Thank you very much for introduction. So my name is Yosuke Todo from NTT Secure Platform Labradories Japan. So today, I'd like to talk about cube attacks on non-black box polynomials based on division property. So this is a joint work with Takanori Isobe, Yonrin Howe, and William Are You. Okay, so first, I want to introduce as an overview of my talk. So our new technique is an improvement from the cube attack. So cube attack was proposed by Junyu and Shamil at Euroclip 2009. So cube attack is a kind of higher order differential attack. So higher order differential attack is one of the most powerful and famous cryptanalysis technique for block cipher. So when we attack block cipher using higher order differential attack, we first prepare the set of chosen plain text and we evaluate the sum of the corresponding ciphertext. So if, in many case, higher order differential attack uses higher order differential characteristics, who's the sum of ciphertext is always there. So when the block cipher is analyzed, we first prepare higher order differential characteristics, then we append key recovery after the characteristics. Then we guess subkey last round is used and recover the ciphertext from the intermediate text and compute the sum and evaluate as the sum value is zero or not. So if the sum is not non-zero, we know the guessed round key is incorrect and we can reduce the size of the round key space. But unfortunately, this attack strategy is not applied to stream cipher in general because in the case of the stream cipher, we cannot add key recovery part after the characteristics. So cube attack is so more familiar to the analysis of the stream cipher because in the case of cube attack, we recover the secret key from the sum of the corresponding output text. And in other words, the cube attack recovers the secret key from high order differential characteristics directly. But the most significant, most drawback part of the cube attack is this is the experimental attack. So this means we first regard stream cipher as black box polynomials and we evaluate this black box polynomial experimentally and they evaluate the sum of value. So in this case, as the size of cube bits, this means the size of active bits is limited to the experimental range, for example, 30 or 40. So that's a, in theoretical range, we can use more number of cube bits. So in such case, in many cases, we can attack more number of rounds. So in my talk, I proposed cube attacks on non-black box polynomials. So this means, so we never regard stream cipher as black box. So we perfectly analyze the structure of stream cipher and how to realize cube attack in this situation. So as a result, we explain the best attack on premium grain and acorn in the context of the key recovery attack. So how do we get this result? So we use division property. So division property is proposed, was proposed at Euroclip 2050 and this is a tool to find integral distinguisher on block cipher. So as far as my knowledge, so the division property is only applied to block cipher. So I think this is the first application of the division property to stream cipher. So but if we think, so the key, only key initialization part of the stream cipher, destroyed lecture is very similar to the block cipher. So if we want to evaluate zero sum integral distinguisher of stream cipher, this application is trivial. But so key recovery is non-trivial. So I want to propose how to recover the secret key. So to realize the key recovery attack, so I explain what division property can do. And so I propose a new, how to use the division property. As a result, we can get secret key variables that are not involved to the super poly. And finally, from this knowledge, we can recover the secret key. Okay, so let's start main topic. So now let's consider the stream cipher. So in this, as like this picture, so the input is two value, x and v. And x is n-bit secret variables, and v is n-bit public variables. And there applies a stream cipher. And z is the first bit of the key stream. In such case, we regained stream cipher as one Boolean function from n plus n-bit to one bit. So now, so we apply the cube attack. So in the cube attack, we first prepare cube index i. And so i is index i1 to ii, and this red part is active bits. And the other part is inactive. Then we compute the sum of the cube of the first bit of the key stream. And the c i is a set of two to the i values where v i is active. So in this case, so Boolean function f is decomposed into like this. And the p i is this monomial. So in such case, if the sum of the cube, so we get p i x v. And so attacker recovers the secret variables x by analyzing this Boolean function. And in the cube attack, we call p i superpoly. But so f is a stream cipher, and the stream cipher is very complicated structure. So it is very difficult to decompose Boolean function f into like this. So previous cube attack uses experimental approach. So now we want to recover the algebraic normal form of the superpoly. So we assume superpoly is linear function, and we compute the sum of cube for randomly chosen x, and so check linearity test in many times. If so linearity tests always pass, so if this nf of the superpoly is almost maybe linear Boolean function. So if the superpoly is a linear function, we can recover the algebraic normal form of the superpoly, and finally we can recover the secret key. But in this approach, so in the second phase, so we have to sum of the cube. So if the size of cube is, for example, 40, so it is very difficult to compute this variation in practical time. So in previous cube attack, it is experimental attack. So I convert this experimental attack to theoretical attack, and so for the theoretical attack, we use the division property to analyze algebraic normal form. Previous attack, so algebraic normal form is analyzed by experimentally using linearity test, but we analyze the algebraic normal form by using division property. So division property was proposed at Euroclip 2050, and so it is a tool to find the integral of the definition is like this. So it's a little complicated, so I skip this definition. So the most important part is division trade. So similar to differential characteristic and linear characteristics, so there is also division property characteristics. So if we have k there is division property, and the propagation rule d gets k1, kI, kR. So if the trade from k there to kR, satisfying propagation rule of the division property, we call this trade is division trade. So the most important part is, if there is not division trade from k there to EJ, means the unit vector, in such case, the J speed of ciphertext is always balanced. So, but this evaluation is in many cases very, so difficult, so in practical time. So, but as a group to last year, Sean proposed a new method for the evaluation of the propagation characteristics of the division property. So he used a CP based solver. So for example, MLP and SAS, SMT and constraint programming, so asked for such solver's help, we can practically evaluate the division trade. So if the solver answers, this trade is infeasible, we know the J speed is balanced. In other words, so if solver answers, it's possible, it's feasible, so J speed is unknown. So we directly apply this technique to stream cipher and we get integral distinct issue, there's some distinct issue. So now we get, we first prepare the division property for the chosen plain text, and zero k, and zero is corresponding to the secret key and k is corresponding to the cube bits. So now we check division trade from zero k to one, and if no division trade, we know the sum of the output is already there. But unfortunately, we cannot recover the secret key only by this approach. So to recover the secret key, so we propose a new application of the division property. So we never use division property to find there's some integral distinct issue. So we, division property is used to analyze NF coefficient. So we first evaluate the number of involved key bits, that's of cube bits, and we can guarantee the upper bound of the time complexity to recover the NF of the superpower. So to understand this technique, we first explain the basic knowledge of algebraic normal form. So now F is the Boolean function and this is the algebraic normal form. So and AUF is the ANF coefficient. So of course, it's practically invisible to analyze all NF coefficients. Now we first decompose a Boolean function F in according to the vector k, such that x to the k is monomial. So in such case, we can decompose Boolean function like this. So now we know this part is algebraic normal form of the superpoly. Now, assuming there is not division trail from k to one, so we know the sum of F is equal to superpoly is equal to this algebraic normal form. It's always there for arbitrary x. In other words, we know algebraic normal form coefficients such that U is greater than or equal to k is always zero. So this means by using the division property, we can know ANF coefficients are zero or not. So now we extend this idea to key recovery attack. Assuming there is not division trail Ejk to one, so previously this part is zero, but now we add unit vector Ej, then AUF is, if there is not such division trail, we know ANF coefficients such that U is greater than or equal to Ejk is always zero. In such case, so we know superpoly is like this and if Uj is one, so from this knowledge, we know corresponding ANF coefficients is always zero. So this polynomial is equal to this polynomial. But now Uj is always zero. This means xj is independent from superpoly. So this is the summary of the result. So now we first prepare the corresponding division property Ejk and check division trail. If there is no division trail, we know xj is not involved to the superpoly. So by repeating this procedure, this means we repeat E1 to En and we know each secret variables are involved to the superpoly. So now we explain attack strategy. So attack strategy consists of three parts, a variation of line and online phase. So of course, so previous cube attack, analyze is up to offline phase, but our attack is practical up to a variation phase. So offline phase is only guaranteed from the upper bound of the time complexity. So this is a variation phase. So first we decide the position of active bits i and prepare the set j is the empty set and we check the division trail E from Ejk to one. And if there is such trail, so this index j is inserted into the set j. If there is no such trail, so we don't insert. So finally, we know the set j and this set contains bits that may be involved to the superpoly. Next, so offline phase, we prepare, we decide initial IVV, randomly and repeat the set of chosen IVVs by flipping bits in active bits, and then compute the sum. So, but we know the secret variable only j bit, the size of j bits, secret variables are involved. So we, so as a, so n minus the size of j bits are not involved, so we can perfectly compute and store the table of the sum of cube with time complexity to the i plus j. So if the size of cube plus the size of involved secret variables is smaller than the security level, so offline phase is so faster than exhaustive search. And finally, we try online, we recover the secret variables in real. So access encryption Oracle and compute this sum and we check the, we compare this sum value from the sum value in online phase and if this sum value is different, the guess the secret variables are incorrect. So the data complexity is to design. So now we apply this idea to stream cipher trivium. So trivium has this type structure and so secret key is 80 bit and initialization vector is 80 bit and secret key is inserted into this path and IV is inserted into this path. So the number of rounds of the trivium is 1,152 rounds. So first to verify our idea experimentally, so we try small cube size. So in this example, sorry, the number of active IV is 10. So we choose this 10 bits active IV. In such case, so we know these five bits are involved to the secret key by valuing the propagation and the division property. As a result, we know, we attack five, nine, one round. So the time complexity is two to the 30 time complexity. So in this case, so if we choose this IV, so initially, so the super poly is like this and if we use this IV, super poly is like this. If we use this IV, super poly is like this. So in this case, these two super poly is not balanced function, but the bottom one is balanced function so we can recover the secret key, we can recover the one bit of secret key information by using this IV. So now we try the solid color variation. So the most interesting result is this path. So if we choose the number of active IV is 72 and this is the active index, in this case, the number of involved keys is only five. So we can attack this tribe with reduce the number around the H32 as two to the 77. Of course, the exhaustive search is the two to the 80. Okay, so next, finally I explain the other applications. So I also applied this technique to Grain12HA and ACOM. So Grain128 was already broken by the dynamic cube attack but Grain12HA was have been survived. So previous best attack is 177 rounds and it's only distinguishing, but so our attack reaches 183 rounds and it's possible to recover the secret key. And in the case of ACOM, so this is one of the third rounds is candidates. So previous cube attack is 477 rounds but our attack breaks 704 rounds. So finally, I conclude my talk. So I propose cube attacks on non-black box polynomials. So I propose a new method to how to use the division property. So previously division property is a simple tool to find to detect integral distinguisher. But so from this paper, in this paper I use the division property to analyze A and F coefficients. So in this approach, so the cryptographer only creating MRP model for the division property and so evaluation is, what evaluation was done from the MRP solvers. So the cost is very small and so it is very easy to apply this technique to barrier stream cycle. So and so division property is more practical than experimental approach. So we can evaluate cube attack even if the size of cube is a theoretical range. So for example, so in the case of best attack on trabium, we use a 72-bit cube bits. So it is practically infeasible to check such huge cube experimentally now. So but we can predict the security of the trabium in future. So thank you very much.


This is it guys, the prelude to the Ghostbusters event we've all been waiting for since the miniseries Ghostbusters Get Real from 2015 and last year's Ghostbusters 101. Hey guys, welcome back to Come Again TV, we're all geek culture collides. If you're new to the channel, don't forget to hit that subscribe button so you don't miss out on future videos. Ghostbusters Annual 2018 leads directly into the new miniseries from IDW Publishing and All-Star Ghost Heads Eric Burnham and Dan Sconing who've brought us every Ghostbusters story since Dan first began doing the art for Ghostbusters in a Holiday 1 shot during the Haunted Holidays trade paperback from 2010 and Eric began working on the title during the infestation two-parter from 2011. The story opens once again with a tunnel crew stumbling upon an ancient artifact, six stories underground. Of course with this being Ghostbusters, one of the tunnel crew doesn't want to wait and possibly share the wealth of the discovery and opens the artifact which leads the Ghostbusters being called in. After the Ghostbusters arrive, they search the tunnels and come across a being with a pumpkin-like head just sitting in mid-air. Ray obviously wants to communicate with it, but in straight up Venkman fashion he says, let's just not follow Ray if he tells us to get it. Eventually the being transforms into several hundred ectoplasmic bats and slimes nearly every member of the team save for Peter who barely got any on him as usual. Back at the firehouse Ron Alexander has returned from Chicago to undergo his proton re-licensing as part of his pardon. The hilarity ensues as Ray continuously jabs at Ron making him the punching bag for the team. Eventually the team tracks the entity to Liberty Island and Kylie figures it out but just when they're about to be overwhelmed with spirits, Egon gets help. From every dimension in the IDW multiverse, it's the Ghostbusters. Every single team across the multiverse. I have to tell you guys, this was a really great issue. The back and forth between Ron and Ray, it was almost like Ray had become another Venkman. The constant jabs at Ron's expense, even Egon got in on the action. Although Kylie figuring out the entity's name was a bit anticlimactic for my taste. They could have strung it along a little bit more but it's all a matter of writing taste. We don't get a lot of Peter or Winston in this issue but in the last few pages we do get two Kylie's in one panel. We get the answer to the call Ghostbusters and Jillian teaming up with Ron to begin work on something they've been wanting to get their hands on for a very long time. I can't wait for the continuation when we receive Ghostbusters crossing over later this month. Once again, Eric and Dan did a great job and if another Ghostbusters film is ever made, Sony truly needs to hire these guys as advisors during the script writing process and the filming because they truly know their stuff. Each of their mini-series could easily be turned into an animated film. In fact, why haven't IDW and Sony teamed up to do that yet? I mean Marvel and DC both get their animated movies. This would be a great way for IDW to draw even more interest into their publications. And what better title to start with than Ghostbusters? Especially if their first animated movie were Ghostbusters mass hysteria, which I've always said should have been a film. IDW, Sony, Sconing, and Burnham could make loads of cash if they took these stories and transformed them into animated movies. Start with mass hysteria, then move into Ghostbusters Ninja Turtles. Followed by Ghostbusters Get Real, Ghostbusters 101, Ghostbusters Ninja Turtles Part 2, and then Ghostbusters Crossing Over. That's six full-length animated films that could bring in loads of profit for IDW and Sony. So go out to your local comic book shop today, or head on over to comicsology.com and pick up your copy of Ghostbusters Annual 2018 and be sure to keep your eyes open for Ghostbusters Crossing Over. I'm Shannon for Come Again TV, take care my friends.


Stephen Farron here, Mountain View Dodge. What I have here, a beautiful 2021 Chrysler Pacifica Touring L Plus. This is an all-wheel drive, so I've been asked a lot of times when they come out with the all-wheel drive, are they gonna have the stone go? They sure do. Look at this. So on this one, we got a button right here. Push this, move the seat all the way forward because you want to do that.  Then you're gonna pull it up just like on all the other stone goes we had. You're gonna put the lever on the side. You're gonna pull the strap back here. It drops down. Pull this back and you have a full stone go. This one also has the rear DVD for the kids.  Mountain View Dodge. Who are you gonna see? Me, Stephen Farron, and don't forget your mask.


All right, let's put this one in full first here. There is no sound. So good. All right. So there's a lot of good stuff in there. And my main comments would be, even though this is super stylized, it would still be interesting to have a moment of when that arm comes up during all of this. And I love the multiples here. Great. That is a great moment there. And I'm curious to see how much it will break the stylization of adding slight rotation and just a little bit of wiggle. I'm just really talking a couple of pixels. It's just slightly alive.  So it's not completely only one arm. I'm just curious if that would just break it. Cause it is really funny that it's just only the arm moving. I like the smears. All that stuff is great. And I like that it's the only time at the end that the character is blinking. He was great. I was curious. I'm just curious about that. That could be an interesting change just to see how it will break the cartooniness. Now, when he actually does hit the guy, the only thing I would potentially examine is he's always kind of like, if I put in the onion skinning here, once he gets hit, let me just see. I didn't go in there frame by frame. If that's the head, here's the head. That's cool. And then we're in the middle. So it's always in a different spot, but then we're getting a bit similar. It's not super different. And then we have the ends. So my thought was, what if on these, as he's progressively hitting him, that it would also have him go down more and more and more, meaning that he's here. He gets hit, that's here. Bam, next one he might be here, but maybe a bit more on this side, really pushed that contrast. Then when he's up here, imagine on this one, he's lower. And if you want to go ta-da, that nice pose, then maybe it would be a lot higher. And then when that happens, now he's a lot lower. And after this one, he might go up. So there might not even be too many moments where I was thinking where he goes lower and lower and lower. But maybe it's just, to me, when you watch this, boom, hits, hits, hits, hits, hits. I know there are changes, but it's overall feeling within this bubble. I wonder if it could be something where it's more exaggerated and then the ups and the downs and left and right potentially. Other than that, a lot of cool moments here where as he turns, he's got a really nice, clean silhouette. I would potentially look at, I know he has to go higher because the gun is here, but maybe it could be an exaggeration of something with the hat, the flap up here and this here and this like that. Just so you have a cleaner view of the upper arm, even something like this on the hold. So when he goes on here, and I'm talking just one frame, but something where we just at all times have a clear view of that elbow. Like that is nice as it goes down and we're resting on that. The smears are cool. I like, so much that's good here in terms of the holds, the squishiness and the bounciness here, thawing, that's all cool. When he does this here, the same thing, I'm just looking for contrast where even when he grabs the gun here and goes, huh, it could be a, oh, I'm in trouble. So it's not just down here and watch this, goes down, squash and stretch up here, but it could be with a slight bend back. Maybe even that foot goes up. Not that you have to do a reversal, but just something where it's a bit more, whoa, it's going away from the threat, but now this guy's threat is he has the gun. And you might as well go a bit lower and then separate those fingers. So you don't have that overlap there. But again, the animation is great. I like, it all reads really cleanly because you have a lot of clean shapes during all of that. Bum, bum, bum. And again, I love the weight on this, duck on that, how the legs stop and that little swing on this, I think this is a really nice moment of hang time. See how this drags, this goes down first. And as it lands, it has that warrant, the arc down onto this. And when this goes down, I only kind of moves that forward into that. The only thing I would say here is that it's a bit convenient for the head here to land on this. And I will probably do something where it's sideways, like flattens with the head like that, nose here. So it's not just on the chin, just give it a bit more of a flattening. And I know you want to have that come out, but I think there might still be a way of, even if the head is like this and flat, it could just come out like this. And then that way it comes out kind of in the angle and not straight down. It's diagonal, so it could be a bit more appealing as well. And that's kind of that. It's a very, very cool clip. Okay, let's play this with sound. There's a lot of awesome sound in this. Get ready. I'll bring down that sound for myself here. It's so good. So good. There's so much to love. I mean, it's not that much of a critique. It's more going through in terms of what's awesome. Already you have that coming in. And I like that it's the names of the rigs. And then it goes straight into, I love this. You got that little keep alive there, right? Let's go back here. All of that works. You got classic game, keep alive on him going back and forth. I think that's great. There's even a lot of detail in the shoe here. It's not just cut off on the IK foot here, but it has movement. That's great. This might be the only thing where it's a bit odd.  That might just be me. But this is cool. Let's go back to the left guy. I like that. Immediately move with that foot. And it might be something where instead of having just a translate, I know this is extremely picky because everything is really so good. It could just be where maybe it's a foot roll and then into flat or you start with maybe the toe goes up and then into this. So it's not just this whole shape moving over. That could be something where maybe it pivots off of here and the backside moves this way and then the whole thing moves. There's little things like that. I love this. These are all nice clean shapes. You're getting already into smears and multiples. You know, the hair. I'm just going for my frame. I love it. I love how the head drags, how the body goes first, but there's still enough movement to not make it super stiff. That's great too, how the hip goes up here. I love that. I love all those shapes. There's so many great moments. And I like that. It keeps that arc with the multiples. This goes right into a wheel, which is awesome. I love that it kind of just goes out of here. That's your pivot right there. Look at that. We can just go frame by frame and look at all of the awesomeness. It's so good. It would be fun for this guy. I don't know if this rig allows it. Right around hereish, maybe, to have a frame or two of just huge eyes going, whoa, what is going on right before the hits. But then you just kind of play with that a bit. But I also kind of like that. This is the one that is super cartoony, where this one is just a bit more restraint. I'll look at that. I'll look at the awesomeness of all of this. This is so cool. Love that. Look at the little effects in there. And then we got the pah-pah going in there. Shapes like this. You still got the effects there. I love your pops. Like you one frame pops out of that pose into the rest. We're still falling through with that, ooh, with the momentum energy that that leg still goes up with that foot here. And then hold so we can concentrate on him. And that's cool too. Love all that. I just transitions into that. It's a nice quick camera move to make it all work. Clean finger poses. Again, I'm just going through mentioning what's awesome. Love all that. Super picky, maybe this here or here, but not right where that leg is for tangent or a little overlap. I know this is a ridiculous comment, but it's awesome. Also look at him about how he is trembling here. Just enough. It's great. Also love the idea that he comes in from the other side. Maybe a picky thing would be the eye line. This seems okay. Then you go to here. It seems like it's a bit above. And really, unless you're saying it's going to look at himself, or maybe that could be something to look at, maybe with some darts or even a blink through this.  Just something here could be fun. Dragging that ear maybe this way, stuff like that, but it still has all really nice arcs in the flow of that drag coming back in here. Love this. I love just those three lines there. Mish, that at the end. Love that, that shape too, like this, did he? It's just, again, I can only go through and mention how awesome this is. It could be something where as you lean back, maybe this has a little bit of roll over. You can see how it's cut off here. Since everything has enough keep alive and movement throughout, this could be something to kind of push that. This one maybe more of a pivot at the top or maybe the top part of the foot goes up. So it's not a complete slide. I'm looking at how much all of these are sliding, especially at the end here, but both feet are sliding. So maybe that could be a bit more of a slide step, maybe lifting up like this and exaggerating. Not that much, but as a thought, pivoting off this side. And if that's the ground, this side comes up in a very minimal way. Super, super picky things here. And again, something where, again, I don't know if that rig allows it but pushing that smile, maybe making the pupils bigger, just dilate them, making everything to spin. Oh, how nice of you to be here. Maybe potentially pushing that a bit more. This maybe bring the shoulders and the longer, bigger drag. And it's just the neck. Probably at this point, I would flatten those fingers, maybe even stretch them a bit. Just push that moment in there. That's the whole thing I would say here. And as you go here, I love that he goes from this to slap straight over the hair. That's so good. And that is such a great idea too. I love that too. You could potentially, let me see. I know it's short, but potentially exaggerate the chest shape of the inhale. And then as you thinning this out a lot more, so you really feel like inhale, and that air goes through there. Maybe even with a little bulbous thing through the throat. So almost like feeling like that air goes into this. Picky, but that could be something. It's great. This one, not that it's wrong. This is one of those where it's just a different opinion. This could have been fun too. I mean, I see the wobble, but there's something about this with the sound to make this just straight. I don't know, that might just be me pushing that into a straight. This I will probably bring those arms if that Rick can do it. Just kind of break the Rick into duplicates, but stretch out just for that frame. But it's such a direction change for that character to really stretch out a bit more. I'm even here one more, and then it gets into what it's doing here. And that's that. And then we got KO, and that's the end. Super cool. That's all I can say. Repeat myself. It's a super cool clip. I love it. All right, let's play this in full here. There is no sound. You got a long silhouette look here. Da-dong, da-dong, da-dong, da-dong. Cool, cool, cool. Jump, getting ready, and bam. It's cool. I picked this one too because it's not your typical cartoony rake. It's not what you would really expect. And I do have a couple of notes in terms of clarity, but other than that, there's a lot of cool stuff in it. So right off the bat, I love this. I love the very graphic look at that beginning. The only thing I would say is I personally would reduce the vignetting. It just gets a bit dark. It's not too bad. We can still clearly see what's going on here with the character, but it just gets a bit dark in moments like this here when we go over there and we start to lose what's going on. Personally, I feel like, oh man, it's a bummer. I will make that just a bit cleaner. Maybe reduce maybe just for the slight corners there. That'd be my only thing here. This one, the only thing I would say is that it's the run and then we cut to the same run until here. So it's more than half. We are like 60% into the clip and it's the same animation over and over and over. So that could be something where, I know this is adding a lot more work. I'm just saying for future things. We're seeing the run, that's cool. And by now we get it. To me, after this, the repeat has to change because now it's really getting to repetitive stuff where it could be where now we have a slight jump with the gun going this way and then shooting and then bam, that's what causes this. So you have a bit of a difference of run, run, run, run. So it's not just the same thing over and over and over. This gets somewhat saved because we're seeing it from this angle and you have a turn that adds more interest and now we get to see the front part of the character, which I think is neat. It could still be something where, I mean, if I be super picky, it would be run, run, run, run, jump, shoot, bam, explosion, but still in the air, landing in this, shoot, boom, boom, maybe even with the camera tilt down and then into a run. So right after the landing, the camera starts turning and we get into this, that could be something to consider. So it's not so repetitive. I would also look at since, I mean, it's okay silhouette with the color, potentially giving this a bit of a different color to help us see what's going on here. It gets a bit, even with these things coming out here, we don't quite understand what is going on there. I think it could just be a bit clean even here. I'm starting to lose what, what is what here? Then as you jump, I will cut out sooner because we get to string and then we linger and I'm going, okay, am I supposed to, it's something gonna come out here. I would just cut out soon out of that. We don't need to linger on this, almost setting up something that doesn't happen. Then getting into this, that's fine. What I said before, I would just reduce the vignetting a lot and potentially keep more of that in terms of the clouds and not go super dark. Because again, we're starting to kind of lose things a little bit here in terms of clarity. Again, it's not super, super bad, but it would be nice on something like this on the pose that you hold. So you just, why not just have more white clouds and keep the darkness here, but really make this as clean as possible, like the way it is, you know, I mean, it's not like here, anyway, like how the whiteness here, like that is nice and clean. And all of that is really great. And I would just kind of keep that approach for here as well. I like how you change from the posing here into this. All that's cool. Don't think at the end, tricky angle, where are we getting that gun over that knee and all the dark shapes there? That is a bit better. I like this. I think we could hold on this longer versus that. And even this here, we kind of miss this. So maybe on that, could be a post change where we lower that leg potentially. Now that has to be a crazy post change, but maybe just keeping that as clean as possible. And then that is almost too short. It's a good rhythm though. But it's almost like you want to do our second kind of a, as it comes out, it's almost like comes out here. And this maybe the propellers come out and start turning for a kind of exaggerated hold into that. And for your last, probably have this here, this here a bit longer, a bit lower, and then one more where it's really up here and then that into this. Or it's throwing it out there, it's totally different. I know you're having this where we kind of, she shoots into the POV of where I was watching this, could be security camera, whatever. But completely changing in what if this is, the camera is a bit more three-quarter, so we have a bit more of a body, gun, leg pose. That's a very fat, it's almost here. But imagine we just have a cleaner view and silhouette of that gun. So imagine it would be three-quarter and shooting and then maybe whatever the trajectory is that, and it's not this, because the camera broke, but it's, I mean, it could even be a bit smaller, but like she could be smaller here, but that project that could come here and it's an explosion that with debris that wipes out the frame into that. So it's not a static, because the camera broke or the recording device, but it's an explosion, debris, smoke, whatever that causes that as an ending. Throwing it out there, I know this is a massive change. It's just for food of thought, so different ideas subjectively, of course. Other than that, it's very, very cool and that's it for me. As always, let's play this in full first year. There is no sound coming in. Shoo, mm, that smells yummy. And getting ready, wait for it. All right, that's the clip. Nicely done here, cartoony poses, good timing. I love the idea of the how he stops getting into this, arms up into war, into that with a turn to then lean over into this. I think it's really cool. Also not a walk or run, but it's a float into that where we hide the eyes for a moment. I like that you come in here and it's basically just looking at this, hiding and then again, mm, my biggest note is for this and it's not something where something is wrong, it just be something that's exaggerated and just a different idea. So it's very subjective. And it's something at the end in terms of the posing. So mainly what I'm gonna look at is, this is all cool. And there are some moments when you have transitions getting into this, but then it feels like it's almost a bummer that this is right there where that nose is, where I would feel or like that with the hair, exaggerate and maybe lengthen that arm. So that hand is here. This is a bit below the nose. So you have a clean separation between that and that arm and all of this, kind of forming a lot of somewhat tangents. It's just kind of too overlapping. Same thing with this right there. I know I'm talking single frames here, but anything to kind of separate things and keep things a bit cleaner, even here potentially separating that hand and this hand, maybe this arm would be higher, this one would be lower. Just looking at moments like that. That's fine because now you're into like one clean pose with just hands sticking out there. That's all cute. Love all that. That's all fine too. You could even exaggerate and curve those fingers. Everything kind of follows that path including the fingers was even have the hair kind of doing that. Then as you come in here, I will probably still have maybe a drag more on those legs instead of feet, instead of being down. I don't know if how it will play if those legs would be up and then snap that into this. Minimal things, nothing crazy to change. My biggest thing here, this is what I was talking about, is when he gets up here, again, this is purely an idea difference.   What does you do here? It drops down. So maybe there's just a quick moment of where during all of this, the chicken comes up, trembles a bit, goes up, is up here and then drops back onto the plate. And as it drops, then your arms come up into this for then that, that could be a slight change, but that's almost when I was watching this, since it's so cartoon exaggerated, I was secretly hoping that you would do the sniff and that chicken comes up and floats and gets stuck on his nostrils. No, not get inside, but kind of stuck on the nose and rest there. That's the main thing for that. As you come into this here, the main thing I'm seeing is that the head is always profile. I know I'm saying this and it's not profile, but as a whole through all of this, I feel like we can do something where, and by me that we, that's a royal we, it's you, if you consider this. So as we go down here again, keeping me at foot a bit lower, separating things a bit more. It's a nice little wet for light and dark, but I don't know, I still feel like we could separate certain elements. This is fine too, but you could push this and bring this here so that knife is separated from that. He brings in what knife and forks, even with this, so it's not too overlapping here. It's a bit of a bummer. Like all those overlaps are with the thumb on those separate frames. Even this is kind of lined with that chin. Might just be me, but I would separate these as much as possible. Even this, the tangent with the nose and that, separating just as clean as possible in terms of silhouette and you're in between here. That's all cool. What I would do here is that we can have all of this goes that ready. And then when that, that's awesome though. I do like this, but when he's done, we're back into that profile pose. And I feel like this is a certain state of mind where he is sitting, looking at this, getting ready to eat. And this is different now because he's done, he's done eating. And it could just be when he's doing that, it's a bit more three quarters. So we go back and maybe, maybe like this, that's the angle of this or even more, where it's kind of almost facing us. Maybe one leg out here, one like this. I know the foot would be off screen and maybe more of a lean this way, holding on to this three quarter. Ah, maybe head up and maybe like that on the fingers. Maybe that could just be something, but that's the only thing I would say at the end, it's a bummer that we are profile and at the end profile again, where we kind of push that end pose to be a separate state of mind and just kind of the end of what he has done. And again, we are a bit closer, forming a bit of a tangent there between the chair and the thumb. And I know I'm talking about single frames and moments in there, but being picky, just mentioning things that I'm seeing. Other than that, that's it. It's a cool clip. Just giving my tooth sense, my two cents, thanks. Alrighty, as played as in full here, there is no sound. Headed towards the fridge, a green fridge. Getting ready to drink and wait for it. Storing. It's a nice, nice facial pose there. Storing. All right. Cool stuff here. The reason why I'm picking this one is mainly for clarity of silhouette and posing. And that's mainly it. There's some really great moments. I think the timing is good. It's everything is like somewhat, I say somewhat clear. I know what the character is doing. I'm just looking at posing in silhouette, but tired, opening this, makes sense, grabs that. I like that little somewhat like soft little, just a little bit of that. That's great. Drinking this. And then I love that. Just that little moment here. Nice posing on the fingers here. You got that going this way and it goes into, and then that bottle. I think the biggest thing animation wise, I think is that bottle. Like everything else, animation wise and timing wise, I like all that. It's cool. The draw, all that's cool, but the bottle actually has a, let's go back here. Goes up, up, up like that. It's a bit of a weird trajectory. And it's almost, I would do a, whoa, not my head. Let me bring my head over here. As I go with, that's the idea of. So I will go up, hold, twirl, and then down. Let me bring my, my head over here this way. That's the biggest thing animation wise, is this bottle. There's just something slightly odd in that path. As it goes up this, it even goes up here and then goes back down. That'll be the biggest thing. Now, that's all good. Love all that. Now, when you open the door and you're covering everything, then to me, I know the big thing is not what is drinking, but it's almost the missed opportunity of if we're covering everything here and then it's kind of a, ba, ba, reveal. Hey, that arm is covering the bottle here. It's not a super clean view. And it has, there's no change in the face. It's nothing really super surprising regarding the bottle here. And I know this would change everything because you are holding it like this, but maybe there could be a different way of, maybe comes in and it's this arm that opens. I know it's a tricky thing that opens the door, but it will go behind him and it has to go past that head or maybe brings the head back a bit. And then as he closes, it could be then the other arm that grabs it around him to then close it. I was just extremely cumbersome, but I'm mainly reacting to a missed opportunity of that having no reveal and this arm covering that. This is clean again. I like this a lot. And even when you do this, bringing down that elbow to keep that really clean. Like right now you have the wrist and that forearms all aligned. It is a bit of a break here. We understand somewhat the length of the arm, but it could still be pushed to give us a bit of a cleaner silhouette. Anything kind of like that. That's all okay. And this is fine too. And to me, just the bottle. So not that I have a great solution for this, is I understand that well, if the hinge is here and this arm opens, I mean, you could, right? And then you open it and maybe just brings the head back a bit or it's just a shorter length. Now the width of this would be different so that you can actually open. I'm not sure how much this, you know, it doesn't intersect with the head, but I don't know if that hinge would be here if the same thing would be happening there, but it could. But I understand that if he grabs this, you can't close it. But the thing is, if you're not going for a reveal, the thought could also be that this arm is opening it and that that door is now behind him and he doesn't close it. You just, this arm is the one that goes and grabs the drink and it's kind of the opposite of that. This arm is that one doing it and this arm is this arm holding the bottle. I mean, again, might be tricky at this point because I do like this because if you drink and you have that here, it could still work silhouette wise. I'm not saying it doesn't. There's something nice about this, having this arm here free and this arm back there, but worth a thought.  I'm not saying something you have to incorporate but it's something for you and whoever's watching this to consider if you're doing this, it's almost like you're setting something up for reveal that's not there. And then that is a bit of an unfortunate overlap for clarity because now once you close this, this is the reveal of this and you want this to be as clear as possible. And that is that from me. Thank you. Alrighty, let's play this in full first year. There is no sound. Gonna go for the gun. Ta-ta-ta, twirl. Almost shoot. There you go. And then react. Super boom. All right. Cool stuff. I like the posing. Everything is clear. For the most part, I got some comments here and there, some nice lines, but the main reason why I'm picking this one is because of the timing. Everything feels a bit too drawn out. No pun intended here with the draw, but this is all takes a bit too long. This could be condensed into just doing the twirl, going for the gun and even this here could just be grabbing this a lot faster. You can shape a couple of frames out of this and also getting potentially a bit more of an arc into this. It follows into that twirl versus this that feels a bit straight here as it goes just straight up there. And I like how you have the head move out here. But what I would do is the tricky things that you have a lot of covering the face. It seems all very overlapping. You wanna keep this as clean as possible. I would consider something where that is a bit more the case of the line of action of the body where you have the head way out here is out here. So the twirl happens like this and you still have some separation between all of that and the head and that way it's not. So I'm gonna go back here straight with that. You can have a bit more of a curved body line. And that way when you go like this it's not just that but because you are potentially this far back let's just pretend this is where you're at if you put on on the skinning here. Well, let me just delete this, it's cleaner. So you have that, let's pretend this far out and then you go into this and even that might have a potential bigger move shoulders up here. You can see if I'm going fancy here with different colors you can see the amount of distance that the characters covering here versus now let's go super fancy and go with what should we go with? Let's go red. You see right now you have this line where his body is and then this line where his body is it's just a smaller distance of travel. It just in terms of contrast it's just not as exaggerated as it could be. Let me switch back to this here. So imagine like those moments would be more exaggerated where you have from here to here maybe in between being lower with the breakdown just pushing those elements but going back to the timing that takes a bit too long. That's not too bad if you zap into this fastest that's cute, I like that. That's good timing there but even this could have just bit faster I would shave a couple frames out that especially once you get into this I would find a way to lean him a bit more over there so that we have a clean separation between the head and those arms. So it's not so overlapping there. Like all of that for me it takes way too long to cut in half at least and if you go from here to here it might even have a little bit of relaxation in those arms to go lower, to separate that not that you can go lower than his beard but trying to find moments where we don't get too close where it's almost a tangent here with that line and that mouth line there just kind of free things up and keep it clean. So again imagine the head would be for the back you wouldn't have that overlap you would have a clean view of the gun, the arms and then that hat could be somewhere here and the head could be here and that would just be cleaner not that my drawing is awesome but hopefully that makes sense. So that's not too bad but I would still go whoa this into maybe a bit more exaggeration in what the root is doing to go whoa, it's a bit more of a down and then up with the push on that leg and you can potentially speed this whole thing up by 10% it's a bit more potentially even wider in terms of how far you're going you're going pretty far or maybe just a bit more maybe it's just the speed I'm reacting to just feels like I'm really seeing all those multiples versus it's so fast that they serve as multiples and smear frames it feels like it's just a tad too slow and even this drop could just be oh, and just a bit faster. That's the main thing I think there are a lot of cool moments in there but just overall again I picked this one where I feel this could really benefit from just a bit snappier timing and watch out when you go down here I'm not sure if this is the foot sliding if you started to add some camera moves because it's not uncommon to add camera movement stuff but when you have no background, no lines, no nothing you don't know if it's the character moving or if it's the camera moving so watch out, I would if you do this potentially with a post change might even pivot off of here just to a rotation over but watch out for feet just kind of sliding around like that and that's about it


Seems a little rowdy in here. Ladies and gentlemen, Third Street, used to be a barbell gym is now turned into a zoo. It's a powerlifting zoo. We got a Game Day barbell in the house. We hit some podcasts. We just got back from the expo. I feel like I haven't slept in a week, but you got to train. It's beautiful because like, yeah, we're content creators and we're businessmen and there's real trips based around building a meet, an event, an experience February 4th and 5th, but the truth is we're all just kind of gym bros. So it all revolves around us lifting weights. We got some of the meeting done. We got a podcast done, a little more serious. Then the music goes up and it's time to smash weights. Enjoy the ride, man. We got Joe Stanley. We got Tim. We got Niko. Nadine's in the house. It's a literal party. A little aviar lifter now is full-time, so she's up in the game for smashing weights. I'm in front squat and then try to hop in with the bench with the boys. Freshman when I came in, I was like, damn, they're in a warehouse.  I did ask him and I'm like, dude, there's floors that have like no dust, no chalk or anything. The front desk is well put together, which also you guys built yourself. Really impressed by that, dude. I could tell how much work you guys put in. The community here is like awesome. Like the energy right now, the music's really good. The equipment is really, really nice. They spend a lot of time and a lot of their effort making this gym really clean, really accessible to the public. I'm really impressed. Really, really impressed. They do a really good job using their space. It's honestly, it's not the biggest gym in the world.  Honestly, I think the front desk is the most important part of the gym, dude, because legitimately when you first come into the gym, this is the first thing that people see. So making this presentable for all the incoming potential new members you can get, it's a really big step. So they have all their merch, all their pieces of equipment they sell to the public. And honestly, this is really well put together.   Yeah, he's gonna beat me.  This is how coaching works. I'm a backdoor motivator. He said he's gonna get 21, but I don't even bench press anymore.    I'm gonna get like 15 reps. He's gonna get 22, watch. 22, he's gonna break his PR. But why is he gonna break his PR? Because of my coaching. I've been training for 20 years. I don't want fifties for six. I don't want fifties for six.   Yeah, he got my dog.   I'm gonna get lit. Oh man, yo, Joe. The wager is me so. It's over dude, it's over. The wagering my dog bro, it's over bro. I'm gonna get lit. I'm bringing it out, dude. Dude, Mike's not ready for this dude. He's warming up, bro. He needs to warm up. I just front squatting. You want me to just, what are you doing? How about you, I'm 12? I'm gonna get lit, bro. I'm 12. I get to choose your music, and you get to choose mine. All right, all right, all right.  Oh god. It's warming up, I'm already warm, I'm already warm. Oh god. Damn, really, what was up with this dude? That's crazy. I hope that Apple Watch has a booster and a little turbo charged nitrous. Your wrist don't need it. Wait, babe, babe, babe, babe. I gotta make my drop, bro. Yeah, I have my dog on the line, dude. Oh my god. I'm about to go Super Saiyan, bro. Oh my god. Dude, I don't know if I'm gonna start crying, bro. I'm gonna wait for the drop, hold up. Daddy, you picked my favorite song, too, bro. You put my favorite song on. Come on, Nico. Hey, 22, 22, let's go. Hey, let's go, let's go, let's go, let's go.  Yo, that was hard. I got 18, bro. I couldn't finish the 19th rep. That was hard, that was hard.  Was that 19? Yeah, 19. All right, go choose the music. Have Cal hope you.  I got like 15, it's 15. It's not bad. If I go 15 now, I'm keeping up with the best in the world. Let's go, come on, let's go. One, two, three, four, don't slow down. Five, six, seven, eight, nine, 10, 11, 12, 13, let's go. 14, 15, 16, 15, 16, 15, 15, 15, 15, 15, 15, 15, 15. 17, come on, 18, 15, that's respect right there, bro.  He still got it, bro. Dude, he still got it. It's at least two reps. And I got a new poodle. Oh God. Oh, oh man, my wrist, bro.  God damn, bro.  My chest is on fire right now. Yeah, I'm gonna actually bench now. You're fucked. Have I actually trained your fuck?


So if thing works, yes, it does. Thank you for the introduction. So in fiction in the 1960s, there was a James Bond episode called From Russia with Love, a very appropriate title. And even better, in the core of the scenario was about trying to recover a lector. A lector was a, well, Sovietic at the time, not Russian, encryption device. So there is a scene where you have James Bond who is listening to a description of this device. He chooses rotors and everything, all this old fashioned stuff. And you have these guys, cryptographers from MI5 or 6 I never remember. And they are trying to use this information to recover how this lector works. Reality is a bit less impressive. Instead of sending guys overseas and have them listen to pretty KGB agents, you look at a PDF file. And on this PDF file, you have this kind of stuff. So you just look at them, and you squint for several months, and eventually hopefully you get some results. This is pi, the S-box of the last two Russian standards. So you have a block cipher called kuznetchik, which means grasshopper. And a hash function called StreeBog. Both use the same S-box. It operates on 8 bits. It's a permutation. It's differentially linear properties are fine. They're a bit better than what you would expect from a random permutation on 8 bits. But what we don't know is how it was made. The only thing you need to implement an S-box is its lookup table. And that's the only information that its designers provided. This obviously begs the question of how did they design it. So first, I'm going to give a brief reminder about the things we knew about this S-box up to that point. So some results which I have established with my then colleagues from Luxembourg, and also the tiny bits of information provided by the designers. And then I'm going to present what I claim to be its actual structure. So the one which its designers used on purpose. And finally, I will explain why I don't like that structure. So in the first place, we found this decomposition of pi. So that's when I was in Luxembourg. I worked on this with Alex Biryukov and Alex Udovenko. And we managed, using techniques I'm not going to go into, to rewrite this permutation in this way. It's ugly. Let's not beat around the bush. It is very ugly. But it helps with the hardware implementation. So when we ended up with this first decomposition, we were mostly puzzled. Also because this component has the worst differential uniformity you could imagine. This part, I call it t. This part, I call it u. So in the following, when I talk about the tu decomposition, it's this decomposition. We were not very happy with this decomposition. So we made a bit of detour. We had a look at an S-box from Belarus and realized that it was built like a logarithm, and that it actually looked a lot like the Russian one. And we also established that the Russian one could actually be written like a kind of logarithm, a discrete logarithm composed with a weird function, a weird permutation, which is extremely weak from a cryptographic standpoint. So it's not something you would expect from a random permutation. But it's really not satisfactory. We knew there was something to be found, but we couldn't find it. So this we published at TOSC also. And in this TOSC paper, we wrote this in our conclusion. So the important parts are in red. We think it's more likely that each of these decompositions, so the tu decomposition and the log-based one, is a consequence of a strong algebraic structure. Still, this master decomposition from which the other would be consequences remains elusive. And at that time, we thought the only way we could actually recover this decomposition would be if the designers of these algorithms, so basically the Russian secret service, would tell us. The little information they did provide because they are trying to convince people to standardize these algorithms. So Strybog is already an ISO standard. Kuznetchik is being considered for standardization by ISO. Both of them are RFCs. So their designers do try to advertise them. And in one of such talk, you have one of the designers of Kuznetchik, which explained how they built their S-box. So here we have two successive slides. It's the same except the second box is in red, which I think means that it's the important part. It's about how they built their S-box. The first box here and here is about a possible way of building S-boxes by selecting them from known classes. This gives you the best cryptographic properties so differential uniformity linearity. It has an obvious analytical structure. And you can use, for instance, the finite field inversion, which is indeed a perfectly valid way of building your S-boxes. That's how they are made in the AES. The second box, which turns into red, is about a random search with a given limit on the parameters. It's not clear to me what this limit might be. And such S-boxes do not have optimal properties. They don't have the best differential and linear properties. But they also do not have a pronounced analytical structure, which, again, is true. And people do use such S-boxes for such reasons. So there is nothing wrong here. The part which I personally find quite funny is that they left out the first option because it has an obvious analytical structure and preferred the second one because it does not have a pronounced analytical structure. Well, actually, what I'm going to show is that it has an extremely pronounced and an analytical structure. Cryptographers have tried to discuss with the designers because they go to conferences sometimes. So Marco Johann Nisarinen and his co-author for WorldBob, which was a Caesar candidate based on Srebog, they had a short discussion with the designers of these algorithms. And the designers said that they had used some randomization using various building blocks and that this was seen as an effective countermeasure against yet unknown attacks, which is coherent with the content of the previous slide. At ISO, what they say is that they did not use the TOD composition to design their algorithm, their S-box, which I think is true, that their aim was to have the best possible and linear, the best possible differential and linear properties obtained from some random search, which they do not explain. And they also say that before the SHA-3 competition, we didn't really care about the origin of parameters. And so the Srebog designers didn't care either. And so they don't feel too bad about the fact that they lost the generation algorithm. So at that point, they claim to have lost the generation algorithm and that they don't really mind because at the time when they designed it, people didn't really care about the origin of parameters. This is not true. Even in 1985, people were already designing block ciphers with very careful explanations about their generation process for their S-boxes. So I'm a bit puzzled by this statement. And then at a small workshop called Crossfire, there was a Russian cryptographer that presented Kuznetchik. Unfortunately for them, Maria was the session chair and could ask them some questions about their design process. And they avoided the question and eventually said that they had used the TOD composition to design their S-box, which no, they didn't, I think. So at that point, we have two decompositions which we are not really happy with. And we have some contradictory statements by the designers and also some really wild statement by the designers like this is, well, I'm supposed to be polite. So now I'm going to present what I found and what I described in this TOSC paper, which is what I think is the actual structure. So before I go into how I found it, just a bit of math. The final field with two m elements, so there should be only one m, but a two before, can be written in this way, except for zero. So that's just the final field logarithm. And because of this, you can partition the states in this way. So you take the union for all i's of alpha to the power i, where alpha is the generator of the multiplicative subgroup. This is the multiplication. And then if you put aside the case i equal to zero, which is just the subfield, then you get this description of the final field as a union of vector spaces, but not quite vector spaces because this don't contain zero, but almost vector spaces. Since the subfield is a vector space of dimension m in the final field of dimension 2m, you can also find another subspace of the same dimension such that the union of the two will span the whole state. So you can also write the final field in this way. So it's going to be the union for all these w's of the additive coset of the subfield. And then if you put aside the case where you have the element zero here, you end up with this partition of the final field. What's important is that in both cases, you have partitions with a set of size 2 to the m. And 2 to the m sets of size 2 to the m minus 1. And everything is linear. It's important because the pi interacts with this partition. First, some words about how I actually found this structure. So for reasons that are completely unrelated to any of this, I worked on an algorithm which looks for vector spaces in a set of elements. And one nice application of this algorithm is that it can allow you to look for spaces of a given dimension that go through a permutation and are mapped to other spaces. So you have an affine space in the input. And when you apply the permutation, you have an affine space in the output. And you can look for all of those. So I was very happy because I thought I had a nice way to test this algorithm because I knew that in pi, there was one such transition. If you set this branch to 0, this is a multiplexer which selects the output of this component when this one is equal to 0 and this one otherwise. So basically, you have that when this guy takes all possible values, here you get a vector space of dimension 4 and here a vector space of dimension 4. So I was expecting to find one such transition. But actually, I found two. So I had completely forgotten about this box and I had moved on with my life, but I shouldn't have. And now I was back working on pi again. And so what I realized is that this second pattern could be generalized to look not at really vector spaces but almost spaces where you have removed the 0. So if you fix a value here, when this guy takes all possible values except 0, you get a vector space at the top because the multiplication by a constant is linear and a vector space at the bottom, well, and a fine space at the bottom. And you have 16 such weird transitions. So this is the situation. We have the final field, the image of the final field, which is the final field itself. And you have one vector space which is sent to some of fine space and another vector space which is sent to another fine space. So that's what I had found with my algorithm. And the combination of these two space, together, they span the whole finite field and you have the same here. When I realized this, I felt really stupid because I had been looking at pi for three years at that point and I knew about this set and this set that they existed and interacted with the S-box. And I never realized that they were the subfield. So when I realized that, I banged my head out of the wall and then worked further. And then I realized that this other vector space in the input was a multiplicative coset of the subfield. And in the output, you had something which was indirect sum with the subfield. And when you look at the other multiplicative subsets, the other multiplicative cosets of the subfield and the additive cosets of the subfield in the output, pi maps one to the other. So pi maps the partition of the field into its multiplicative cosets of the subfield to its partition into additive cosets of the subfield. The random S-box pi does this. Actually, you can write it in this way. So that's what I called a TK log because the designers of Kuznichik are the TK26. And it's kind of a logarithm. So you need an affine function and a small permutation of the exponents of the subfield and the generator, and then it works like this. I'm not going to go into too much details. It map, it always, so such permutations and pi in particular always satisfies some set equalities, namely these. But what is important is that it has a kind of separation property. So if you have that your input is in a given multiplicative coset, it will always be in the same additive coset because when you change j here, you change the j here, and so where it only changes where you are in this set. The additive coset doesn't change. At the same time, if you fix j and you change the multiplicative coset, you will be at the same spot in the additive coset, you will just change the additive coset. If S depended on i somehow, you would still have this coset to coset property. It's not the case. So pi does not just map these multiplicative cosets to additive cosets, it's even simpler. It could do this in a more complicated way. It doesn't. Also, we can prove, and I'm not going to go over that, that this TK log structure explains both of the previous decompositions. The relationship between the TO decomposition and this log-based decomposition was extremely unclear to us. We were really puzzled by this thing. This decomposition explains it. Now, why don't I like this? I'm going to have to tell you about the work of someone else, namely Arnaud Bagné. My apologies. So in his PhD thesis, he introduced a way to introduce backdoors in a block cipher, which was a generalization of previous works by Kenny Patterson on these imprimitive S boxes on the DES that you could put in the DES. And what he proved is that if you want to have a backdoor where you have a partition of the input space into a fine spaces and a partition of the output into a fine spaces, if you want this partition to be preserved so that two elements in the same VI end up in the same WI all the time, then you had to have this kind of property at the S box level. So the S box has to map a partition of the space into a fine spaces, subspaces, to a partition of the space into a fine subspaces. And if you write it with boxes, like I always do, and always with a T and a U, this is what you need. So if you want to build a backdoor of the specific type, then you need an S box which looks like this. And in particular, if you write it formally, what it means is that you need to have an S box which maps additive cosets of a subspace to additive cosets of a subspace. So that's what he established. So yeah, what he established is that the S box has to map additive cosets to additive cosets. That's not what we have here. Pi maps multiplicative cosets to additive cosets. But it's not that simple either. Because when you look specifically at StreeBog, the linear layer interacts with both additive cosets and multiplicative cosets of the subfield. So that's something else the designers did not explain. When they designed StreeBog, they have a small internal block cipher, and this internal block cipher uses a mixed column-like operation. And it's specified by its binary matrix. So matrix. So this is the specification. If you write the binary matrix as a picture, this is what you get. And there are some obvious patterns here. It's actually just an 8 by 8 matrix of the subfield. Why they didn't say so? I don't know, because there is nothing wrong with that. What's funnier is that it's defined in the same field with the same polynomial as pi. So if you take a vector of this shape, you just have one element, x, which is in the subfield, and everything else is equal to 0. When you apply this binary matrix to the vector, you get elements that are going to iterate through a multiplicative cosets of the subfield. So if x is in the subfield and is going looping over the subfield, each cell of the output vector after multiplication by this matrix are going to iterate over multiplicative cosets of the subfield. So two open problems, pretty obvious ones. First, how was L built? It's MDS. But what else can we say? I mean, this guy is equal to this guy, and this guy is equal to this guy. Can this tell us what kind of structure it has? And obviously, can we leverage these properties to actually attack Strybog, sorry, or also Kuznichik? So in the case of Kuznichik, you also have a similar situation, except they were kind enough to actually provide the matrix in this case, and it's a different polynomial that defines the field. So you don't have this kind of stuff in Kuznichik. But you still have the same S-box with the same very strong algebraic structure, which is supposed to be random. So some natural questions that you may ask yourselves after seeing this. That's one I get asked a lot, actually. Isn't it always possible to find a decomposition of a permutation? Well, the answer is simple. It's no. If you generate a permutation at random and you give it to me, I won't be able to say anything other than that it looks random. If we can actually find a structure, it's really a strong indication that the design process was not random. Is there anything wrong with log-based S-boxes? Because other people use them. There's nothing wrong with using a logarithm, but it's not what's happening here. It's not just a logarithm. It's a logarithm which maps the field to itself, not to the integers. It can be seen as the composition of a logarithm and then something which sends back the integers over the finite field. And also in the case of 3-bug, it interacts in a very non-trivial way with the linear layer. So that's why I don't like it. And this is the third decomposition we have, like, won't there be a fourth or a fifth one at some point? To answer this one, I need to do some combinatorics. So you have 2 to the 1,684 roughly 8-bit permutations. You have 2 to the 83 tK logs. And to put this number into perspective, you have about 2 to the 70 affine permutations. So if someone were to give you an affine permutation and tell you that they had generated it using a random permutation generator, you would probably not believe them and believe that there is some sort of bias into their generation algorithm. It's the same here. That's why I claim that the presence of this structure was deliberate. And that's what the designers actually intended. If you want to design an S-box with properties that are really similar to pi, the generation algorithm is very simple. You just pick a tK log at random. You check if it's linearity and differential informity are the best possible for a tK log. If it's the case, then you output it, then you're happy. If not, you generate another. It finishes pretty quickly. You just need to generate about 2 to the power 11 random tK logs, and you will find one. However, so the result of such an algorithm will really look like pi. However, it's never better than a regular logarithm. So if you just take a plain discrete log, the differential uniformity and linearity will be the same, and you will actually have fewer of these coefficients in the DDTLAT. So it's an epsilon better. Pi is an epsilon worse than a discrete log. So the reason to use a tK log instead of a logarithm is not an improvement of the cryptographic properties. And so in conclusion, so if you want to convince your friends that, I mean, if you want to talk about the decomposition of this S-box with your friends who might not be cryptographers, I have written a note where I intended to vulgarize this result. So it's at this address. I claim that the tK log structure in pi, and I hope I have convinced you, was a deliberate choice by its designers. That's what they intended to do. Why? I don't know, but that's what they intended to do. And it really looks like a structure which is known to yell the backdoor. I have not found an attack against TRIBOG using this property. To be clear, I have not found such an attack. I'm not saying there is none. I have not found it. However, until the designers of TRIBOG and Kuznichik explained properly how their random generation process could output an S-box mapping cosets of the subfield to cosets of the subfield in the same field as the one used to build the linear layer of their hash function and why that might be a good thing, I don't think we should use these algorithms. And I don't think we should standardize them. I'm looking at ISO when I'm saying this, like representatives of ISO. I know that next week they are going to discuss standardizing Kuznichik. I think it's a horrible idea. Thank you. Questions or comments? Yes. Here. Thank you. Do you think there's something to learn about invariants, more variants of invariant subspace attacks exploiting these kind of properties? If I were to try to exploit these properties, that's the way I would go, yes. It's really reminiscent of these invariant properties. But this kind of partition is typically, I mean, it doesn't remind me of any of the functions of the attacks that Gregor presented on Monday, so that it might be a new variant or... Yes, that's the way I see it. I agree. Thank you for your talk. You indicated that it's easy to find the one with the best differential linear properties in this space. How did you find the bound for this? Experimentally. Maybe there is a way to really obtain them with the proper pencil paper argument. I didn't do that. I generated a lot. And I saw that they could not improve the bounds. Actually, I have my experimental results here. So this is not just the differential uniformity and linearity, it's a bit finer grained. So the higher you get on this axis, the higher you go, the least likely your linear properties are, and in particular, the lower your linearity is, the higher you go. It's a bit finer grained because it also counts the number of occurrences of this maximum coefficient. And here is the same for the differential uniformity. So when you generate TK logs, you usually end up in here, under my pointer here, and you have some cases where, which correspond to about 1,000 of them, which end up around this spot. But you would need to go much higher than this to get something with a lower linearity and much further to get something with a lower differential uniformity. So maybe there is one specific combination of these two components, so the S and the kappa that you need to define the TK log. Maybe there is one specific instance which will lower these quantities, but using just a randomized search, you're not going to find them. Any other question or comments to leave? Okay, if not, let's thanks Leo again.


Hello and welcome back to the craft box. My name is Brenton today. We're in episode 118 The Wizard 101 death walkthrough last episode if you haven't checked it out already. We entered Avalon and Talked to things and stuff and did things and today we're starting by talking to Fieny Yellowknife What have we here? You say Sir Pike has a wound that will not heal. That is a dark sign Seek out the night goblin to a prowling the high road and make them tell you the name of the one who wounded Sir Pike Okay, um, let us try and do this first try These guys are death, which is kind of annoying, but it'll be fine. Should be good Yee hopefully Again if you didn't watch last year, so we got Dr. Vaughn and before we went into Avalon I that video won't be posted until a couple of weeks But yeah, I did get it just so I will be using it most likely But until then you won't see that I've got it You won't see the video come up. Yeah, that makes sense. Yeah, sure Okay, what's he gonna do?  Don't get hit as much.  Oh right. Hello. They also love this spell as well Love it so much Nothing, that's cool. And let's see. Do we get a thing involved? Prism? No, we didn't. Okay, that's perfect. We can Want it? It's making it way too easy for us, you know This game loves us today, which is good Here we go. What's this? That's good. This is a blade and this is probably a faint. Okay, cool Okay, vampire Okay, boring you're not gonna do much Okay, that did quite a bit, but there's some faint Critical. Okay, nothing. That's fine. That would have only done 50 if we didn't if we blocked but that's cool And hit we're getting all of that health back. They don't even have fortify. They spam fortify usually So I'm really surprised that that one didn't crit said face Kind of sad, but that's cool. Boop. He did. Bye Full health. Yay Bye. There we go. Amazing full health. Stop your spell work. You want the worm? Caranac, the fire spitter. Okay, let's talk to Fianna.  I'm young and a mark just because why not For some reason I feel like the music is really quiet.  Who knows? Okay Let's put a couple of faints in and a couple of TC blades There is blistering inside like the inside of a Smith's furnace. You hear the horrible fire spitter up ahead Okay, we need one of you we will put in Some extra blades just in case I don't know how much healthy hairs or if he cheats So we're gonna find out Just a sec Hopefully it should be fine. I mean, yeah YOLO Maybe we can use dr. Vaughan if we um if we don't kill him first try he's 12,000 that's pretty impressive that is pretty impressive Okay, it's a little pirate. Nice. We start there critical. That's an even better start. Jeez. They start to crit a lot here I Swear this music is part of part when I want as well Don't know where but I just feel like it is. I Know the Celestia one is because that's in the um spiral thread, but pretty sure this is as well Maybe in Skull Island. No It's not what it sounds like I can't remember But it definitely sounds very familiar. We're not getting anything we need which is bad Luckily, he's fire so he can't earthquake He might a fruit, but I can't earthquake. We've got a wanted just in case and Yeah, I have actually never been a fruited So there's always a first time for everything.  Yes nice Just need Two more blades, I think or one more one two Finally we can enchant you. What do we have we have a Two yo, we just need two more blades I'm just gonna pass because there's nothing we can do. This is an a fruit.  I'm surprised Jesus Christ We're going to discard the yellow Okay, what's this? Gay Slowly running out of health. Yay. This could be our first death in a while Gonna blade again still don't have a Prism, which is what I'm looking for Yikes, I should have probably just cut of my spirit blade, but it's fine. That's fine. We'll just yolo kind of keen Yolo haven't used a spouse at Yolo We're just gonna do it. I'm just gonna do it man. We can just as well. This is probably gonna do a lot Also since we're not first, you never know what he's gonna do. So I thought I'd just best to get some health And then we can always just bled up again for the other dude Who doesn't have as much health so saying you but suffer fortify No, no the first time is a fizzle That must be It must want us to hit with dr. Vom to came up again Okay, we get it you fortified already. You don't need to do it twice in a row. Jeez Haha First time casting this spell. Yeah, boy She this is my first time ever casting this spell. Yeah Okay This is actually a really cool spell it takes forever though Didn't create that top sitting Kind of sad, but we should hopefully do No, so close to killing so close But we got full health nearly full health. So full health. Yeah full health. So that's good. So close. Look at that He's got 1,000 health left. Okay Yeah, we can hit any we're full so it's fine, but we're just gonna play twice and then Prison and we should hopefully kill which is good. They actually have a lot of health now I might have to start carrying TC feints, I think Because these bosses get quite heavy or I could just don't to like I did for this one I mean, it doesn't matter really, but means I get to use some Dr. Vom a bit more which is nice because I really like this fellow. It's quite simple, but like effective I actually does a lot of damage as well. So yeah and gives health. So it's like fantastic Okay, just get another blade up and then we should be able to kill just because he's got a cheeky we fortify and they can Save a bit and I only have one prison. So put it to good use That makes sense Boom. Okay, we get it. You're getting health. You don't need it. Oh, okay. Bye Okay, race takes forever so many death spells just take so long to cast it's kind of annoying But you know what it's fine Could be we could be Rad or forest lorded and they could be more people so I'm not going to complain because that would be a long time I was actually expecting him to meet you which is good Because it doesn't do much. Oh, yeah, the fortify right now. As long as he doesn't refresh it should be fine We should hopefully kill.  We should do Usually Hopefully we've got We're fizzling so much.  We got debt power put but not debt accuracy One will be complaining about accurate of power pips and the next we're complaining about accuracy. What?  You are careful not to get any on you Okay, let us hit on bike to Vienna That wasn't actually too bad That's a venom will do nicely To prepare the salve I need some bulbs of ale blanc a medicinal plant with wondrous properties, please fetch me some Okay, I'll let us collect some of this just randomly on the road because that makes sense I'll be long Something white if my French is correct. I don't know what ale is but looks like garlic Or something so might be garlic who knows Didn't really focus in French. I Kind of hated it at the end Great language great culture. Just you know teaches a bit. Okay, Vienna. Hello Ah that's a miracle clove must be garlic To crush the ale blanc and make the salve I'll need my mortar and pestle I lost them to hobgoblin fiend in the area get them. Okay, I'll be back once I have the mortar and pestle Okay, I am back. That was first time not too hard. I think the defeat the defeating click quests and have a lot of very very much Better than it was a firing solicitor. You got them back. I'm sure the fiends were crushed There I've made the strongest antidote. I can Hurry to Sir Pike and tell him to apply this salve to his wounds. It will neutralize the venom at once okay, um So yeah, I think they kind of realize that the fin click quests are boring or something and Up the of the chance and I just made it far better You got the south Whoa, he's standing up. Whoa, man. Whoa, dude. Oh That feels much better The great wizard Merle Ambrose sent you to seek young Perry the great wizard Merle Ambrose sent you to seek young Perry Perry is now a white bearded knight. He lives along the high road But I'm not sure where Sumner field gold would know he is a merchant and knows of the high road. Well What is done on the bay you greeting so we I Scribe a Francis locks who works in the standing tower in Abbey Road can tell you about it. Speak to him to learn more Don't know what that means. But okay. We are going to talk to Sumner Be still my beating heart a wizard come to save us Sir Pike saved me from the froudlings But we lost several bags of grain that are desperately needed here Can you find the bags of grain in the high road and bring them back once the supplies are secured? I'll help you find sir Perry easy peasy. It's for a lot of them I just need to remember which way it was that way There's nothing need a room but which way is to I heard I really get lost never on I get really lost I don't know where things are just doing the thumbnail took me like 20 minutes to try and figure out where I was coming That was a struggle geez But yeah, we managed to do it sex of grain, okay Just realize what we were doing here as well. I am completely delusional. I swear Let us Think about this But I'm bum bum bum bum The music in Evalon is so good. I love it. It's like a gem gem and a half. I would say Okay, that's two Quickly grab this one before they come Whoo cheeky three Four in fact five Six let's go back to Caliban And go back to summer not too bad. There's a lot of like the quests and um Avalon actually really nice. I really do enjoy them. I think it's Yeah, I just really enjoy Evalon as a word in general and lots of people do now the good folk here will be able to weather a hard season Let me help you find Sir Perry Gilliam his cottages on the high road a short way past the wood witch Viana yellow knife Okay, let us go and talk to superior and then I think we will end off the episode he as funny as like question mark above him was like Probably the same size as him, which is really funny. I find that kind of funny But he let us go and find Sir Perry. He is just further down Here from memory And we're not gonna get pulled because that would be bad And because I don't have prisms in Yeah, here he is. Hello The fury in would own myself pray and consume day. Oh wait, you're not a red-thorn badger I've heard stories of a young heroic wizard who defeated Karanak for horrid fire spitter Might you be the one in the same if you can prove yourself? I'll help with the noble quest to find the sword The fire spitter spawn must be vanquished. They've given a poison well near her cave do this and Okay, so in between episodes I will defeat the fire spitter spawn So, yeah, thank you for watching next episode. So we will continue on With high road. I believe I think we'll be we'll wrap up high road. In fact, it's not too long of an area Which is cool. Um piano also tells reagents, which is cool But yeah, anyway, thank you for watching on to leave a like and subscribe and if you're very subscribed Priscilla little bells, you know exactly when I post another video and remember craft outside the box