Hey everyone. Welcome to the Nintendo Prime podcast. I am your hostess with the mostest, Mr. Nathaniel Rumpeljantz. As always, I am joined by Mr. Eric Moore. Hello. I just almost wanted to steal a live one, kind of funny there. I was going to call you the seducer, but I've been watching too many kind of funny podcasts lately. And then we are also joined by a special guest this week. Maybe we'll get him on next week, because next week is kind of a special podcast in my heart. Mr. Darren Hart. How's it going guys? Zeldinformer. He's officially my replacement at Zeldinformer, believe it or not. Well, it's official. He will be called editor-in-chief. Well, congratulations. As of May 1st. Oh, it's a big title. I don't know if I can handle it. He's basically editor-in-chief already. Yeah, I have been for like the past couple months. But maybe we'll go into that next week, because we have one more podcast recorded before my final day. And I know one of the segments I do want to talk about my time at Zeldinformer. So I hope I can get you back on for next week too, Darren. And I think you'll have more questions than I can really come up with myself to talk about Zeldinformer over the last eight years. So we have a lot to talk about this week. And first I want to apologize to our viewers, because we haven't had a podcast in weeks. So for those who paid attention to the last podcast we did, it was the very first time in probably two, three months that we attempted to have more than just Eric and I on the podcast. And the problem that we ran into that was that our setup wasn't working. You can see it in the camera. We have headphones on now. We can hear Darren. But that was the idea last time. And then it didn't work. So we had a pair of headphones down here. Audio was coming back in through the mics. And then these mics didn't record properly and sounded like we were talking through water or whatever. So the audio we had to use was actually the audio on the camera, which is really crappy. And it frustrated me so bad. I did not want to come back and do the podcast again until we fixed it. And here we are three weeks later. I think everything's fixed. It better be. I mean, I'm looking at the audio recording. It looks good. Yeah, yeah, it does. So but I think it looked okay last time too. So last time it didn't quite peak. Oh yeah, you're right. Yep. Anyways, this is what what happens when you record a podcast and there's no one behind the camera double checking things and fixing it as we go or telling us, Hey, you need to turn your mic on and off or whatever. Have you tried taking it off and on again? Oh, the IT club. So we have a lot to talk about this week, a ton. And not just because it's been three weeks, but because this has been a lot going on this week. And the first thing I want to get out of the way is probably the thing that we've talked about all three of us already subtly without actually saying a whole lot because we wanted to save our reactions for this particular moment. And that's because at the as of the day we are recording this podcast, the NES Classic Edition has been discontinued in North America. Rest in peace. So the NES Classic Edition came out November of last year. Most figured it was it was kind of like a temporary holiday run since Nintendo already announced the switch. And they didn't really have anything but Pokemon going on for the holiday season. So it's kind of like, oh, here's some filler go buy this. And it's really awesome. The NES Classic Edition is sweet. I mean, you get 30 of the best NES games of all time for 60 bucks. They have save states in them, like like you would have an emulator on your PC, you know, Nintendo France upon that. But here they are, they have save states in there. You that apparently from what I've been told and what I've seen in reviews of it, it is some of the very best emulation of NES games people have ever seen. Well, it does help that Nintendo did it, you know, what the Nintendo does on virtual console. So yeah, so yeah, so it's really, really excellent quality emulation. 30 of the best games you got save states, you had multiple ways to play it. Everything goes through HDMI natively now. So you could have you could force scan lines on if you want, you can get rid of scan lines, you could play full widescreen or the original four three. It was just really, really cool. It's a thing that wasn't possible with most of these games before virtual console. The only real complaint most had is that the controller's cord was too short. A reasoning behind it is that the controller also worked with Wiimotes. I think people would have just preferred a longer cord because they're not using this thing of Wiimotes. Yeah. But whatever. And now Wiimotes aren't even a thing. So I don't even know why Nintendo did that. But it is what it is. Because they had the technology. They have the technology. Gotta take advantage. But Nintendo kind of out of nowhere went to IGN and said, look, we're done with this thing. It is, we know that it was always meant to be a limited time thing, which Nintendo never actually officially announced it was a limited time thing. To be clear, people assumed it was limited, but Nintendo never advertised it as, oh, it's only out for a limited time. But anyways, that's just to kind of put the kibosh and some people, oh, it was always intended to be limited. But Nintendo said, you know, it was intended to be limited and that they underestimated how popular it was. And because of how popular it was, they kept doing more and more runs of it. And they understand that it's still difficult today to get a hold of it. And they apologize for that. And here's this thing that everyone wants. They can't make enough of them. They sell out as fast as they show up on store shelves.  Yeah, let's never accuse Nintendo of being greedy or cash hungry. Because obviously this is the exact opposite, where you have a product where the law of supply and demand is very clear here. There's not enough supply and there's way more demand than anyone could have anticipated. And they're just like, well, let's not do this anymore and not make a profit off of this ever again. That's basically what's happening here, basically. Yeah, it's it's insane. I was reading a comment by Jason Schreyer over at Kotaku and because he did the report over there of it. And you know, whatever, they were just reporting the facts, reporting the facts. We get to the final line in it. And I just it just it's so sarcastic. It just makes me laugh like it was something along the lines of so Nintendo released an extremely popular system that everybody wants no one can get enough of. So of course, Nintendo canceled it. And it's it's just so interesting how Nintendo came to this decision. Because one of the logical reasons is they can't make enough NES classic editions to keep up with demand. They can't make enough Nintendo switches to come up with demand. So one of them has to go, right? So get rid of the NES classic thing so they can make more Nintendo switches. That's that's what some people have literally argued with me today that this is this is why they had to cancel it. And the thing is, is we now know the Nintendo switch has moved 905,000 units in the United States in March. So it's probably moved over a million by now overall, just in the United States. So they're getting a lot of switches out there. I highly doubt that NES classic edition has anything to do with the switch supply line. They've been planning the supply line out for months and months and months. And the fabrication process isn't the same. So it's not like, oh, we have one line making NES classics. We have 10 lines making switches that one line that we're adding back in is going to make such a big difference to switches. And that's assuming they're going to be made at the same factories in the first place. And I know that, you know, the NES classic is a little different. Like the Nintendo switch is completely region free. So it's like one system. You just make it one time and it fits the entire world, which is awesome for production lines. NES classic is a little different. Like in Japan, it's not the NES classic. It's the Famicon classic. And it looks different. It's got different games. Europe has different games than the United States version does. I think even Australia has some different games than even the Europe people do. And they usually just get the exact same thing as the Europe people do. So it's a situation that I made a video about earlier and I was raging. I'm so upset about this. And it's not just because I don't have one, right? I never tried to get one. I never even bothered to look up if it was available. I didn't pre-order. It was something I always figured, well, this is really popular. It's going to be around for a long time. I'll just pick it up in a couple of years when the demand dies down. And it just happened to have a few sitting at GameStop or Walmart. And then I'll grab one and then I'll enjoy. And the thing is, I don't feel like I need the one right now because I've already played all these games. Right. These are some of the best games on the NES library. I grew up with it. I played them all. I'm in no rush to play them again, but it is something I would like to have for when I want to play them. Plus, we at Nintendo Prime, we like doing live streaming. Eventually I'm going to have to stream more than just Breath of the Wild. Although our fan base keeps demanding more Breath of the Wild. Like, when are you going to stream Breath of the Wild again? When are you going to do it again? There's so much Breath of the Wild. Anyways, we'll get to that topic later. So, Darren, how do you feel about this NES classic situation? I feel like Nintendo is making a big mistake because I personally know, I was talking to my great aunt a couple weeks ago and she wanted to buy the classic edition for her son, which would be my cousin. He grew up with, you know, the NES and really wanted one. She wanted to get him one for Christmas, could not find one, and she did not want to pay the scalper's price, which, let's be honest, who does? So I, you know, told her, yeah, I can't find one either. And she's like, well, if one pops up, would you mind letting me know? And I'm like, I mean, yeah, I can let you know, but probably not gonna, probably not gonna work. They sell out in like two minutes. I think the last time that I saw one go up, I attempted to get one. The second it went up, I went on the webpage and the webpage would not load, just like all of my previous experiences with different websites that have tried to sell the classic edition, they just sell out in seconds or minutes and the website just dissolved. And people that want it, what do they want it for themselves or if they're just scalpers, there's websites that aggregate all these retailers together. So like, they literally have those pages on like automatic refreshes like every 10 seconds. And when it comes in stock, I know some, I know one person in particular, they were able to make it so when the status changed from out of stock to in stock, it actually sounds off an alarm. So they can just have it auto refreshing the entire time he's sleeping. And then when it goes off, he just wakes up and it goes by the way. Okay, wow. And again, that's like massive scalper mentality, right? But it's also one of those things that if you wanted it legit, too, that's what you had to do. Yeah. And that kind of gets into my point on why I'm angry about this. It's not so much that I don't appreciate that it was a limited run. I think it had to be a limited run, because they eventually need to do an SNES classic, right? Probably an N64 classic, maybe even a Game Boy classic edition someday. Yeah, but do that down the line after like everyone has gotten the classic edition that they want. Yeah. And well, what I was kind of getting at is it's fine if they were going to limit run this, right? But limit like, as soon as you knew how popular it was, pick a date in the future, pick like August, we're going to be done making NDS classic as of August. But until then, we have planned to push out two or three million units between now and then. Please look for your retailers and then everyone would know you have X amount of months to grab one and not buy it from a scalper. And plus you have, you can have guarantees that Nintendo is going to start selling out bigger shipments of it because there's an end date and everyone knows when that end date comes, even if there's still say 500,000 of them still out on retail shelves, there is no more coming. So by through the next holiday season, they would sell out anyways, if there was extra in the shelves. So like my philosophy with this was Nintendo announces rather abruptly, they are restocking it through this month, but it's units they've already made. So they already have them in the warehouse, they're just slowly shipping them out to all the various retailers. But it's one of those, instead of announcing the same month that you're going to discontinue it, give us a warning and be like, we are dedicated to making sure everyone who wanted this thing can get their hands on it before we cut off the production line. Instead, they're like, hey, we know this is hard to get, we know it's difficult, we know there's high demand for it still and we're just not going to give you it. Tough squats. It's like, and what makes it hard to swallow, because I heard someone say, well, this must have been they're going to have virtual console coming soon to the switch. Of course they're going to have virtual console and switch eventually, but virtual console, you could never get these 30 games for 60 bucks. You could not get them at this quality emulation. You cannot get them with save states. There is absolutely nothing that really correlates between what you got in virtual console and this outside of the fact that virtual console, we hope in the future anyways, you'll be able to keep your games forever. There are some virtual console games with save states that call them suspend points. Yeah, some, some, but they're not all 30. Yeah, it was almost like they were experimenting and it led to this. Yeah, would you mind reading that comment that I had sent you? Can you read it? My screen's a little far away from me. Okay, yeah, let me find it. Okay, here we have a very interesting comment. Now this comment comes from some random person over at GameNizia. Yeah, I'm sorry, a person who typed this up. I don't, I can't see your name because I copied and pasted this quote, but kudos to you because it made me laugh out loud. So pardon me, because this is a little bit NSFW, but you're at the bar with your bros, just having a good time. All of a sudden, 4,827 of the most beautiful women in the world walk in and all crave your one friend's dog. They walk up to him and say, hey man, we're all clean, sexy and into what you're into and ready to, ready to plow. Calm down, you gotta get the joke out so everyone else at home can laugh here.  Your friend is Nintendo. I couldn't even get through it without laughing, but that's basically that. You couldn't even get through it. That's basically it. Here's the, here's the just, here's the just of the joke. You're at, you're at a bar having a good time and you're at a bar with your buddy, sorry, having a good time. And in walks 4,827 of the most beautiful women in the world and they all come and they all want your dog. So they walk up to your friend and you're like, hey, we're sexy, we're clean, so you don't know STDs and they want to have some fun times with you. And instead of having fun times with those women, the friend is sitting there jerking off and the moral of the story is that your friend is Nintendo. Because all of your, the correlation here is that everybody wants this thing and Nintendo is just like, we're done. We don't need it. We don't need your money. We're done. And I mean, to be fair, Nintendo doesn't need our money. They're coming off one of the most profitable years they've had in companies history. And it feels weird saying that because Switch wasn't held last year, Pokemon Go technically isn't a Nintendo game. But Nintendo's shares went way up because of it. You know, they do get a slice of the pie. Yes, but it's a smaller slice than people realize. So yeah, it's very interesting that this is the way Nintendo's choosing to handle the NES Classic Edition. And it makes me not want to buy the SNES Classic Edition when it comes out because I feel like I'm going to be taking that away from someone who didn't get to play those games growing up, that wants to get into it at a cheaper price. Because I got to play all these NES games. I got to play all the SNES games, all the N64 games. All these games are going to throw in these collection packs. I've gotten to play. I don't want to take a cheap way to play that away from people who normally can't afford to do it.  Like people don't realize how big of a price difference it is on the eShop compared to what you got in this Classic Edition. I did the math and this was last year. It would cost almost $300 to have all 30 of those games on your Wii U at the time versus buying the Classic Edition for 60. And most of those were very bad emulation, very bad coloration, sometimes laggy controls. And most of them did not have save states. So, and the thing is, I don't think that save states are really a VOL end all anyways, because I didn't grow up with save states. So it didn't matter to me. But we're in a world today where people download this stuff illegally for free and have save states and do whatever they want. So if Nintendo is going to offer it, they might as well support save states. But it's just upsetting that Nintendo went down this route. Now, Eric over here has been silent the whole time. And the funny thing is, the very first thing he told, he tried to talk to me about when he got here was, dude, you don't have any of this Classic. No, I saw your post on it. Yeah, because he saw the post that I made at Nintendo Prime. What are your thoughts on this situation? As someone that I know also wanted this thing? Oh, I most certainly wanted it. And it, you know, to what you were saying, the whole announced the same month. Well, not even announced the same month. It's halfway through the month. Yeah, you got two weeks. Yeah, right. Congratulations. Two, two weeks. Here you go.  So if I could right now, I would flip this table. That is how angry I am.  Please don't. No, I wasn't planning on it. That's why I said if I could. If you guys are wondering why I don't want him to flip this table, it's not because of the mics. Go watch. I put up a video that's like an office tour. You'll quickly see why if he flips his table, I'm in deep doo doo. There might be no more Nintendo Prime. Right. Oh, anyways, it's. But yeah, it's so ridiculous that they didn't give a nice enough warning saying, hey, yes, this was intended to be a limited edition. Sorry, we didn't tell you this. So that's why we're telling you three, four months ahead of time, not two weeks. Like put a timer on it that fans know about. And don't do it. Like, don't make this announcement through a press website that not everyone in the world reads. Yes, IGN is the most popular video game website in the world. But not everyone reads that. Why did I not get this in my inbox? Why wasn't it sent out to all Club Nintendo subscribers or all, you know, all people that have Nintendo account right now. I'm sorry. Literally just chose to be a crappy replacement. Well, fun, fun story about my Nintendo. I can't call it a crappy replacement because Club Nintendo felt crappy because it used to give all physical things like awesome physical items for purchasing stuff. But you only got credit for purchasing at the time physical games, then they eventually advanced into digital. What I like about what they are doing now beyond that here is that they haven't sat there and over promised what my Nintendo is. You know what it is. You get some free games, you get some, you know, some digital stuff. And that is what it is in all of your games now, as of the switch anyways, physical and digital come towards it. So yeah, it's not as good as Club Nintendo used to be, but it never set itself up to be better than Club Nintendo.  Whereas Club Nintendo used to Club Nintendo used to be like amazing. And then it was doing what what my Nintendo does now. And now my Nintendo just like, hey, like we're just owning what this is. This is a discount program and some free digital items. Basically. And the thing is, like it's easy to get it's easy to get mad about it. But Microsoft and Sony don't do this. Yeah, to have their discount program, you have to subscribe to their online service. There's no club that gathers points and rewards you for just buying games. Well, that's true. Yeah, that's very true. So that's the thing like Nintendo doesn't have to know other company does this like, I hate getting mad about it. It's like, no, Nintendo is done. They're done. They're done doing all the physical stuff. And that's fine. Because they didn't like we're not in that era anymore. This is a new era of Nintendo, where everything's digital. And I'm okay with it because I didn't expect them when they said they were going to play some Nintendo, I thought they weren't going to give us anything, to be honest. I thought it was just going to be you get like a 10% coupon for the eShop for one purchase. Like, so they've done a little better than that. What's really weird is that they have some games exclusive to my Nintendo, like the Twilight Princess pick cross thing. Really weird that I didn't think they do exclusive my Nintendo games. That's weird, but it is what it is. Anyways, so we're just going to kind of wrap up this section of the podcast. Let me throw one more thing out there too. My thought would be, why can't they just let the regions themselves decide whether or not they want to continue making this? They might have. Because here's the thing. It's only been discontinued in North America. Oh, yeah, true. So what the hell? So that's why people are like, oh, well, it must be to make more Nintendo Switches. Then why are they still making it in Japan? Why are they still making it in Europe?  I never really thought of that. Yeah, you're right. It's only North America that has it cancelled. Damn, UNA. So it's like, it could be the individuals, it could be NWA being like, yeah, we're tired of supporting it. So it's not worth, we're not making enough money per unit to continue to support it. We were overwhelmed with Switch and fixing the left-wing kind of issue or whatever. Whatever the reason is, it's dumb. Because I mentioned this in my video about it. I said, they could raise, they could just say, look, we're going to continue to supply it, but we have to raise the price by 10 bucks. And people might get mad until they start realizing, hey, it's in stock now and I can buy it. Yeah. So they could have increased their profit margins and still sold out. Even at 40 bucks extra, I mean, 100 bucks, it's still, it's still a deal. I mean, I've seen scalper selling it for 200 pop. Right. It's still a deal. So it's, but I'm very angry about it. I'm a lot more calm now than I was at the time I made that video, but I'm just as upset about this whole thing. I literally, I was angry when I saw the audience, but then when I read that comment, I mean, it was kind of worth it just for that piece of gold. Yeah, just for the comment. There is that. Yeah. But you know, and I'm going to throw this plead out to our audience, if you can give me a logical reason why Nintendo would do this. And I've already gone through with some of the reasons some of our fans have given us and why they're not logical, why canceling it to make more switches doesn't make sense. Why? Well, it was always planned to be limited. So we should just be thankful Nintendo still did it for a few months. Yeah, that's what Nintendo is acting like, which by the way, hello, arrogance. You're basically saying, yeah, we only plan for it to be a month, but high demand. So we kept it going. But hey, you know, you should thank us. We're done with it. We know you still can't get one. But don't forget the fact that we aren't going to tell you that it was only supposed to be I love Nintendo, but this is them at their ultimate peak of just arrogant as hell. And they know they can get away with it because one, it was massively successful on a scale that they did not foresee. And they're still riding high right now off of that switch. Switch launch is like the best launch in internal history, and they are just sky high with how they're feeling right now. Their stocks are soaring, their mobile games are doing well. Nintendo is in a very good place financially. And everything seems to be going their way. And they know it. So they're like, yeah, well, this is some bad news. So we're just going to be arrogant about it. Because why not? Everyone's going to forget about it this week. Because why not? What I what I think was is I'm not going to forget about it is the fact that they did not expect this console to be this popular because I certainly expected it to reach maybe not the high when they announced that it is now, but it's close to it. Whereas it seems as they really didn't announce that social media blew up this at all. Yeah, when they saw what like you watch social media blow up about it when they announced it. And it's like, okay, we are way underestimating this. Look at the production. They didn't do that.  We'll sell it for the holiday season and be done. And that's what they thought internally. As I said, they never actually stated publicly it was only a holiday season item.  It happened because I actually was going to wait a few years until the price came down on it, which again, it's already relatively affordable, but they might have just meant price come down as and they don't have to buy from a scalper. Yeah, because that's the only way to really get one right now. Yeah, I would definitely if I just walked into GameStop and someone sitting on the shelf, I'd pick it up immediately. But I mean, I tried to order one online like four different times and I couldn't. So I was just going to wait.  It is probably the first time in a long time I've been legit angry at Nintendo for something they're doing because I give Nintendo a lot of free passes on things because I've been a long time fan. I don't want to say I'm a fan boy. I mean, I'm really Nintendo Prime. That's all you need to know about how much I love Nintendo. But it's one of those things where I'm also able to be openly critical when they're screwed up.  They even screwed up a ton with a 3DS early on. But they turned the 3DS around, they weren't able to turn the Wii U around. The thing is, I like my Wii U or when I had it, I liked it. But I don't have it now. There's a reason I don't have it now. The Switch feels like a better system to me. I don't feel like I need my Wii U. I feel like most of the games I like on Switch are probably going to come to, or liked on Wii U are going to come to Switch anyways. And in this case, I thought I had time to get the NES Classic because Nintendo never told me I didn't. And now they're telling me I don't have time two weeks before they're done. Not good Nintendo. Not a good look. And the thing is, I just hate that in the way they announced it, just they go into this big, oh yeah, we're not going to have it anymore. By the way, we know you can't get one. We know you can't get one, and we're not going to sell it anymore.  Yeah. We know you all want one. We know what they're difficult to get, and we're done making it. Have a good day. It's like, it's just, if they had just gracefully said, look, like if they had come out and said, look, because we're having issues with the production lines, we're just conceding that we're not going to be able to keep up to meet demand. So we're just going to have to cut our losses, and we're not going to be able to make any more at this time. Maybe we'll bring it back again in the future when we have our production lines in better order. We greatly apologize for the inconvenience. Please look forward to future announcements, you know, and then maybe even tease that you plan to do an SNES classic or something like get something to be excited about where it's like, okay, well, at least they're admitting that they just messed up and they can't keep up. So we're just going to stop it and cut it off now instead of trying to keep up and then come back out with it again, you know, in a year from now, you know, or whatever, when they're more capable and stocked and heck, they could even if they want throw the switch and is like, hey, look, we're trying to get a handle on our switch situation. We're going to put this on the back burner and we'll come back to it later. It's something like no, we're done. You can't get it. It's difficult to find. We're sending shipments out for like the next couple of weeks. Goodbye. And part of me feels really, really, really bad for consumers right now. And I feel like for consumers that we're planning to get this that haven't played some of those games. No, not even just that. But scalpers are having a heyday with this. I can guarantee it. Scalpers have a heyday with everything. Oh no. Just to give you an idea, on the desk right now, we have some of this Breath of the Wild amiibo.   They're still sold out everywhere and scalpers are selling them for like 100 bucks a pop. I think the one amiibo that's ironically not up here that I have that is easy to get to the vocal blend one. I don't know why it's over there. I forgot to have it. Anyways. But yeah, I'm just frustrated. I think we're all frustrated because we all wanted one. We all thought we had time. And I feel bad for the people that were going to get their kids into it. Like my plan was to get my kids into any game. Oh, definitely. Simple to understand two buttons in a D pad.  My kids already play like phone games like Aiden dies like every five seconds. That's just he's used to dying.  He probably laughs every time he runs a Mario into a pet. Oh yeah, for sure. Runs the door going by dad watch to do game over.


Hi, good morning. Thanks for being here so late in the conference. So yeah, this is joint work with Wei from UCSD and Tung from Florida State. And this talk is about indistinguishability. And the starting point is the fact that proving indistinguishability is a central step in assessing the security of symmetric cryptography. And in fact, very often we end up with fairly sophisticated proofs which are made of complex and error-prone probabilistic arguments. And for this reason, several frameworks have been developed over the years to ease this task and make it easier for us. Still, there is a number of very hard technical questions that remain open and for which we have no solutions. And so the main purpose of this work was to come up with new techniques to enhance the set of results we can cover and for which we can prove indistinguishability. And in particular, we have two contributions. The first one is a new framework which we call the chi-square method for indistinguishability proofs, which is then applied to a number of constructions that we analyze for which we obtain not only simpler proofs but often tighter bounds. And for time reasons in this talk, I'm going to focus on one of these construction which is the excerpts of the random permutation. It's a very simple construction which has alluded a simple analysis for almost two decades to date and hence it's a great test-bed for our framework. So for this reason, I want to start this talk by giving you an overview of this construction and the problem it solves before moving to our actual contributions. So the problem we are considering is the one of building goods to the random functions or PRFs. So remember that this object is just a function which takes additional a secret key and if this key is chosen randomly, no adversary usually called a distinguisher can tell apart an interaction with the key function from an interaction with a truly random function which returns uniform random outputs. And this indistinguishability is formalized by having the distinguisher output a decision bit and then we capture its distinguishing advantage or PRF advantage, which is the difference between the probabilities that the distinguisher output one in each of the two experiments. And generally we are interested in the best possible such advantage given a certain distinguisher running time t and a budget of queries q and we would like of course for f to be a good PRF this to be as small as possible for t and q as large as possible. A related notion is that of a pseudo random permutations or PRP and it's better tailored at block ciphers like AES. So here the context is that our function, our key function is a permutation for each value of the key. So it's one to one and has no collisions in the outputs. So it's fair here to only require indistinguishability from a random permutation which returns outputs at a random but are however distinct. And of course one can formalize this again in terms of corresponding PRP distinguishing advantage. So again the important point here is that from a practical standpoint what we want are good PRFs. Because these are great tools that allow us to achieve a lot of applications for encryption and authentication and so on. But what we typically have are good PRPs in the form of block ciphers like AES that are satisfied, that are assumed to satisfy this property in a strong sense. And the catch with it is that a block cipher can never be a good PRFs if the number of queries exceed the square root of the domain size. And this is just by the birthday bound beyond the number of queries you will notice the lack of collisions and hence you can distinguish from a random function. So it's totally conceivable to have regimes for adversarial complexity where AES is a good PRP however it's a completely insecure PRF. So a question that was asked for the first time by two very close works, timely close works by Belare, Kroves and Roggaway and Hal Wagner, Kelsey and Schneier in 98 is whether one can find transformations that transform PRPs into PRFs while preserving security. And the very neat constructions that was first suggested by Belare and Hal in their paper without a proof is the extra of PRPs. So the idea here is that we obtain a PRF which depends on the key of the PRF for two block cipher keys and to evaluate it on input X we evaluate the block cipher on the two keys on the same input X and X or the outputs. I refer to this construction in the following as X or two because of its two key nature you can easily obtain a one key version of this construction by losing one bit of input length and pre-pending a zero or one to the input and invoking the block cipher on the same on these two inputs and X or in the output and we call this one the X or construction. Now these starting these constructions is far from just purely theoretical interest so there are practical schemes that are meant to achieve beyond barely secure security that rely on it. And in fact very recently Ivata and Soran have proposed a modification of the GC-MSIV authentication encryption scheme that relies on the construction for more secure key derivation from nonces. So it's important for this reason to have good bounds on the PRF security of the X or two and the X or construction. And the way we approach proving something like this a bound on the PRF security is typically by transitioning to a simpler to handle intermediate world where we replace the block cipher instances with independent randomly chosen permutations. It's easy to bound the distance between the two left worlds just by the PRP advantage of the underlying block cipher which is usually very small. And then the problem is to find a bound for distinguishing the two right hand side worlds and combining the two bounds we can get a bound for the PRF security. And so we typically focus on upper bounding this term which is the really hard problem where we have this idealized version of the X or two construction or respect to be the X or construction and giving such bounds typically is a pure information theoretic problem. We don't really know how to exploit computational bounds on the power of the distinguisher. We typically only exploit the number of queries it makes. So there has been work and technically very involved work on analyzing this quantity and analyzing these constructions. The first such result was by Belaradim Paliazzo who published in 99 an unpublished manuscript that gave a bound that essentially implies security up to almost two to the n queries. Unfortunately this paper has some minor errors that by now we know how to fix but remain unpublished and looks one year later published actually a bound which is inferior for the two key version of the construction and only guarantees security up to two to the n over three queries. So it was up to only until 2008 and 2010 that Pateran published two analysis of the two variants of the construction which essentially give optimal security or near optimal security. And in this work we actually give very similar bounds to Pateran's. And the point however, and why this is important is because Pateran's bounds followed by applying a very heavy hammer that Bart is going to talk about in his talk later on called Mirror Theory and the other results are proofs that are very involved, they exceed 50 pages in length and I think at least the second one is probably not yet published and not fully verified today. So in contrast, our proof follows as a much simpler application of our chi-square method and while for the one key version we pretty much match and get only slightly weaker bound than Pateran's which is tight, for the two key version we get a much superior bound where we have an exponent higher than one which gives us of course much smaller advantage for query regimes that are smaller than two to the n. So I want to give you an overview now how the chi-square method works and what it does and to do so we have to look at the general problem of a distinguisher that attempts to teleport two interactive objects or systems F and G by making queries to them and we want to upper bound its distinguishing advantage in doing so. Now it is convenient to look more closely at how an interaction between the distinguisher and the system looks like. So the distinguisher will proceed by making queries and receiving corresponding answers from the system F and make a certain bound and number of them say Q before outputting its decision bit. Now a neat thing is that for information theoretic analysis we can usually assume that the distinguisher is without loss of generality deterministic meaning it doesn't make any random choices. And these allow us to describe the interaction uniquely by just looking at the answers of the queries because if the distinguisher is deterministic you can reconstruct the queries themselves uniquely from their answers. They're always uniquely determined. So I'm going to denote the sequence of outputs obtained from the system by the distinguished D which we now fix as the transcript Y superscript F. Of course you can do the same for the system G and you're going to obtain a corresponding transcript as Y superscript G. Now here is the point why we want to look at transcripts. So what we know from previous works already is a simple observation is that if you want to upper bound the distinguishing advantage of D you can do so by the statistical distance of the transcripts. In fact this bound is tight if the distinguisher chooses its speed optimally. And so here the statistical distance is just one half the L one distance between the probability distributions and this observation has been exploiting numerous frameworks for indistinguishability proofs in particular in the H coefficient method. Here however we focus on a specific class of proofs which I call next output indistinguishability proofs. So what that means is that we consider settings where the distinguisher has performed a partial interaction say with the system F as observe Y minus I outputs here Y will be equal three. And now given this observation there is a well-defined probability distribution for the height output, the output to the height query. And we want to compare this next output probability distribution with the one we will get if you were actually interacting with the system G and we had seen the same partial set of outputs so far. And by comparing typically we will try for example to understand and upper bound the statistical distance between these next output distributions. If you can do that then every cryptographer will probably almost instantaneously then try to apply a hybrid argument to upper bound the overall statistical distance by summing up these next output statistical distances. So this is more of a probabilistic version of how you will state a hybrid argument you have to be careful. These next output distances depend on the sequence of previous output so they are random variables and therefore you will need to take an expectation here when you're summing up. But it's really the usual hybrid argument and one of the problems with this is that these hybrid arguments are known not to be tight in general. And for this reason here we suggest a different approach which is inspired by similar phenomena that have been observed in statistics where instead of upper bounding the next output statistical distances we upper bound the chi-square divergence of the next output distributions. You don't need to understand chi-square divergence in detail beyond the fact that it's some sort of weighted version of L2 distance which is asymmetric because the weights depend on one of the two probability distributions. But the key point is that when you do that we can actually give an alternative version of the hybrid argument which is what we refer to as the chi-square method which essentially upper bound the statistical distance with the square root of the sum of the expected chi-square divergences over the number of quarks. So it's very similar but you have a square root. Now of course I might be treating you here. I mean, this is just a different formula. You don't have any sense how statistical distance relates to chi-square. You know, are we getting anything new? And I want to give you one abstract examples before turning to a more concrete one. Assume for example that we can show that the next output probability distributions are very close in a point-wise sense. For example, for every y for every partial sequence of outputs you know that the probability that the next output in y at the ratio between the probability that the next output is y in F and the probability that the next output is y in G is very close to one is within epsilon in ratio. Now if we do the standard hybrid argument and you want to compute the statistical distance between the next output distributions given this information only you have to trust me it's a very simple calculation. All you get is an upper bound of epsilon over two. Put this into the hybrid argument you're going to get something that grows linearly in the number of queries once you fix epsilon. If you actually apply the chi-square method then if you compute the chi-square divergence given the same information again, little calculation you have to trust me here you get epsilon square as an upper bound much smaller and if you apply the refined hybrid arguments now you get something which grows with the square root of Q rather than Q. As Q gets large this is a huge improvement. Now I want to show you more concretely how this chi-square method applies to analyzing the XOR construction. In particular I want to look at the XOR 2 construction again it's easier to analyze in the paper we also have that analysis for the single key version as I will say shortly and what that means is that we are considering now our real system to be the construction instantiated with two independent random permutations whereas our system G is going to be the truly random function. Now if you want to apply the method what we need to do now is try to understand this next output probability distributions. So we imagine that we run the execution for a while there's some fixed distinguish rates implicit here making some queries it has made i minus one queries and we have obtained the first i minus one outputs this is this ball face y i minus one vector and now we want to understand what's the probability that the output to the next query the id query here again i is equal four equals small y. Of course this is a complicated distribution we will need to understand but the distribution is easy to understand in the case we were actually interacting with the random function there the probability will be uniform so it's one over two to the n. So this allows us at least to put into place a formula for the chi-square divergence we are going to upper bound for every i and our goal is to bound its expectation and we can in fact here nicely exploit the linearity of expectation and the problem is equivalent to upper bounding the individual summons in the sum over all outputs y so we can fix an output y any possible string and upper bound that term for any y. So an important point here again I want to stress it again this probability is quite hard to understand and it's the core of the proof but a need observation that was already pointed out in the work by Belarad in Paliazzo is that it's easier to deal with this probability if rather than conditioning on the sequence of i-1 outputs which implies a lot of different things we rather think of conditioning on the internal values that have been output by the two permutations call them u-y to u-i-1 and v-1 to v-y-1. If you actually condition on those then it turns out that it's much easier to describe the probability that we reach a particular output. It's not clear you can do that in fact but a simple application of Jensen's inequality tells you that if you're actually computing the expectation only of these summands we can do this by just not making the term smaller and we will be able to upper bound the right hand side again with something small. In fact there's this minor error here that was pointed out by Nandi and his student in the version we have in the proceedings so we are updating this in an e-print where we are claiming that these are equal they are not but you can prove easily this with Jensen's inequality. And so we are left with the problem of upper bounding this probability really and understanding it to upper bound the term. It turns out at this point this is not very hard. In fact all we need to do is we fix some values so we fix the values of the permutation output and we want to understand what's the probability that the i-t query takes the value y. And in fact to do this it's really enough to think how many possible values the i-t output of the first permutation call it ui can take which are consistent with the output still possibly being this fixed y. Remember we fixed y. And we can do that. So in particular if you look at the space of all possible two to the n values we see that ui can definitely not be equal u1 to ui minus one because it's a permutation so the i-t output of the permutation needs to be distinct. Also you have to be careful that there are some other values it cannot take because the value vi such that ui x or vi equal y is uniquely determined and you need to make sure that this is also consistent with the fact that pi two is a permutation. So there's a set of other values that ui cannot take. Okay, otherwise you will never reach y guaranteed. And so these are all of them, the two sets. These are the ones you can't have. Everything else is fine. And if we denote the intersect, the size of the intersection of these two sets by diy then it turns out you can use inclusion exclusion and give a very simple formula that you don't need to parse of the probability that the value y is taken condition on the internal values and internal outputs of the permutation. So the key point here is that you have to trust me but these are all simple calculations. And if you plug this in through some simple algebraic manipulations and some inequalities and some working around them, you can upper bond a statistical distance with an expression which is the square root of a double sum of variances of these random variables diy that I just defined. We're again remembering that these are nothing but random variables obtained by sampling twice independently, i minus one m b strings without replacement and then shifting them by y, one of the two set by y and looking at the size of the intersection. In fact, it's not hard to see that y does not even matter once you do that and you can really set y to zero. Again, this is not a hard calculation. You have to work a little bit but something you could ask in a probability class you can upper bound the variance and you plug it in and you get the desired bound. I mean the key point here is that I omitted a lot of calculations but I really want to stress that the actual steps on the proof I haven't cheated are exactly what I wrote here plus some calculations that require some pain but can be done pretty easily. And if you compare it with existing proofs that's a massive improvement. Now going towards conclusions there are more results we present in the paper. So we as promised we analyze the single key XOR construction. Here the analysis is more painful in particular because you have to deal with the fact that there's dependence between you don't have two independent permutations so there's a higher degree of dependence and this makes probability calculations somewhat more painful but the high level structure of the proof is very similar to what I have just shown you. The bound is weaker and the main reason for this is actually not even due to our technique but simply the fact that this is a construction that can never output zero and therefore this makes the bound q over 2 to the n-type. Another construction that we analyze in our work is the encrypted Davis-Mayer construction that was proposed by Colliatti and Soran here at crypto last year. And they propose a bound up to 2 to the n 2 to the 2n over 3 security. We improve this so 2 to the 3 quarter n security by using the chi-square method. And here I have to say that I have to advertise that there's going to be a talk later in this session which is going to go back to mirror theory to show a tighter bounds that implies security up to 2 to the n for the same construction. I also want to stress that it's not clear whether we can tighten our analysis using the chi-square method and it's still open and we might be able to do so. It's an open problem. And finally, we also study the swap or not cipher which is a construction that was proposed by Hong-Morris and Roggaway in the context of format preserving encryption. Here the result is a bit harder to state compactly but essentially using the chi-square method we prove better trade-offs between the number of rounds in the cipher and the achievable security level. So I want to conclude with a big disclaimer here which is that the techniques that I have used here from a statistical viewpoints are really nothing new. So some of these techniques appear in previous works and also special cases of these techniques have used even in computer science. So a notable example is a paper by Kamin Chung and Salil Vadhan from 2008. They're both cryptographers but the paper is not on cryptography. It's on analyzing hashing on block sources which uses a special case of our framework in their analysis. There is even an older paper by Stamm, not the cryptographer, a statistician who actually proved something that rephrasing our own language using the chi-square method will directly imply good bounds for the truncated random permutations and giving bounds. But the methods were somewhat similar or special cases of what we have. But the bottom line here and I think the lesson that we get out of this at least with the example of the extra PRPs is that when we have problems that are really technically hard, sometimes we are stuck on using frameworks that are well-established to give these proofs. And in many cases thinking a bit more broadly like maybe people will do outside cryptography and statistics using, for example, other metrics might help us solve the problem much more elegantly and much more compactly and with better bounds. Also not an entirely new observation even in this community. There's a notable example, a paper by John Steinberger from 2012 where he used Hellinger distance to prove bounds on key alternating cypher. So the fact that we can swap metrics in our type of proof is also not something new. And there are open questions. As I mentioned before, the encryptive is my reconstruction. It will be nice to close the gap with a shorter proof using the chi-square method. Another interesting question is on our two extra analysis. I advertise the fact that having an exponent larger than one of course gives us better bounds and a better decay. But it's not clear that the 1.5 exponent is tight and in fact, two might be more like a reasonable answer. I don't know, but we don't know how to prove it. And of course finding more applications is also something very important. Okay, this is everything I wanted to say. So I thank you for your attention. The paper is an e-print and I'm happy to take your questions.