All right. Having discussed two of the three, what are for me, foundational principles that help explain why free markets, free economies are good for human flourishing, we're going to go on now to the third. So we've talked about the great importance of market prices, which communicate dispersed knowledge to everyone so that we can stay well coordinated, the importance of profit and loss in guiding entrepreneurial ingenuity. Now we're going to go on to the next one of these. It has more to do with incentives than it does with knowledge. And when I'm talking about prices, I'm talking about the knowledge involved in prices. When I'm talking about profit and loss, I'm thinking about the information content in that feedback. So the market process does do very well to provide useful information. It also does well to provide good incentives. And so these next two lectures, this next portion of the course has to do with the incentives that are inherent in different institutions. And in particular, I'm going to offer for your consideration a strong claim. And that claim is that the incentives inherent in market institutions are much more conducive to people paying attention to the well-being of others than the incentives inherent in governmental institutions and interventions. Here's a way to look at it sort of graphically. Over here on this side, we've got the institutions of civil society, private ownership, freedom of exchange. And along with freedom of exchange, an idea I've been developing a lot lately, regulation by market forces. Because if these two certainly go together, if we are really fully free to exchange what is ours with others who wish to exchange with us, then the government can't very well restrict that. Any restriction on that voluntary exchange is going to be an interference with the freedom of exchange. So if you don't have government regulation in that sense, government restriction and interference with what you can do, then the only kind of regulation you're going to have available is going to be regulation by market forces. It's an idea I've been developing in some articles and I think it's very, very important. But for the purpose of this lecture, what I'm going to do is basically make two presentations. The first is going to contrast the incentives inherent in private ownership versus the incentives inherent in government ownership. And then we'll go on to the incentives inherent in freedom of exchange versus those inherent in restriction of exchange in government regulation. And I'm going to make the claim that the incentives for people to pay attention to the well-being of others are much stronger on this side of the range. All society free market institutions almost require people to pay attention to others in order to get what they want for themselves because others don't have to deal with them. If you want to make use of someone else's property, you have to make it worth her while. If you want to exchange with someone, you have to offer her something that's going to be useful enough so that she'll participate. So that's really what I call the invisible hand principle in an early lecture. If you want more for yourself in a free exchange economy, you better pay attention to what other people want where they won't interact with you. In that setting, people have a very strong incentive to pay attention to what others care about and value. On the other hand, when you have government intervention, when you have governmental force used, even if the intention and the goal is to make things better off for people, human beings being what they are are tempted to use that intervention for shortcuts and get what they want independently of what others want by getting some governmental action that favors them at others' expense. That's the overall claim. Now we're going to start with the institutions of private ownership versus government ownership and look at the incentives inherent in those. That's this lecture. I want to begin right away with a case study and ask you some questions about it. Then I'll give you a contrasting case study and ask you some questions about that and I'll try to make my point out of these two case studies. The first case is that of the Tongass National Forest in Alaska. The Tongass is the largest temperate zone rainforest in the world. It's the largest national forest in the American national forest system. It's about the size of West Virginia. It's the largest temperate zone rainforest in the world. There are larger tropical rainforests, but there's no bigger rainforest in the cool areas of the world. Some details about it. It's a habitat for Sitka spruce that tower 500 feet in the air, Sitka black-tailed deer. There are otters in the streams. It's habitat for wolverines. It's one of the most important spawning grounds for all Pacific salmon because there are so many streams and inlets and waterways, all in that very much indented coast of Alaska. As a national forest, that area of land is meant to be a land of many uses as the forest services motto goes. In addition to the environmental amenities of the Tongass, for about four decades, for a long time until about ten years ago, there was a major logging operation going on in the Tongass also. The way it worked was that private logging companies would lease from the forest service permission to go into the forest and cut down the timber so they would pay for the privilege of going in and cutting the timber. The forest service built the roads and managed this operation. Unfortunately, the logging operation was very environmentally destructive. They cut a lot of the old growth timber. The logging activity would lead to erosion, which would silt up the streams, make it more difficult for the salmon to come up and spawn. In some dreadful cases, they found the simplest way to get the timber out of the forest was to drag them behind these great big machines and just drag them down the stream beds. That had the consequence of making the stream beds, which in their natural state have trees fallen into them that dam up the water and make little pools where the salmon can rest. No pools, no trees down. They were just loose ways, and so it was very difficult for the fish to get up stream to spawn. There was clear cutting, which was ugly, and a variety of environmental problems. Now you're taking your notes on paper, we're sitting at what looks like a wooden table. We need wood products, and so it makes sense to do logging, even if it's ugly, where the benefit of the timber exceeds the cost of getting it out of the forest. But in the case of the Tongas, listen carefully to this, lest you think you misunderstand. The cost of building the logging roads into the forest, a cost which was borne by the Forest Service and then by the taxpayers, therefore, the cost of building the logging roads in and managing the logging program far exceeded the market value of the timber that came out. The Forest Service lost about 80 or 90 cents on every dollar. So we had this very environmentally damaging operation going on at a loss. The question I want you to consider is why. Why? Who would be behind that? And I'll give you a little suggestion about how, a quick and dirty way I think about public policy. I want to understand a public policy, I ask myself two questions. First of all, what are the interest groups fundamentally involved here? What are the interests that are most affected? And second, what are their incentives? So you might consider that. What are the interest groups most involved in this logging program? What are the people who have the most at stake with it? And what are their incentives? So consider that now and try to give me an explanation of why Congress would renew this logging operation at a bad loss with great environmental damage year after year after year. Fortunately, they've ended it almost entirely now. But it went on for a long time. Why did it happen? Okay, let everyone think for a moment. Okay, go ahead. So the benefits of the logging operation, that is the revenue they made, were all concentrated in the logging company. Okay, so the logging companies are, the logging companies certain, the logging interests including the sawmills benefited greatly. Whereas the costs were diffused among all of the taxpayers. Okay, good. That's right. That's true. Who else in addition to the logging companies benefited? And let me be clear, the logging companies benefited by having the roads built for them. If this was privately owned land and they had to build the roads, they would have declined to do that. Because the roads were more expensive than the value of the timber out. I'll add to that quickly. Partly it's because that area has boggy soil. And logging roads have to support big trucks that carry tons and tons of logs. So these were big substantial roads. And in an area with lots of streams and inlets and so on, they had to build a lot of bridges. Steel bridges, big major bridges to carry, so it was very expensive. But they didn't pay for it. Okay? So you could give them any one interest group. I'm looking for two other interest groups here behind us. The logging companies clearly benefit because it's profits where it would have been losses. Who else is involved? Road builders and I assume local politicians who can give jobs to their people building roads. Road builders, I think they're like sort of the logging interests, yes. But local politicians, not just local politicians. And you're right that it's jobs for the logging companies and the sawmills. But I don't think local politicians because the local politicians have no authority over a national program. But you're warm. Well, of course the representatives in Congress can get the benefit for their district and also the other incentive group I'm thinking about is the Forestry Service itself, it wants to expand its budget to- Good for you. You've got it exactly. You've got it exactly. So the other two interest groups are Congress and the Forest Service. What's in it for Congress? Well, Senator So-and-so, Congressman So-and-so, the logging companies, the American Lumberman's Association invites them to be our speaker, all expenses paid, of course, in our annual meeting at the beautiful island of Maui and we give you an honorarium for your speech so that there are political contributions from the logging interests to the members of Congress who will support this program. Now there aren't enough congressmen in Alaska to sustain and the other timber states to sustain this, but they do a little bit of you scratch my back, I'll scratch yours with Congress people from other states in exchange for supporting their programs and we can see how it'll go. So it's votes, it's political contributions to Congress, that's what's in it for them, but how about the Forest Service? What did you say? What's in it for the Forest Service? Well, they want to expand their budget and their influence and government. They want to expand their budget, they want to expand their jobs. So there's jobs and budget for the Forest Service, they build the roads, it's jobs and revenue for the timber companies, it's contributions for Congress and that's what sustains this. Meanwhile, what's happening to the forest, it's being pillaged, it's being despoiled. Now here's the key question for the purposes of this lecture. Who owns the Tongas? I'm looking for three different but equivalent answers. Who owns the Tongas? Two of them are nobody and everybody. Two of them are nobody and everybody. The other one would be the government. The government. What everybody owns, nobody owns. And the government really has the say over it. The argument I want to make is that when the government owns it, or everybody owns it, or nobody owns it, the incentives to look after it are not very strong. The problem with the Tongas, I submit to you, is that it's government owned and lacks the incentives that are inherent in private ownership. Let's get at that with a similar case. It's similar in being an environmental case, but different in some fundamental ways. This is the case of the rainy wildlife sanctuary in coastal Louisiana. This is 26,800 acres of marshland. It is owned by the Audubon Society. What is the Audubon Society interested in? Primarily. Named for James Audubon. Conservationism. But primarily birds. They're the big bird watching society in the world, I think. James Audubon was a wonderful ornithologist. So the Rainy Wildlife Preserve is owned by the Audubon Society. It was given to them by the Paul J. Rainey family. And it's a wonderful marshland wildlife sanctuary. Among other things, it's the stopping over grounds for hundreds of thousands of snow geese who migrate from Northern Canada to the Southern Hemisphere each year. And a habitat for all sorts of wonderful water birds. At the same time, for a very long time, there was in the Rainy Wildlife Sanctuary an oil and gas production operation. Oil companies were in there with their, they had their drilling rigs in there and they built wells and the wells produced oil and gas in the wildlife sanctuary, owned by one of the major conservation groups. The question to you is, how did the oil company get into the wildlife sanctuary? What happened so that came to be? Think about that a little bit. Again, think about the incentives of those primarily affected. Who are the groups primarily affected, what are their incentives? How do you suppose an oil company was admitted onto the land, a wildlife sanctuary, land owned by a conservation group? What do you think? Well, the conservation group has an interest in keeping the sanctuary fairly pure, so the oil company is only going to be admitted if, one, they can pay a lot of money towards conservation, and two, the conservation group has some kind of guarantee that it's not going to despoil the sanctuary. Exactly the same point. Exactly the same point. It has to be mutually beneficial for both parties. Okay, other comments, other suggestions here? You've gotten it pretty well, gentlemen, good. The usually when I ask this question to my classes, first of all, someone says, well, there must have been some government intervention to force them in, but in this case, as far as I know, there was no government intervention. What there was was a contract. The way I like to imagine it, just to entertain myself, is that initially you can imagine the oil company approaching the officers of the Audubon Society saying, can we come into your wildlife sanctuary and drill for oil? I think, oh my God, that's the last thing we want. The oil companies are like the devil to us, get lost. But then the oil companies come back and say, we, our geologists believe there's a fortune in oil and gas down there and we will pay you very substantial royalties. And then you can imagine the conservationist sort of taking a deep breath and thinking, oh my God, all right, come into the office, let's talk about it. And the provisions of the contract would include very large royalties. And will you're right, the Audubon Society is a non-profit group. They can't pay the royalties out to their members. What did they do with the royalties? They probably used them for furthering their conservation efforts. That's right. They used them to improve the quality of the wildlife sanctuary and they used them to buy and preserve additional land. So there's a very strong advantage in the revenue to the oil company. As I understand it, also, there were various safety considerations. I don't know this for a fact, but I expect they required the oil company to post a bond so that if there was a spill of some kind, the money was already there to clean up. The oil company shut down, they offered to shut down during nesting season. So there wouldn't be any disturbance during nesting season. They had the ability to drill at an angle. So they said to the Audubon Society, you tell us the least sensitive places to site the rigs and within limitations we can site the rigs there and get to the oil and gas deposits. The roads, the heavy roads they need for their equipment. They said, we don't care how long and winding the roads are. Tell us where you'd like them so that we avoid the sensitive places. All these arrangements were made and as I understand it, there was never any safety problem. There was never any environmental damage. And it was a source of very significant revenue to the Audubon Society. Similar question to what I asked you a while ago. Who owns Rainy Wildlife Sanctuary? The Audubon Society. The Audubon Society. It's privately owned. And the idea I want you to consider is that the difference in the very satisfactory use of Rainy for dual use, not just as a wildlife sanctuary, but also as a source of oil and gas, with which we can heat our homes, is a consequence of the incentives in private ownership. In private ownership, the incentives are very different from those in public ownership. When you have private owners, the private owners enjoy the profits or suffer the losses. Therefore, they bear the opportunity cost of use. If it's true, as I like to imagine, that initially, the Audubon Society told the oil company to get lost, that was a costly decision to them. That would be millions in royalties given up. They feel the millions of royalties, because they own it and they have the opportunity to enjoy those royalties. So they pay attention to it. And they have a strong incentive to be good stewards, to make all possible good use of the land that they own. By contrast, the public administrators who administer the Tongass are not owners. They have no profit and loss stake in the land. They get paid a salary independent of profit or loss. And that program made massive losses for decades, but it didn't come out of the pockets of those who are making the decisions. So they did not bear the opportunity cost of use. The taxpayers did. And because they don't feel the opportunity cost, they don't see the possible benefit from the profits that come from good management, they have an incentive to use the resources to protect their turf, to benefit themselves politically, independent of the good of the resource itself. So that's my first point about the benefits of private ownership. Private owners have a strong incentive to be good stewards of what they own. Public administrators and non-owners don't have that profit and loss incentive to be good stewards. So that's one thing to be said for private ownership. It promotes stewardship. Next point I want to make, the second point about the benefits of private ownership, has to do with the performance of the private owners, the performance in doing their job, and we'll contrast that with the performance of the public administrators who manage publicly-owned land. In government-managed, government-owned things, because there's usually tax money coming in to cover it, there's less of a connection between performance and funding, and that gives less of an incentive to do a good job. That's the point here. Let's look at it with another example. I spent two years in Scotland as a student, made friends there with a guy named Donald Henry, and we talked about politics. When I came back to Scotland after my being at home in the summer, Donald's eyes twinkled, and then he looked at me and he said, Howard, I have a story for you. You're going to like this. I wish I could do the Scottish accent. Well, I said, OK, Donald, what was the case? He says, well, this past summer, I didn't have a job, so I signed on. I said, you signed on, Donald? I, to the dole. The dole, Donald? I, that's our unemployment service. OK, go ahead. So I signed on, but then I got a job. Well, I kept my appointment at the dole office. Didn't feel too good about it. I'm standing there in line and getting closer and closer to the window, and I'm feeling more and more guilty. And finally, I get there, the ladies, counting out these palm notes. I couldn't stand it any longer. And I said to her, no, I don't deserve it. I have a job. Guess what she said to me? Oh, go on, Deerey. Everybody does it, and she pushed the money his way. How well is that woman performing in her job of getting money to the unemployed? Not very well. How strong an incentive does she have to make sure the money just gets to the unemployed? When she performs badly like that, what's likely to happen to her job? Nothing. Nothing. What's likely to happen to the funding of the enterprise she works with? What's going to happen to the funding of the Scottish unemployment system? Might actually go up. Well, maybe it'll go up, it'll stay the same, but it won't be cut because it comes from the taxpayers. So the government administrator doesn't have a strong and incentive to do a good job because the funding is going to be largely independent of performance. By contrast, consider the case of Children's Scholarship Fund Baltimore, which is a nonprofit I helped to start in my hometown of Baltimore. We give partial scholarships to low-income Baltimore families who want to get their kids out of the bad public schools and into some of the good little often church private schools in the area. How careful do you suppose we are to check the tax returns and make sure that the applicants for our scholarships are actually low-income people? Do you think we are careful about, very careful, sort of careful or not very careful? I would guess very careful. Very careful. Why would we be so careful to make sure that we perform well and get the money to those who really need it? Because you have a vested interest if you don't screen everyone correctly, you'll either lose money or... That's it. Why would we lose money? Because you'd be... Because you mean, it's not even necessarily your own narrow self-interest, but you wanted the money to go to low-income people. And if it goes to high-income people, they're taking advantage of it. Well, that's true. You don't want that to happen. That's true. But similarly, the lady at the Scottish Dole office probably wants the money to go to the unemployed. But we have to be more careful.  I raised money in Baltimore long enough to tell you it is a jungle. There are all these good enterprises out there going to the same donors, and you better have a good story to tell. And your funding from your donors depends very much on how well you use those funds. So there's, again, this close performance in funding. And Children's Scholarship Fund is a privately-owned, privately-operated, private sector operation that can't use the tax system to get its funding. So we have a stronger incentive for good performance in our job. That's the first main point in this. The incentives in the institution of private ownership are such as to give people strong incentives to do a good job, to perform well in their obligations to others.


Hello, everyone. The title of this talk is Algebraic Attacks on Aster and Duster using low-degree equations. This is a joint work with Stanton Stakar, Willi Mer and Takanori Isope. Recently, there is a trend to design symmetric key primitives friendly to applications like secure multiparty computation, fully homomorphic encryption, and zero-knowledge proof systems. Aster is a fully homomorphic encryption friendly design proposed at Crypto 2018. The overall structure is depicted in this figure. Specifically, for IARUNs of Aster, it will iterate a run function composed of a fine layer and a non-linear layer for R terms. Then, one more fine layer is applied to the output. Finally, the key is XORed with the output and the key stream Z is generated. A notable feature of Aster is that the fine layers are ever-changing for each to be encrypted plain test block. In other words, each key stream Z is generated with a different concrete Aster instance. This is quite different from the common symmetric key cryptographic designs, where the linear layers, non-linear layers, and round constants are all fixed. Let me give a brief introduction of the Aster round function. The fine layer is generated in this way. First, use the plain test block counter C and announce in as the input to an XORF, for example, Shack 206. Second, use the output of the XORF to construct a random for rank-linear matrix M of size N times N and a random N-bid round constant Rc for each round. Then, the matrix M and the round constant Rc will form the a fine layer A. Different from the fine layer, the non-linear layer of Aster is fixed and it is indeed the M-bid calibration. Note that the file-bid calibration is used in the K-Chack round function. The designers recommended a set of parameters for the block size in the security level, for example, Rc and the number of rounds R. Indeed, the choice of these parameters is based on the resistance against the linearization attack, which will be detailed later. In addition, I have to emphasize that the key size is the same with the block size. Therefore, according to this table, it can be found that the key size is much larger than the claimed security level focused on the first the first role of this table. The key size is 327, while the designers only claim 80-bit security. Moreover, it should be noted that there is a limit on the number of flint test blocks for each M-bid key. Apart from the above parameters, the designers also propose the three aggressive parameters where the security level is almost the same with the key size in. They are called HR Star. The same data limit also holds for HR Star, and there is no attack can break any of them with such a data limit. For DAS Star, it can be viewed as a variant of HR Star. In a world different from HR Star using ever-changing linear layers, DAS Star adopts a deterministic then full-ranked linear transform matrix error. The DAS Star primitive was proposed at 2SEC 2020. The overall structure of HR Star and DAS Star are the same as shown in this figure, so both of them use the feed-forward operation. The non-linear layer of DAS Star is the same with the HR Star, so both of them use the M-bid calibration. However, the linear layer is redesigned in DAS Star. Specifically, the linear layer is now composed of a fixed linear transform error and an ever-changing bid permutation P. The bid permutation P will depend on the round number and the plaintext block counter C. Our attack is irrelevant to the details of the permutation P. Our attacks can work for any bid permutation. I will not detail the specification of P. There are two main features of DAS Star. First, no pseudo-random number generator is used. Second, there is no need to generate random full-rank matrices. The DAS Star designers propose the same parameters as HR Star, except the one whose block size is too large, as listed in this table. So, DAS Star also uses the same data limit as HR Star. Now, I will describe the analysis of HR Star. Note that the same analysis also applies to HR Star because they are in general the same design. The most challenging problems to analyze HR Star are listed here. First, it is a moving target. Second, traditional techniques like differential, linear, cube, and higher order differential attacks are fair because they require to collect many plain test, cypher test pairs and a fixed encryption instance. However, this is not the case for HR Star because each keystream D is generated with a different concrete instance. However, there are also some notable exploitable features. First, the degree of the nonlinear operation, the calibration is 2. So, the degree of the round function is low. Second, the number of rounds is small. At the last, there is a feed forward operation which implies that a mid and middle style attack may work. Or in all, the algebraic attack seems potential for the low degree of the for the low degree of the round function and the small number of rounds. The designers are obviously aware of it. Indeed, the choices of the parameters are based on the resistance against the linearization attack. There is no doubt that the linearization attack is the simplest algebraic attack. The procedure is very simple. First, the attacker collects T equations in terms of n variables and the degree of these equations is up-bounded by T. Then, if the number of equations is larger than the total number of different terms formed by the n variables, he can rename all the terms of degree larger than 1 with new variables. Finally, the problem is equivalent to solving a system of linear equations where the number of equations is larger than the number of unknowns which can be easily solved by Gaussian elimination. Obviously, the degree D will dominate the time complexity of the linearization attack. A smaller D the lower the time complexity of the Gaussian elimination and the attack. Let us see how the designers evaluated the resistance against the linearization attack. The degree of the calibration is 2 in the forward direction. For r rounds of r star, the degree of the key stream z in terms of the key bits is up-bounded by 2 to dr. Hence, the attacker will need to solve a system of nonlinear equations in terms of n unknowns and of degree up-bounded by 2 to dr. As already said, the degree will have a big influence on the time complexity of the attack. Now it is natural to ask whether it is possible to lower the degree to dr by using a mid in the middle style structure. However, is it really possible? Is it really feasible to consider the back direction? Due to the feed-forward direction, it is easy to observe that the output of the last calibration can be written as linear expressions in terms of the key bits. In other words, the degree of the output can be treated as 1. In addition, the input of the last calibration is of degree up-bounded by 2 to dr minus 1. Although the degree of the output of the last calibration is 1, the degree of the inverse of the largest scale calibration is rather high, so it is a well-known fact. Hence, if we simply consider it inverse, the degree of equations will be much higher than 2 to dr, and we can benefit nothing from such a kind of equations. The time complexity of the attack will only increase, not decrease. Indeed, this is exactly what the designers thought, and hence, they directly gave up such in the middle style attack. It is too costly to consider the inverse of the calibration. This is a summary of what I explained just now. The analysis indicates that we should never consider the full inverse of the calibration. Then, how should we analyze R star? It can be found from our paper that our used method is surprisingly simple, so I think it is more helpful to explain how we find the simple improved linearization attacks. This is inspired by the study on the 3-bit low MC S-Box, which is defined below. So, the degree is also 2. Then, the authors of that paper described how to generate more linearly independent chaotic equations for these 3-bit S-Box. The idea has already been known and has already been known in the Vienna XOR algorithm. Specifically for the output bit y0, we can multiply x1 and x2 with both sides of the equation and we will again get two different chaotic equations because the only chaotic term in the expression of y0 is x1, x2. Similar strategies can also be applied to the output bit y1 and y2. Moreover, we have two additional chaotic equations generated with different ideas. Thus, we consider to eliminate the cubic term x0, x1, x2 as shown in the last two equations in this slide. So, to do so, we have to consider two different output bits. So, combined with the inverse of the 3-bit S-Box, there are in total 14 linearly independent chaotic equations to describe the low MC S-Box. Based on similar procedure, we first list the end chaotic boole equations for the n-bit calibration. Then we can simply derive some chaotic equations by multiplying proper variables with both sides as shown in the last two as shown in the last two equations in this slide. Then we ask ourselves whether there are other ways to generate chaotic equations in other forms. This is a natural question because we can have two additional chaotic equations generated in different ways for the low MC S-Box. So, whether this also so whether we can do the same for the calibration is worth investigating. Then, we observe that we can consider two consecutive output bits of the calibration. This is also inspired by the way to generate the two additional chaotic equations for the low MC S-Box. So, we have to consider two different output bits. By looking into two consecutive output bits of the calibration, we find a chaotic equation in a quite different form. X i and Y i plus 1 equals to 0. Specifically, different from the chaotic equations in this slide. So, the last two equations in this slide, the input bits of the calibration we are no more multiply with each other. What does this equation imply? First, we should note that X i is the input bit of the calibration while Y i is the output bit of the calibration. Second, we should also note that the expression of X i is of degree 2 to the r minus 1 while the degree of the expression is 1. Hence, although the largest scale of the equation is not fully inverted, we can obtain an equation in terms of the key bits whose degree is upper bounded by 2 to the r minus 1 plus 1, which is smaller than 2 to the r and the degree of the inverse of the calibration. By simply using the above chaotic equation, we can greatly reduce the degree of the equations used for the linearization attack on R star. As illustrated in this figure, specifically the degree is reduced from 2 to the r to 2 to the r minus 1 plus 1. Note that we do not fully invert the calibration. Instead, we only carefully investigate the relations between certain input bits and output bits. That's why we use a dashed line in this figure. For when R is large, we can see that this is a great reduction in the algebraic degree. For example, when R equals to 6, the degree of the equations is reduced from 34 to 33. This equation also implies that the linearization attack will be improved by one more round because attacking R round R star with the new chaotic equation is now equivalent to attacking R minus 1 R star with the trivial linearization attack that stops the system of nonlinear equations of degree to the R minus 1 plus 1 in terms of n variables. Then, another question natural arises. Can we find other similar useful equations? If so, how to find them? To answer this question, we should first understand what kind of equations are useful to improve the attack. To do so, we first make a definition for the exploitable equation. An equation is defined as the exploitable equation is defined as an equation where the input bits of the calibration are only allowed to form linear terms or quadratic terms with the output bits. Finding exploitable equations is indeed not that difficult because we already know the constant on their form. We can use a three-step method. First, we consider a small-scale calculation. For example, n is 7, 9, 11, and 13. Then we use a similar technique to find quadratic equations for the small-scale calibration. Finally, we check whether the exploitable equations also hold for the calibration of any size. The five exploitable equations used in this paper are listed here. Note that equation 1 has already been widely used in the pre-media attack on HRC. However, it is always interpreted in a different way in that context. In other words, so its form does not attract too much attention. As for that star, we find that the attack can be further optimized due to the usage of a deterministic linear layer air. In a word, we can only, in one-output bits of the inverse of the last linear transform air based on equation 2, we can construct a system of nonlinear equations in terms of the key bits and of degree 2 to the r-1 rather than 2 to the r-1 plus 1 from many plain test cycle test pairs. So in a sense, this is an r-star. In summary, so this is a summary of our results. First, based on the improvements of the linear relation attack, we directly broke two out of three instances of HR-star. Second, the generic linear relation attacks on r-star and d-star are all improved by one more round for most instances. Second, third, r-star is weaker than r-star that's while rating the designer's claim. In concluding, our analysis shares new insights into the large-scale cooperation. Moreover, our analysis also shares new insights into how to analyze the r-star-like primitives. Finally, we significantly improve the linear relation attacks on r-star and d-star. Moreover, we believe that it is interesting to further investigate whether it is possible to construct nonlinear equations of lower degree for the r-star family. If it is feasible, we may even break r-star and d-star. That's all. Thank you.


The Covid-19 pandemic has had a significant impact on the health, well-being and working conditions of nurses in Slovakia. Nurses have been particularly affected by the strains placed on their health from the virus itself, as well as the additional workload and stress caused by the pandemic. Many nurses are considering leaving their jobs due to these factors which could lead to further straining of the healthcare system if left unattressed. It is important to develop human resource strategies to attract, retain and continuously invest in health workers, including in emergency preparedness and response. This will help to ensure the resilience and preparedness of the health system in Slovakia for future emergencies. This article was authored by Sylvia Putakova, Jana Martinkova, Elena Yurikova, and others.


Yep, looking forward to this. Well, the referee has let it go, and Cook has the lead, and Yanovsky has pulled up. He thought the red lights were going to come on there, and Greg Cook has the lead here. Can you believe it? Greg Hancock is in second place, Ty Wolfland is third, and Maxey Yanovsky is in the back. And Yanovsky pulled up there thinking that the race was going to be stopped. What on earth happened to the start there? Oh, unsatisfactory start. No doubt about that. Cook won't care. He's out in front, looking like he's third win. Hancock coming on strong. Second place, Cook. He's going to win this race. If he can, he's going to go through to the semifinals. What a night for Craig Cook. Wolfland is back in third place. Hancock pushing him hard into the last lap. What a night for Cook. He's going to win his third race on the night. Yep, three straight wins back in for Craig Cook. Goodness me. What a surprise this is. And good to see. Craig Cook makes the semifinals. Whoa. Points on the board after a last place in his opener. He is absolutely jubilant of his British colleague. Ty Wolfland congratulates him. And this is definitely, definitely the moment of his career. Nine points in Cardiff. He's still got a race to come, and we will see him in the semifinals as well. Congratulations, Craig Cook. What a night for Cook so far. He really is going great guns. Unsatisfactory start. I don't really know what happened there. I've got to see it again, because Yunovsky will be fuming about that because he was left stranded. There's no doubt about that. It was controversial. But for Cook, nine points on the board. What a ride. That'll do for him. And it means that Cook leads the Grand Prix. Who would have thought that? Greg Hancock, Bartosz Marslick, and Ty Wolfland all on eight points apiece. Goodness gracious me. What a moment for Craig Cook. Three straight... Here we see the start, Kel. Well, let's have a look. Oh, Yunovsky moves, but penalizes himself. So the referee gets it right. He jumps. You'll get a warning, quite possibly. We will hear that. And for Yunovsky, well, his chances of being amongst the points were over before he got to the first corner. Cook takes full advantage. Hancock snakes violently to the first turn. Yunovsky penalized himself there by being a little bit too eager. Wolffenden doesn't get away very well either from the outside gate. But Craig Cook doesn't care. He's out in front. He's having the night of his very life. And it's been such a tough time. Such a tough time. And for Cook, well, he's in seventh heaven.