Updates on Poseidon

Transcript

Hello. We're going to start uh a session on Syon. Well, we've had an entire hour. Um I don't know if we uh used in full. Actually, originally we envisioned this session to be more like human day and probably it was to be but I decided to prepare like just a couple of slides to introduce you uh to the story of it's last time story and to be able to see some updates are they shocking updates like probably not shocking updates just regular updates and uh well how it all started actually the back into 2016 there was an

idea to uh create hash function uh which is kind of friendly in new scenarios. So at that time it was invented new hash functions for FHE or for APC later for uh zero knowledge proofs for very simple circuits and it was quickly realized that uh for a good hash function for hash function friendly to uh proofs you need a very kind of clean and compact algebraic structure. And this idea was in big contrast to this uh idea of existing hash functions like standard ones like CH 2 and SH 3 because when

they were designed the intention was to get rid of any possible structure well as much as possible in particular from any algebraic structure because there were like some broken in the past but this area uh quickly evolved and Poseidon and rescue were designed shortly after Afterwards there were several uh followups u I didn't actually feature the very recent designs that was skyscraper there's of two versions there binary t4 and and so on mark 32 all these designs so this is picture so how it start

well uh to entertain you a little bit so in summer 2018 someone recommended to me like a paper on on stars and that I had no idea about I didn't have any clue how this works but in the appendix to the start paper there was a special hash function designed by a he took it from somewhere and it was like as based uh it used some wider state uh but the thing is that particular hash function based on as it was insecure and we knew that it wasn't secure because it was exposed like 10 years ago but back at the Well, this kind of insecurity was not made public because no one believed that there were one would use a as a hash

function. So, it was difficult for decision to publish a research in that and that remained kind of uh hidden. uh but al suggested uh several cryp analysts and designers to design a new hash and we started work on that and announced it preliminary on def but it took us several more months to come uh with a full proposal and we published a full paper uh like more than six years ago really uh and it was presented at conference next year in 2020 uh well this uh design of asylum was uh well start asked several teams to design a new hash. There was also designing the

rescue hash function and in 2020 a starter run some kind of a hash competition to figure out which hash function is the best and they did not select Poseidon because they thought that rescue is better. Well, the story is maybe they didn't select Poseidon at that time but since they selected it later we knew that they kind of changed their changed their mind. Um and uh yeah after that um Poseidon started being used more and more uh well we announced first headbound program in 2021. Uh two years later we kind of optimized asylum a

little bit uh to be used over small fields and to use more efficient linear layers. And people ask more and more well if Poseidon is used everywhere why should we avoid using it and indeed uh since it has become a detective standard uh as a z friendly hash function u and it's actually well I forgot to put this on the slide but quite recently uh Google has released u metrics over the last five years of kind of all cited papers and one can look into the cited cryptographic papers that were published in the last five years and I'm proud to say that Poseidon is the second one.

>> Uh anyone >> so what could guess who's the first guess? >> No >> yes Marlin. Uh so we are kind of short. So Marlin is like 600 stations in 550 something. Um, okay. So, Poseidon has a very simple structure. Well, it's simple to me because I've seen it thousands of times. I don't know, maybe you've seen in the first time it's not so obvious, but basically the idea is this principle uh well known in symmetric crypto that you should confuse your uh state

applying some uh nonlinear transformation like box. In our case, it's It's a power mapping denoted by S. Uh and alternate this power mappings with some diffusion layers and diffusion layers are supposed to kind of diffuse data the entropy uh to different parts of the state. And you see this kind of this alternation like S boxes and M is matrix multiplication linear layer for diffusion. This goes uh several rounds. So in Poseidon there is this structure basically that um in the first rounds of Poseidon we apply power mappings to each part element of

the state whereas later we apply it only to middle ones. Uh the reason is that in order to protect from classical cryptographic attacks so called differential crypto analysis we need this full layers because only for full layers this argument about protection against differential attack works. Uh on the other hand the second group of attacks so called algebraic attacks which exploit uh well low degree of polomials representing the entire scheme they are prevented by accumulating large enough degree. So basically when when you look uh into the uh any output word as a polomial of input words so this

polomial should have high degree but for it to have high degree you don't have to have this boxes everywhere you just have to like uh put them one after another so that the degree accumulates and this mixture uh it allows both protection against different kind of attacks and But at the same time, it's still well fast enough because there's some balance between the number of S boxes and the number of rounds. And after all, it's still kind of ZK friendly enough. Well, it may not be like super well kind of the best in terms of small circuit size, but it's kind of as uh the history

shows, it's good enough. It's good enough in all the aspect. It's fast enough and it's fast enough in native and fast enough in uh circuits. So application two uh and it can be used with uh for for short hashings I mean for hashes with short output or for long well for long mean some kind of uh random generation and is basically used into two different modes. I would like I probably have to expose it because you might have seen it in the code. In the code there are so called compression mode and the sponge

mode. So basically the compression mode is terribly simple modest operation. Basically it says that if you have any bjection transformation P uh which is denoted uh which is depicted at the right and if you have any transformation which is bject can be for example block cycle call. If you add the feedback, if you just sort or add in the field uh the inputs to the output like element wise, then this thing becomes one way. So if you don't bother about compressing things, if you just need one, then this feedback is is a simple thing to achieve uh one maintenance and in many cases since uh default state is like 500 of

7685, it's enough many usages because you can also truncate the output of course as much as you want. Well to prevent collisions you don't have to truncate smaller to to smaller than 256 bits. Uh so it means like half or one/ird of a state but for tremendously many applications just the simple compression mode is good enough. So even though was designed to be used uh in a sponge mode the sponge hash function in fact now in many applications we don't have to run this sponge run it only when we uh have to absorb have to hash long strings but in many applications they don't really

have to. So for example in this in lin signatures we hash long inputs only in one case when we hash the chain ends into a leaf of a mer tree that's the only case we need the sponge and even in that case we could implement it just the compression mode by just calling arranging the hash calls as a tree. So um further on uh what well we have said that it's good to uh have uh PID uh inside Ethereum very simplic Ethereum layers and then implications around Ethereum uh but we haven't said is secure and well in for example in terms

of provable security how we understand it there is no provable security for hash fun like almost nothing there exists some proofs of security proofs for so-called modes of operation like to state that spot mode is a secure mode of operation But it assumes that inside the sponge must be some randomly generated permutation which is in our case it's not really true. Uh and the only way in symmetric crypto to uh get uh kind of uh security to to declare block cipher hash fun secure is through third party scrutiny. Basically we uh all the cryptoisters in the world must have tried must try to break it and they must

fail. After that we can't say well we are confident that it's cure but it's still not really nicely formalizable statement unfortunately and that's why when we write new hash function papers it's very difficult to have good definitions there because well we cannot meaningfully say what we uh mean by its security. Well in some cases when hash function is key. You can do this. But when it's just kind of for collision resistance, even just formalizing collision resistance is not trivial.

And uh well, there are several ways to increase our confidence. >> A quick question, how many analysis are there in the world? And what percentage would you say have had a good look at? Well to count crypto as well we can look at this for example authors of uh FC conference FC workshop which is this primary venue for symmetric cryptographers I don't know well one 200s probably how many of them looked I don't know I bet a quarter did I'm pretty sure a quarter did and I think a good quarter did so historically uh most of analysts uh have been in Europe now there is another center in Singapore

with very strong uh professors there. But I think in Europe we have touched everyone. So we really have approached every single person even if they retired and do just fish and we just came and said you kind of for outside and well not all professors kind of solid professors have looked but well for us it's enough that they are GC students. So as I stated basically we have several ways to increase our confidence and uh we we write uh and publish papers uh we provide boundaries for reduced versions

and see if attacks on reduced versions behave as we expect. We incentivize the side of different attacks. We arrange workshops basically uh do this all things. uh this is uh the way to increase our so yeah and uh in in pre uh in previous year there was a decision to run a so-called Poseidon initiative for to track and increase confidence in particular Poseidon hash function and decide whether it's good to use in various components of Ethereum and right now uh what we currently think it's can be of good use for the

consensus layer for for signatures for the state layer. I think the now the consensus that we don't have to use it uh because the current functions are good enough even if you use narify the state but well this may change in the future I think uh yes u okay um so initiative well we declared that it should last for two years um and the group inside uh Antonio George and myself trying to have all these uh activities going on. Yes, >> you just said that the current a

function output for the states. So this mean that potentially in the future we have then two hash function in total in Ethereum for state and for and maybe for other things. Is it a problem? Is it well probably not because I think we already have several hash functions, right? fors I'm not sure if the hash function in BLS is the same function for the state it is curve processing I think you just take a hash and do something with it and then call that thing curve I think that hash would be the same as the

hash okay follow. Yeah. >> Just have a very high level question. I'm not familiar so much with the hash function world, but if if you were going to sort of want to see some kind of theoretical result that comes out that makes you much more comfortable about the robustness of the security guarantees of the silence. What kind of result would that be? like what kind of thing would you see you know deep brain and say oh wow okay now I am much more certain that this is um you know completely selfassity of algebraic attacks so algebraic

attacks are prime prime primary attacks the most important text for algebraic friendly hash functions and There are several methods in particular government based attacks uh which are whose complexity is very difficult to estimate. So it has been historically a longstanding problem of the complexity of government based attack in particular when you apply it not to just random system but to more or less structured system of equations. If there are some new results about urban based tech complexity they would be particular lower bound ones. they would be of course very uh interested.

Um okay so the initiative is supposed to last two years and we had a good plan for this year. So to get to public boundaries and get practical attacks we announced several research directions where uh there was a gap regarding analysis or test analysis. uh we uh planned to have um a big exploratory regarding based attacks. So even if we didn't if we can't get theoretical estimating the complexity of government based attack we would still uh we plan to run like tons of experiments with different parameters and try to at least

extrapolate the complexities from small instances. We plan to issue awards to good papers that are not in the previous categories and organize workshops and retreats. I think that um well it went pretty well. So this is for example the uh breakdown of the budget. Uh so in total we had around 600k planned for this year and well for bounties kind of as expected. So half of the budget has been paid out uh because we designed them intentionally. So that's there are some really low hanging fruits there are some medium handling fruits and there are stop stuff and if everything has been if everything were broken it would

mean that we were wrong in estimating the complexity of this bounty instances but it turns out we were pretty right that gave us quite confidence. So grants we have uh uh kind of distributed enough. So there were several several competition. Some applications were discarded, some were granted. We made good use of money for workshops and travel. We we bought 35k machine for based experiments with two terabytes of RAM. So that's a good stuff that just starts working hopefully this month. Uh we haven't issued any awards because well there have not been have many papers that don't deal into the grand categories.

So for boundies uh you can see some details. So we published u bounties for poseidon over different fields and for for poseidon 31 there were like wall beware instances and m31 instances and you see that like small ones were claimed really quickly like there were like several instances that were claimed like really in the third very first day of publication. And in some cases there were like even competing teams that submitted first bounties solutions within an hour and we granted them both the amount pretty generous but you see like uh the bigger versions were not broken. So this

numbers that you see here 32bit 40 bit security is not something maybe what we traditionally understand for security of hash function doesn't mean that there are like 28 bit outputs rather not um it would be uh make a simple explanation probably imagine that like in total we have like 40 rounds suppose we have 40 rounds and there is a claim that 40 rounds means 128 bit of security then basically 32 bit means is quarter of 40 like 10 rounds or something. So we just kind of kind of cut a fraction if it's a fraction of the size of the fraction that corresponds to

the ratio like 40 over 1.8 means how how big a fraction can be practically broken. Yes. So so one question I did have about this. So I think in the bounty example uh all the constants you use were the ones in the original Prooseidon 2 implementation. for these randomly chosen matrices. And one thing that we've done in Py30 is tried to like optimize the exact choices of constants. But one risk of course is that moving from random constants to sort of chosen constants could potentially have a security risk. Do you have any sense of like sort of how much one should worry about using random constants versus picking constants to sort of improve performance? Uh that's actually a very good question. So on one hand there

there were examples of uh block ciphers and hash function that got broken because they used uh non-random constants but the the design themselves were not particularly good and I think uh we could have used non-random constants for example in SH 3 the constants are not random in SH 3 they're like small bit weight and I think we could also use uh small constants but in fact no one has told us it's kind of important for uh for z improvement because for native implementation doesn't really matter what the constant is >> oh no it's important for speed >> is you can you so we got that like a 2x speed up from 23 by using by choosing

constants >> oh yeah okay well then you should tell us which kind of constants are there >> yeah sorry I can talk to you later >> well uh if they are all like plus one then probably not but if they're like all different ones and like all powers of two. >> Oh, it's it's okay. Um I I mean I guess I wasn't going to talk about this, but we can stare at the three code, but it it turns out that for maybe their field, you can multiply by positive and negative inverse powers of two very efficiently. And so basically we chose constants such that the constants were either I think plus or minus 1 2 3 one one or two or three or inverse powers of two.

>> Oh wait, am I talking about matrices or addition constants? Uh these are the constants for the internal the matrix of the internal layer. Ah for m yeah matrices yes for matrices we uh kind of there are explicit uh for matrices there are no random constants anymore and besid too the constants are chosen to be like small weight and actually there is a sub routine there are several tests the matrix satisfy doesn't have to be just pulled yes matrix but it also must be kind of non-s singular in terms of it doesn't it's powers of this matrix must not have uh some subspace uh invar cases.

>> Yeah, I think we caugh you like so we check the test you were giving but like I think they're still potentially picking totally random constants does still slightly say like as long as they pass the test pass you're not completely confident. >> Yeah. Yeah. Well now we regard we do encourage that the constants are not random because it looks horribly and don't need it. I thought I originally that you you talk about addition constants but >> no no those less addition. >> Okay. But do you even have the option to change the constants? Like we have a standard and if you change the constants you break the standards.

>> The thing is there's no standard yet. We have been thinking about making it a standard for years but uh the there is kind of it wasn't even clear for which field should be the standard. So now that today but year ago it was not really clear. So if we empower the state size how how many state sizes do we need or like yeah but if we if we take one particular field and if we know that we need like I don't know operation 3 to one and two to one and that's enough then then yes we can standardize so for the bounties for next year and would it make sense to update the

bounties with the constants that are used in three or the ones maybe have some meeting after after that workshop where we figure out what is the constants or matrices that are of practical interest and then update or get to the bounds. Yeah, sure. That's a good plan. Another thing is uh we can also contact bound hunters directly and uh kind of give them the content and check if something changes. I'm kind of 99% sure nothing changes at all. Um I don't know for you for example for the graph method doesn't matter which kind of concept is there >> as long as the matrix is the same changes I script and the matrix is

passing the script >> so computationally wise does your attack become >> I have also a question about the run constants because I think that there are some that are formalized by your spec where you have a script that you generate in Sage like you provide some run constant. So we add it then to the Python spec and in pro3 you have the we added very recently the possibility to have this specific constant but there is also the possibility to have like a random generated constant. Is there like a tradeoff for security or stuff in generating this constant in random way?

this this round constants which are additive constants. Uh well the consensus is you can take any similarly random probably it's even okay to use non-reent ones but we haven't done any research and this ground hasn't been taken. Maybe if there is an idea if it brings any notable speed we should announce it better. Um how to generate this constant is a good question because for example right now we finalizing binary paper for binary fields and there has been a question how to generate and someone says oh we shall take it from the pine number someone says we should take it from sh someone we should take it from three or from any stream cycle we have actually no clues wise it doesn't matter but if for implementations it matters I ask you to

kind of stand up and say like we like have this because I don't know for example What the threat to do to have like a standard classical hash function uh which you know how to call or to have this constant generation to be uh so that you can in line basically so you don't have to use any library I have no no idea and feel free to suggest >> um uh I have a question about versus rescue and and marvelous. So, uh, in rescue there's this design principle that they want the Sbox like there's two S boxes. One of them is low degree in

one direction and one's low degree in the other direction and the side doesn't have this. Can you like explain what's going on and yeah, that's actually a nice thing. Well, uh, I don't have place to draw. It would take really much time to draw, but you can imagine. So we can think of like uh PIQ hash function where like the same structure but there boxes which are like uh roots like high degree power methods and these roots are supposed to be like in in some direction to be low degree but I think they don't the requirement is not exactly that

they're low degree in either direction the requirement is that the constraints algebraic constraints you generate for this Sboxes our flow degree and technically yes it doesn't really matter for for for constraints in which direction uh the degree is high but uh for some algebraic attacks it apparently does matter so for Poseidon the uh degree well now I'm not 100% confident what I'm saying but that's kind of my impression of how this attack works basically In Poseidon the uh degree grows uh in a straightforward way it increases from from top to bottom. Uh and when you try to break Poseidon with

grounder basis attack uh you do it only in one certain direction and you you cannot uh exploit uh kind of smaller parts of uh for better. So the like all the applications of government based attack are like straightforward and we can kind of predict how this attack work how these attacks work more or less whereas for rescue if uh in some directions the degree is low some is high but you can have constraints uh that all these constraints of are of low degree in fact into the government based attacks you put these constraints you don't put the this entire thing but you

put constraints into the government based tech because it finds a solution. It finds a solution satisfy this constraint. It's pretty much the same as uh breaking the thing. And it turns out that because in some uh directions the degree is low. This G for G based attacks it becomes possible to describe the side of the hash function in such a way that it's more friendly for a growing basis. And this friendliness it comes exactly from the fact that this degree growth is in in the wrong direction. So this uh there has been like a series of results called free lunch attacks from French team primarily uh which look into this into hash

functions like rescue or adimo and they do exploit the fact that in non-trivial direction the degree is low and they are able to to use it for good and growth based attack it doesn't break it completely but apparently security margin regarding based attacks It has decreased significantly since the introduction of of rescue. So when rescue was designed, everyone was confident that the government based attacks are like fall short of breaking. Now it's not the case anymore. So the security margin has lowered for from my perspective and it's not the case for for >> very interesting. Thanks.

>> Yeah. So for grants uh yeah we have announced 10 research topics and we granted several of them. So we have um grants granties from Luxembourg, Luren uh in Austria, Norway, Armenia and France. Uh some of them almost finished. So interesting. uh in two uh I think it's not the secret really anymore that uh in the uh run three and four researchers obtain pretty much the same result without knowing about each other and I think they even uh submitted uh the same result to uh your crypt I don't

know what what happened there so they decided not to know about the charter so I kind of I approached every team and said well uh there is a possibility that another team is doing the same as you do you want to know about it or not and they posted no so I kind of I kept them confidential uh but interesting thing that they kind of got the same result well it's not an kind of not not a breaking result but it's still kind of a nice theoretical result regarding the global based complexity kind of what we expected u so there have been like new papers published that are not part of the brands but in terms of breaking it there's no real progress I would say. Uh still they are kind of uh very nice and

some of them I think will uh qualify for an award uh in the end of the year. Um we have run several workshops. We had in January we had just a track in uh at so-called also uh it's middle of Austria ski friendly and so on but I got terrible headache there because of altitude. Uh so then we had uh dedicated workshops like one day in Rome, two days in Spain and just in two weeks there will be another workshop uh in Luxembourg. Um well we have like from 20 to 40 attendees at each workshop and this is actually quite good. So we

have some group work uh we have discussions we have collaborations u and so on. So a lot of uh young uh PhD students uh which is I think quite nice and I invite everyone to uh attend next workshops and what will happen in the future. So um we are now in the phase of uh discussing what we shall do in the next year. So the budget for the next year is not yet fixed. It's in discussion right now. So from my perspective what we really need we probably have to have like have a closer viewing within protocols of our interest in like good

example is uh lin signatures but there can be others. So if we think that some particular protocol This info for example like using it in recursive starts and starts u we can have a closer look if this uh protocols uh tells us uh the requirements of hash function which are not like just be a good random if there's something more granular than that we would happy to work with it and I think crypto analysts uh uh in the world they kind of they most Most of them they know there is like collision resistance and previous resistance and

not much more than that. So they and they try to find this kind of attacks but they don't know of attacks specific to particular protocols or when you use it in cashir or you use it for for m trees or or elsewhere. So I think uh there is some gap between the usage of a hash function in high level protocols and uh cryp analysts on the ground. So we want also I think better understanding of how to break attacks. I think we already have kind of part of this by the end of this year with the new results coming from from granties but we do want more. We do need more experiments to run particularly for

grabs. And uh the third thing is I think we need some sort of oblation report in the very end that summarizes uh the the initiative and the results and there should be some interpretation of course how we interpret all these activities because hopefully there will be no break but there must be someone basically to say that it's there has been no break and our confidence has increased so it shouldn't be just who stands up and say well I like to secure because clearly biased in all possible ways, but we do need to find some some way to kind of attract the to make the community speak uh of of the initiative and how it ends.

The particular form of how this should be done is not really decided yet and we are very open uh to suggestions. Um yeah, this can be detailed. I think uh we can declare new bounties. Uh so yeah there was one idea to have bounties with uh other constants. That's definitely not a problem. We just have to fix which console so that we don't declare too many boundaries. Uh I think we can declare also interesting bounties for usage of Pyon things. I've heard of this called so called uh zero test uh property. So basically the the challenge is to find the polomial such that if you

hash this polomial then the output hashes root of the same polomial. Well it's I formulated super simply but in fact it's little more complicated because the output is multivariable and you have to say what it means to be root but this is all solvable. Um, and I think that's that can be really nice targets for for analysts. If you if the protocol people think that it's kind of relevant or you may think of another test yeah postpand signatures uh is also interesting because we have the target collision resistance property uh and we have already widely declared that we

seek for cryp analysis cryp analyst crypto analysis in this scenario u but we haven't got any results Uh well, of course, Michelle uh ask we asked for grant proposals on some uh topics that we think are interesting and I think that we should ask more about resultant tax on based experiments and on quantum security because well we declare uh quantum resistance but in fact a lot of components even in symmetric crypto it's quantum security is not fully understood in particular uh provable security like one provable security I think the kind

of lacks uh behind the state of dark and plastics and like for the sponge construction if I understand correctly we don't have uh really tight uh uh bounds tight bounds for differentiability um well we shall organize other workshops because I think people are interested and there are kind of several potential venues We can do this. We can collocate this with the conference so we can make standalone ones. Uh we are open for proposals and yes uh well for final reports. Yeah there are several ideas how to how to run it. We can organize kind of paid event. We can we can

approach cryptographers. Well there are different things. Still we are brainstorming how to do this better. uh and eventually I hopefully by the end of the next year we we shall publish uh uh this report uh hopefully use it for good. Uh well this all items are of course kind of supposed to be part of the of the budget and with numbers being discussed uh these weeks I think uh but of course we welcome any ideas well I've in this area for several months looking deep into the and kind of my eye is blurred but maybe some outside the box ideas uh would be interesting here and that's actually my final slide uh Um

yeah, thank you questions. [Applause] So one other thing that you could I mean in terms of topics is one other thing that is probably could be done would be looking into if you can improve the security analysis for sign two rounds which >> well so so the way you pick number of rounds is you had in your paper like a careful analysis of like how many rounds

you need but I imagine that when you you did this initially like you know usually we want to be uh somewhat careful and take some upper bounds for because we don't want these to get broken. But if you can strengthen your analysis, you might be able to reduce the number of rounds of free speeds. >> Yeah. Yeah. Actually, one thing I wanted to mention because I forgot about this that uh in this algebraic analysis runs uh researchers have effectively established a new metric for Ger complexities and they calculate the so-called ideal degree. So when you formulate the krypton problem as a set of the normal equations then you can

compute the we can define what is the ideal and what's the degree and it turns out that uh all based attacks we know so far they're lower bounded by this ideal degree squared and if it's widely assumed it is the case for non attacks at least then uh we can apply this this uh bound to calculate the number of rounds and our preliminary estimates they show that in Poseidon 2 we actually overestimated the attacks so that like this for example 20 plus round partial rounds you see for koala bear uh that's maybe actually an overkill uh we don't I don't

think we shall even if it's true I don't think we shall reduce it because it can be good example that we have high margin but it's yeah that's result results not fully published this is uh just kind of fresh news about like boundaries for catching phmir set of polomials possibly you could think like I wanted to here and what's the simplest here that I can think of is just like you know it

could be a long zero vector and then I want to prove that it has to be zero. So I kind of the verifier is going to choose random locations and test that are all zero. So like breaking that would mean finding something that is far from zero any long that is far from zero and you hash it. You about the locations that the hash gives you like you know 100 random locations and those locations are zero. So if they manage to do something like that I would be very w this is the basic we can simulate some random test random objects and when you say you

commit to the strings does mean you commit like bit twice you spend like a hash one hash per bit or you commit to it in entirety >> yeah I don't know so we don't really need a method three for this >> yeah because tree is big but If you just take a field element and you commit it then kind of uh algebraically it's you can't really distinguish uh between like how how what it means to be close to zero like in the field it's not uh so hashing many tous field elements and then use the hash to get you like a 100 samples and how how like can you find a vector which is like

mostly non zero but those hundreds samples all zero Yeah, that that does make sense. So well uh I think for for be good bounty uh this should u uh take not really not many hash calls. So the the fewer hash calls you have the easier uh it is to break. Ideally one hash call. If you can formulate something with one hash call that would be that would be nice. So currently the boundaries are about one one hole. >> I think you can for one Hash call is like you say 16 field field elements and you have one hash call and then you like then you take like the left most field element after the hash call get like a

bit from it and then you check the the the field in that bit and you want to move that to zero. >> Yeah. Yeah. >> That might be too easy. You might want to do you might want to do like two or three bits. >> Okay. They throw ideas at us and >> I mean the bounty could say if you we can analyze the probability of that doesn't have to be negligible right but if the bounty says you get the bounty if you improve the probability of disorder Well, what I know about this.

So, basically for basis, uh there are several steps. So first you will have to well you have to have some crypto target for example like why the premium then you formulate uh this as a system of equations and this is completely uh I would say like it's it's the choice of of a analyst uh how you which equations you see is it like one equation for the entire thing or round by round or something that's what we call the model so you decide on the model then you write down your equations and then you have to have uh you basically use some computer algebra software and now there

are different possibilities so most of uh uh gro attacks they use just pure magma software it's a well-known thing I think we have paid for the license and it's supposed to have the best attack implementations and most of researchers the world guys. Well, these guys from France, well, I can't say for sure because they haven't started working yet, but I hope they will. Uh, they claim to have their improvements over my so maybe they can have something better than this at at this stage. uh but still they eventually one way or another they

do did build verb basis and this verb basis is usually with respect to some ordering of monomials and usually uh whatever ordering you do you do you have to convert it to another ordering uh because well uh the most well suitable ordering to find a solution is the most difficult one to to compute and you have to do a conversion and this conversion That's I think it's consensual that it's a bottleneck. That's where this ide comes into place.

Okay. Uh so we have like 10 minutes. Thanks very much.