of Washington's men, covered Wayne and his battle-wearyed boys see that the army is safe and that darkness is fallen. They slip off into the fog and darkness and safety for themselves. Leaving the British to wonder what happened to the army they thought they had in their clutches. I kept the British fighting them so that Washington's soldiers could get away. That's exactly what happened until darkness and then under cover of the dark, they all slipped away and it seemed to the British that the whole American army had disappeared. But the Americans lost that battle, didn't they? Yes, they did. Sometimes you have to lose battle, so save your army for another battle. Oh, then it isn't really so terribly bad, is it? Well, like so many things. You know, you have to have some disappointments today so that you can make things come out right in the end. Oh, bicycle. You have to give up a little things today. Oh, you understand perfectly. Thank you. Mm-hmm. Well, now... Oh, now I know. How? Well, because here he is right below Dick's adventures. Well, why didn't I get that? Remember, Rusty had bought the painting of the horse for $0.50 in that old shop. And that was the cause of some trouble because a young man named Smith in a nearby town learned that his landlady had sold the picture from his room and he became very unhappy about it and he's gone in search of the picture. He's learned that someone at the Miles farm bought the picture and so he's bought an airplane ticket to Lexington, Kentucky. And just about this time, Mr. Miles sold Rusty and Tex that they were going to go home to Kentucky in the track. Yes. Well, now let's find out what happens next in this mystery. So here we go with Rusty Riley. Gallop and run till the road is dusty. Give us music for his horse and Rusty. Rusty comes in to Mr. Miles and says, Oh, I've got big plays in the horse man, Mr. Miles, and all the luggage, too. Tex and I are ready to leave. Well, okay, Rusty. I'll go out with you. I want Tex to do something for me in the way. So Mr. Miles goes outside with Rusty to the truck where big plays is loaded.  Mr. Miles hands Tex some money saying, Oh, Tex, there's a shortcut to the new highway that goes right by the airport. I want you to stop and reserve seats for Patty and me and flight number six to Lexington. Tex replies, Sure, boss. Meanwhile at the boarding house in town, the young man named Mr. Smith is saying to his landlady, Oh, Mrs. Clancy, I'll be gone for a few days, maybe a week. Uh, hold my room. Now I gotta hurry. She reminds him of his job at the airplane factory and asks him if he quit. He answers, Oh, no time to explain now. Goodbye. Last picture top row, Mr. Smith is at the ticket office at the air terminal saying, Reservation to Lexington, please. Uh, the name is Smith. The ticket is handed to a many steps aside. First picture bottom row, Tex steps up to buy the ticket for Mr. Miles. And Mr. Smith over here is Tex saying, Oh, um, I want to make two reservation Smiths and flight number six to Lexington, Kentucky to be called for by Quentin Miles of the milestone farm. Smith says to himself, milestone farm. The people who have my horse painting. That must be the big Tex and the antique dealer described. And as Tex walks out of the terminal, Smith follows him saying, I'll just keep that old cowboy in sight until the plane's ready. Maybe he and the kid who has my picture aren't going to Lexington. He follows Tex outside and sees him walking toward the truck and says, By George, they are going to Lexington, but they're going in that horse van. Here's Tex say to Rusty, Okay Rusty, we can start rolling for the home quarrel. When Smith hears this, he says, I can wrangle a ride with him. Maybe I can get back that picture on the way. He walks over to the van and says, Oh, pardon me. I see you're from Lexington. You're heading that way. I could use a lift. I can help you drive. Tex looks at him and replies, Well, now friend, we got a valuable horse on board. I'd have to know a little about you. It would really be an unusual situation. My eye can't dance. I'm afraid you'll have to, and not only that, that's all the time I have now. But before I go, here's that nice fellow with some more interesting information. Come here all your boys and girls, I've got to go now. All right, Mr. Comic Weekly Man. Okay, that's a date, and the date with all your boys and girls.  For I'm the Comic Weekly Man, the jolly Comic Weekly Man. I'll be back to read the funnies to you happy boys and hearties. Don't forget, boys and girls, see you all next week. Your friend the Comic Weekly Man, the jolly Comic Weekly Man.


Hello and welcome to the session. My name is Mansi and I am going to help you with the following question. The question says verify the following minus 1, 2, 1, 1 minus 2, 5 and 4 minus 7, 8 and 2 minus 3, 4 are the vertices of a parallelogram. So let us start with the solution to this question. Now here we use a very important property of parallelogram that opposite sides of a parallelogram they are equal but its diagonals are not equal. So using this property let us find out the solution to this question. Let the point A be minus 1, 2, 1, the point B be 1 minus 2, 5, the point C be 4 minus 7, 8 and the point D be 2 minus 3, 4. Let these be the 4 given points. Now applying the formula that says that if a point P x1, y1, z1 and a point Q x2, y2, z2 are 2 points then the distance between them is given by square root of x2 minus x1 the whole square plus y2 minus y1 the whole square because z2 minus z1 the whole square. So using this let us find out the distance between the point A and B. So AB is equal to square root of 1 minus minus 1 the whole square plus minus 2 minus 2 the whole square plus 5 minus 1 the whole square. This is equal to square root of now 1 minus minus 1 is 1 plus 1, 1 plus 1 is 2 and square of 2 is 4 plus minus 2 minus 2 is minus 4 and square of minus 4 is 16, 5 minus 1 is 4 and square of 4 is again 16. So this is equal to square root of 36 that is equal to 6. Similarly we find out the distance between the point B and C. So BC will be equal to square root minus 1 the whole square plus minus 7 minus of minus 2 is minus 7 plus 2 that is minus 5 and square of minus 5 we have here plus 3 square this is equal to square root is 9 minus 5 square is 25 plus 9 that is equal to square root of 43. Similarly we find out the distance at the whole square minus 3 minus minus 7 the whole square the whole square that is equal to square root of minus 2 is 7 is 4 and square of 4 is 16 4 is again 16 that is equal to square root of 36 that is equal to 6. Finally we find out the distance between the point A and D. So AD is equal to this minus 1 is 2 plus 1 the whole square plus minus 3 minus 2 the whole square plus 4 minus 1 the whole square that is equal to plus 1 is 3 square of 3 is 9 plus minus 3 minus 2 is minus 5 and square of minus 5 is 25 plus 4 minus 1 is 3 and square of 3 is 9 so we have square root of 9 plus 25 plus 9 that is equal to square root of 43. Let this be the parallelogram ABCD now we have AB is equal to 6 units BC is root 43 units and AD is root 43 units. Now we see that opposite sides of this parallelogram are equal because AB is equal to CD and BC is equal to AD so it is either a rectangle or it is a parallelogram now we find out AC that is this diagonal and we find out BD that is this diagonal. So AC is the distance between points A and C so AC will be equal to square root of 4 minus minus 1 the whole square plus 7 minus 2 the whole square plus 8 minus 1 the whole square this is equal to 4 plus 1 the whole square is 5 square that is 25 plus minus 7 minus 2 is minus 9 and square of minus 9 is 81 plus 8 minus 1 is 7 and square of 7 is 49 under the square root this is equal to square root of 155 and we also see that BD is equal to square root of 2 minus 1 the whole square plus minus 3 minus of minus 2 is minus 3 plus 2 the whole square plus 4 minus 5 the whole square that is equal to square root of 1 square is 1 plus minus 1 square is 1 plus minus 1 square is again 1 that is equal to square root of 3 so we see that diagonal is not equal to diagonal this diagonal is not equal to this diagonal therefore ABCD is a parallelogram so first of all by proving that opposite sides are equal we show that this is either a parallelogram or a rectangle but we know that in a rectangle the diagonals are of equal proof that diagonals are not equal to each other therefore we can say that is a parallelogram so this was what we were supposed to prove in this question I hope that you understood the question and enjoyed the session have a good day


Welcome to my presentation on the security of the suffix keyed sponge. My name is Bart Menning and this is a joint work with Christoph de Bruyne. The sponge is a very popular way for cryptographic hashing. It's based on a cryptographic permutation of size B bits and the state of size B bits is split into an inner part of size C, the capacity, and an outer part of size R, the rate. And if you have to hash a message of arbitrary size, in this case P, this message is first padded and split into blocks of R bits, which are compressed one at a time into leaves with permutation evaluations. After the last block and the last permutation are done, the squeezing starts. R bits at a time into leaves with permutations until you have sufficiently long digest. And the sponge is very popular. For instance, the SHA-3 hash function is based on the sponge construction. It can be used to construct softs and many lightweight hash functions are based on the sponge construction. And in 2008, Pastori et al. proved that if B is assumed to be an ideal permutation, then the sponge behaves like a random oracle up to around 2 to the C over 2 queries. And the C over 2 basically comes from the birthday paradox on the inner part of the state because if the attacker ever finds a collision in the inner part, this collision can be used to break the construction. You can also use the sponge for keyed applications for constructing a PRF. And the simplest way of doing so is by simply concatenating the key and the plaintext and evaluating the hash function on top of this. This is a construction that's currently known as the outer keyed sponge and it's a secure PRF. Alternatively, you can place the key in the inner part of the state and this is what we currently know as the inner keyed sponge. But at some point we observe that once you do so, the state of the sponge becomes secret and there is no need to maintain an inner part here anymore. So you can just as well do full state absorption and this is what we currently know as full keyed sponge. So the P is padded and split into B bit blocks which are compressed one at a time. And this is a very efficient and popular construction. At the same time, once this state is secret, all subsequent states will be secret. So this means that if we consider this construction in the leaky setting, the attacker can get quite some leakage from the secret state. In detail, if we focus on the leakage resilience of these keyed sponges, we can see that the permutation P is repeatedly evaluated on a secret state and any evaluation of P may thus leak secret information. And this brings us to an important question. Namely, can we minimize the leakage of the keyed sponge? Well, there is a way to do so. One way to do so is by adopting the hashed and MAC design. The hashed and MAC design takes a hash function and simply feeds the plain text to this keyed hash function to get a certain digest. And this digest is then processed by the random function f or the MAC function f on the input of a key and this finally gives the tag. And the construction has some advantages in the leaky setting. The reason is that the hash function is unkeyed so nothing needs to be protected. And note that this hash function could, for instance, be a sponge function. The only function that might leak information is f, which is keyed. And f is only applied to a fixed size input. On the downside, if we want to get K-bit security, you should take a K-bit key, but also should take a hash function with a K2K-bit output. In other words, the function f that must be protected has an input of 2K-bits plus the K-bit key. And that's why we consider a dedicated sponge construction. That's a suffix keyed sponge. And this construction, basically at a high level the name comes from the fact that the key is concatenated to the plain text in the end. But the construction is more general. So we consider a b-bit permutation, p. And we consider a state that's split into an inner part of size c and an outer part of size r. The plain text is padded into r-bit blocks which are compressed one by one into leaves by a permutation. And after the last block is compressed, we compress the key. And the key of size k is compressed into the outer s-bits of the state, s does not need to be equal to r. I'm using some function g. And I will come back to this function g later. It will play an important role. And this gives you a new secret state which we call v. One permutation call is done extra and then the output is truncated to a t-bit tag. T, again, does not need to be equal to r. And SUCKS has several advantages over existing schemes. So if you compare SUCKS to the full keyed sponge, on the downside SUCKS does not have full state absorption. Absorption is only r-bits at a time. On the upside, the side channel leakage is limited. The only functions that could leak in a side channel attack are g and the final evaluation of p. In addition, s and t do not need to be r-bits. They can be larger. They can be arbitrary. Typically, you take them equal to c over 2 and then you take them equal to r-bits. In other words, they are arbitrary. Typically, you take them equal to c over 2 or k-bits because this part can be broken in 2 to the c over 2 evaluations of the permutation. So the security level is c over 2 and you can take s and t equal to the security level. Now if you compare SUCKS to the hashtag MAC design that only has advantages. Most importantly, the keyed function here can be half as large. So typically s equals k and not 2k. So the state here is half as large. On top of that, g does not need to be cryptographically strong. For black-box security a simple xor suffices. In that case only one cryptographic building block is needed, namely b. We analyze the security of the SUCKS keyed sponge in detail and at first we consider a restricted setting to see how we can prove security in the simplest possible way. And in this restricted setting we restrict ourselves to the parameters s and t being smaller or equal than r. And in this setting we prove that if b is a random permutation and if g is 2 to the minus delta uniform the conformity means that if you fix an input and you fix an output the probability that this input goes to the output probability taken over the key k is at most 2 to the minus delta. So if b is a random permutation and g is 2 to the minus delta uniform then we prove security of the SUCKS keyed sponge up to n squared plus n divided by 2 to the c plus n divided by 2 to the delta. And if g would be the xor delta would be equal to k. And the proof kind of relies on the inter-frenchability of the sponge. As a matter of fact it uses the inter-frenchability of the sponge as a black box which can be done because s and t are smaller or equal than r. And now unfortunately for the unrestricted parameter setting where s and t can be larger than r we cannot rely on the inter-frenchability of the sponge so we have to develop a dedicated proof. And before going to this proof I first have to discuss an intermezzo on the multi-collision limit function. So consider the problem of throwing m balls uniformly random into 2 to the r bins. Then we define new rcm as the smallest value x such that the probability that the size of the fullest bin is more than x is at most x over 2 to the c. I must admit this definition is quite gibberish but let me explain it. So this definition comes from a work of Dama et al. Asia Crypt 2017 on the analysis of the full-keyed duplex. So it's really sponge-oriented this definition and this is also why we get the 2 to the c here. And in a typical sponge proof we always have a term of the form n divided by 2 to the c where n is the total complexity or n squared divided by 2 to the c. That's what we've seen in the previous slide. And from this respect x is typically a small value so x divided by 2 to the c is negligible compared to the rest that we see in the bound. And then this means that the smallest x such that this holds gives a negligible term or another one stated differently the size of the fullest bin is at most new except with negligible probability. And this means that we can upper bound the size of a multicollision by new and size of a multicollision on arbit strings by new unless with negligible probability. And in this work of Dambeidol Asia Crypt 2017 this bound was analyzed for a specific and a graph was given for specific parameters. So if you take a specific case of r plus c equal to 256 so we have 256 with permutation then a specific graph of rcm was given this is the black line here it's a stairway to heaven graph and there are two lemmas that derive an upper bound on this graph and these lemmas are quite good and we will use these lemmas later on these bounds later on. Now using this multicollision limit function we can prove security of socks in the unrestricted parameter setting in detail we consider against the same sponge picture we have a key of size k we have s and t of arbitrary size at most b and we prove that if b is a random permutation if g is 2 to the minus delta uniform which I recall means that for a fixed input x to a fixed output y the probability that x maps to y is at most 2 to the minus delta and g is 2 to the minus which means that for two fixed inputs distinct inputs x and x prime the probability that they map to the same output is at most 2 to the minus epsilon in that case we prove that socks is a prf up to this bound and I will explain the bound in detail it consists of three terms the first term is easy it basically accounts for inner collisions in the unkeyed hashing part and the same bound appears in the sponge channel and the sponge indifference ability analysis somehow but again it basically appears in the sponge indifference ability analysis and it accounts for collisions in the inner part here because if that happens the scheme can be broken now the second one I will omit for a moment I will first go to the third one and the third one corresponds to a break at g at t and q bounds the number of construction queries with the same tag so it upper bounds the maximum size of a multiculation on the tag in construction queries and to see why this is needed for a moment assume that the attacker just makes one construction query so q in this case is the number of construction queries and is the number of primitive queries but for a moment assume that the attacker makes one construction query so it gives one plaintext b let's attack t mt is the outer t bits of the secret value w but the attacker doesn't know the other b-t bits but what it can do is it can take this t it can guess the other b-t bits and it can make an inverse primitive query for this guest value w and any of these guesses succeeds with probability 1 over 2 to the b-t and now the attacker can make capital N guesses so the success probability would be n divided by 2 to the b-t now on top of that if the attacker does not make one query but q queries it could get a multiculation on t and now the attack that I outlined before could work not just for one of them but for any of the construction queries with the same tag t so we have to upper bound the maximum size of a multicolusion on the tag likewise here this term corresponds to a break at g and in this case this new bound the number of primitive queries with the same inner part note that the attacker can make primitive queries if the attacker gets a multicolusion here with the same inner part with a different outer part u then also the inner part of v will be the same the outer part of v is unknown because the construction is key but different so the inner part is known and the same for at most new values the outer part is different and unknown and the attacker can make capital N guesses and any of them succeeds with probability 2 to the power minus delta, epsilon and I want to note that if g is the XOR the minimum of delta and epsilon equals k still the bound is a bit confusing with these terms new so I would like to show the meaning of this bound by means of a concrete example and the example I consider is the ISAP authenticated encryption scheme so ISAP is a submission to the NIST lightweight crypto competition by the Brownig at all is particularly designed for secure use in a leaking setting and the message authentication of ISAP is the subject feed sponge ISAP uses SUCKS for message authentication with the function g instantiated using ISAP RK which for the sake of current discussion is a secure function g ISAP consists of four instantiations two with catch up 400 and two with the S-con permutation on a 320 bit state so if we consider the generic security of SUCKS with the ISAP-like parameters starting with the catch up 400 we've got the B is 400 to a 400 bit state the capacity of 256 rate of 144 and the key of 128 bits and if you plug these numbers into the bounds for new we get that the two new are upper bounded by 3 and 80 respectively and this means that we get I mean the 80 stands on top of the 2 to the power of 272 so that term is really negligible compared to the other two and the other two say that we get 128 bits of security likewise for the S-con based parameters we've got B is 320 C is 256 R is 64 and K is 128 and we get bounds on new namely 5 and 67 and again 128 bit security so this is quite a strong bound finally we also consider a leakage resilience of SUCKS and in the leakage resilience setting we consider non-adaptive leakage resilience so we consider any fixed leakage function L and this leakage function L leaks laptop bits of information for each permutation goal for each secret permutation goal and we consider PRF security as before so the attacker has access to either the construction or a random function in addition it gets access to the primitive in both worlds as before so this is the typical black box PRF security but now in addition the attacker gets access to the leaky version of the construction in both worlds it gets access to the leaky version of the construction and the idea of the model is that the attacker can make an arbitrary amount of leaky queries it can obtain an arbitrary amount of leakage but at the end we want that once the attacker makes a challenge query to the construction or to the random function it should still be hard to distinguish which oracle it is talking to and in this model we prove leakage resilience of SUCKS in detail we prove that if G is on top of the earlier conditions and is also strongly protected then the construction is a leakage resilient PRF up to the following bound and the bound really looks comparable to what we've seen before with some addition so this is new, here we've got a new term and here we've got a new term and let me explain these new terms starting with the minus lambda here recall that originally this fraction corresponded to the attacker gassing the inner B-t bits of W but now we consider a leaky setting and in this leaky setting the attacker might have obtained left bits of leakage here on W and this kind of reduces the entropy of W by left bits likewise this term originally corresponded to the attacker gassing and the outer S bits of UV but now the attacker can get leakage but the attacker cannot just get one portion of leakage of lambda bits but rather more and to upper bound how much leakage it gets we use the multi collision function and this term, this new bounds the number of repeated leakages on the same GKX more technically this new bounds the maximum number of multi collision on the same outer part U with a differing outer part inner part of U indeed if the inner outer part of U is the same the inner part of U is different this means that the outer part of V might be different and might be the same but the inner part will definitely differ and the subsequent permutation call might lead different amounts of data on the outer part of V and this is accounted for in this leakage to conclude as we observed that the suffix key sponge is a very easy to protect message authentication code it achieves a very strong security bound and it's still very efficient in fact it's beneficial over the full key sponge and the hash done by construction in a leaky setting and in part because of this ISAP users sucks as a message authentication code and on top of that we can prove leakage resilient authenticated encryption security of ISAP using this result and using a result from AsianCrypt 2019 on the leakage resilience of the duplex and this concludes my presentation so I would like to thank you for your attention