zkSummit6: Rescue-Prime: a Standard Specification Alan Szepieniec – AS Discrete Mathematics & Nervos

Transcript

[Music] alan thank you so much for being here very excited to hear uh about rescue prime and with that i'll let you take it away all right thanks for the fabulous introduction uh i did notice though that you didn't brave to pronounce my surname um probably a very wise choice description is the better part of valor as they say exactly exactly uh for those who wonder how it is pronounced uh i say chapienze but then someone who's actually from poland might disagree

about the correct pronunciation so there you go uh this is obviously joint work with tomer usher and simon dora and well this is a presentation about a paper called rescue prime and there's some other stuff in the title of that paper uh but i'll also be talking about the original paper which i'll refer to as the marvelous paper uh which rescue prime is based on based off of um so here's a a quick outline uh first i'll be motivating why we need

arithmetization oriented hash functions and then i'll look at what rescue and rescue prime do and how the two differ and then i'll cover the security argument against algebraic attacks briefly and lastly i'll have a conclusion um so my slides are probably roughly 30 minutes in terms of presentation time and if you have any questions uh please raise your hand uh join in uh or if you're if you're shy you can also write it in the chat and alex will read your question but i certainly prefer an interactive dialogue to uh

standalone stand-alone lecture um so in the context of zero-knowledge proofs there's always this this transformation going on where you start from a computation at the top and it's turned into two programs at the bottom approver and the verifier such that the verifier does not need to have the resources that performing the computation naively would require so the prover which performs the computation but in addition to performing the computation produces a proof the prover has access to secret inputs

and that's when we have a zero knowledge proof system or sometimes instead of uh secret inputs it has access to much more running time and then we then we have a succinct verifier proof system and in fact you can combine the two and the whole point is that the verifier does not need to have access to those resources but instead has access to a proof pie and based on the the construction of that proof the verifier decides whether or not the claim is accepted as true or not most of the research in proof systems is about this compilation process

and that's where all the moon math is going into and that's where all the information theoretic analysis is going into and and there is no shortage of papers and results dealing with that block but that's not what this presentation is about or what the paper that this presentation is about is about um we take a step up and have a look at the computation itself and in particular oftentimes you need to evaluate a hash function in that computation and since you're going to transform this

entire computation into approver and a verifier the hash function can affect the performance of that prover and verifier very very strongly if your hash function is rather naive then you'll have a very expensive proven verifier and if it's geared to optimize this transformation then maybe that cost is much less so that's uh the idea behind poseidon and rescue and by no means is that list exhaustive there are a few uh others as well and so rescue is is one of these uh hash

functions that already exists that is very amenable to transformation by a zero-knowledge proof system what we're introducing in this paper is rescue prime which is almost basically 99 the same thing it's just presented in a different way and and there are a couple of minor tweaks um that that make it even more um amenable to transformation by a proof system um so here's a a slide that i drew from one of the reports by starkware where they consider various hash

functions to build their one of their applications on top of i think the hash functions go into a merkle tree or it's a it's a vdf where you evaluate the same hash function many many times and they compiled some some cost metrics and with respect to sha-2 and sha-3 you're in a completely different ballpark with respect to this cost metrics than if you look at the arithmetization oriented hash functions and then in fact even among the arithmetization oriented

hash function rescue is already [Music] inching out ahead of its competition but then rescue prime is even better still so it i don't know exactly what the number would be but i expect it to be 2.9 or something um so it goes to show that that um arithmetization oriented hash functions are useful and are are being used in practice so that's why we have that's why we we designed them or designed uh one family of them uh in the past so

that's this is the original paper which i will refer to as the marvelous paper and this paper didn't just introduce the hash functions vision and rescue it also introduced a design principles for for designing secure ciphers and uh assessing their security um as a result of of introducing design principles um and and this elaborate security assessment the paper is rather difficult to process

particularly for for implementers who just want a list of instructions because they want to know what to do they don't care about the exact complexity of an algebraic attack so that's why we have the second paper i should probably say the motivation for the second paper is because the first one was finally accepted after i think five submission attempts uh but now that it is finally accepted and more or less um the the hello hey alan sorry there's a question in the chat i'm just gonna read to you

if you don't mind go ahead uh so question i noticed that many are using 60 and i referring to the the slot of the results of the different functions i said i noticed d1 big prime fields which is obviously much smaller than traditional hash functions is there any issues with collision resistance both then i was then you were asking just in general are there any you know special assumptions that you need to make about this class of hash functions versus something like sha256 so it's two questions i'm there for you right so uh while these hash functions are defined over 61-bit prime fields the

output of these hash functions are going to be multiple uh field elements so in the end you'll have 122 bits of output or even 244 depending on how many how many uh field elements it outputs got it and there also in the chat said the output of the hash is larger than the field in that case which i think is what you just said exactly correct thank you i'll uh see questions good yeah um so this paper the goal here

is uh to take just one aspect one one hash function of the two hash function families that we we specified in the previous one and make it as simple as possible and make the instructions for implementers as clear as possible and while we were added we decided to apply some simplifications but those are really not very very uh meaningful so the scientific novelty of this paper is basically zero so i'm sorry to disappoint anyone who was coming to this lecture for for seeing the scientific novelty

because if you already know uh how how rescue works and uh what the argument for for security is this will just be a repetition of all that knowledge on the other hand uh this paper does have what i still think qualifies as scientific contributions namely we have an easy specification of the hash function uh or easy to follow rather the specification itself serves as a standard so that if you implement what's described in this paper and someone else also implements it in a different code base in a different language even

at least it will be the same [Music] hash function that's being implemented and thirdly it is slightly simpler than rescue uh so i'll get into that uh and uh so what is the just another question here and by the way so everyone knows in the chat and allen also also so you um the slight delay between folks who are there who are watching and what you and i are discussing there's like a little bit of a lack so some of the uh some of the questions are gonna be coming like a little delayed from uh from your talk but uh this there's a question from thor that returning to this uh around collision distance and the

output and the question is uh is the hash function objective that is even maybe larger than the input field wouldn't the number of possible outputs be limited to i says 2 to the 61. um hang on the output field and the input field that distinction doesn't make much sense the field is uh how you define the plus and times operations right in both cases you take plus modulo p and times modulo p and you build your

hash functions out of plus and minus excuse me plus and times alone no other operations allowed the output of this function that you built are going to be several numbers modulo p so that's what we refer to as field elements is a number modulo b okay i've got a thumbs up on chat uh so thanks for that all right uh so so what's the difference between rescue and rescue prime well for starters we flip the order of the s boxes um and i have a slide motivating just that

we simplify the derivation of round constants and if you were confused about how the round constants were derived in the original marvelous paper um [Music] it doesn't really matter that much but this that this go around at least we have a a uh easy specification so it's difficult to get this uh wrong and uh thirdly is the security margin is reduced so originally um we we set the number of rounds to be two times the number of rounds that we know can be attacked by

that we expect can be attacked by the best performing attack just to be just to exaggerate on the conservative side of things now that was almost two years ago when when we set that security margin and in the meantime there has been some analysis of of arithmetization oriented hash functions but uh the security of rescue is untainted is uh the the efforts in breaking rescue have gone essentially nowhere as far as we know so we expect it it's uh safe

to reduce the security margin from 100 to 50 percent alan two more questions in the chat sorry i guess we asked for this um uh so question from dara it matters i would by that i'm butchering it and uh i'll figure something else out um the question is it matters it's about the the pretty analysis this family have it matters that the round constants are super random right otherwise there is a back door possibility so that's one question from there i'll let you tackle that one first uh there are a couple of uh functions that the round constants um serve

the first and and foremost thing is that they make every round into a different function if every round is the same function then and a clever attacker can trick the cipher into recomputing parts of itself and there's this uh slide attack and and all sorts of self-similarity attacks uh are possible if rounds are not distinct from each other so so the first and foremost purpose of round constants is to make every round unique in traditional ciphers it is often possible to choose malicious round

constants these would be specific numbers that were designed to to enable certain [Music] linear or differential properties and if you don't know why those numbers were chosen you have no hope in discovering those linear or differential properties whereas if you do know why those numbers were chosen then you have a leg up on anyone else who's trying to attack it so that's one of the the reasons why people distrust deaths and triple that's as well in fact

is because the the specification just gives you the round constants but it doesn't tell you uh where they came from and as a result if you're if you're sufficiently paranoid or even mildly paranoid you probably shouldn't trust deaths because someone somewhere might be sitting on a way to attack it that hasn't been discovered uh so the second purpose of of round constants and and rather the purpose of generating round constants as the result of a pseudo-random number generator

is to convince everyone that we don't have any uh anything hidden up our sleeves we didn't choose these constants to satisfy particular algebraic properties got it and another question from sean in the chat is there a difference between the base prime and the corresponding order and he clarifies the orders d1 not prime question mark uh so the the base prime defines a field and the field in in discrete algebra the order refers to the number of elements of the field

but that's in particular circumstances sometimes you say the order of an element and then you mean the order of the group that that element generates and if you take a random element from your field odds are that the group that it generates is going to be p minus one so definitely distinct from the order of the field great all right thank you i didn't get the the clarification can you repeat that oh yeah uh so sean so again the the full question so is there a difference between base prime corresponding order and then the you know he the follow-up was order is 261

not prime question mark so i think yeah yeah so you could i don't know if due to the 61 plus one is prime but it's certainly possible that there is uh a prime of a similar form where the the order of the multiplicative group is two to the k where k is sufficiently large in fact uh those are are good primes uh to use in transparent proof systems using fry which is what stark uses uh

great well uh let's move on allen and i'll let you know if there's any more questions in here all right um so that was the the introduction drinking break let's see construction so um in the original marvelous paper we specified rescue as a result of several steps and um hats off to anyone who managed to take those steps with that who was with us the entire way because it's it's actually a rather long and winding road

so first we we specified the block cipher and then when you set the key to zero then you get a stand-alone permutation and when you instantiate the sponge construction with this permutation then you get a sponge function whose output is infinite but if you truncate this infinite length output to a given length that's how you get the rescue hash function so this also shows how to get the round constants for the rescue hash function right because we specify the round constants for the rescue block cipher and then you set the key to zero this gives you essentially new round

constants for the permutation because there is also a key schedule involved in the block cipher which transforms the constants but in the end that's that doesn't matter the exact derivation of the round constants doesn't matter too much as long as it is um as it makes sure that every round is different and that it's uh clear that it's difficult to choose round constants with particular properties so this was rescue and then for rescue prime we really only specify two things rescue xlix and rescue prime so rescue prime is the hash function

and rescue xlix is the permutation and we we don't even specify what the sponge construction would look like i mean it's obvious if you know what a sponge construction does but we we omit any reference of that and we go straight to a truncated sponge construction not sure why that's happening all right there should be a note here about the correct pronunciation of rescue xlix [Music] my co-authors insisted on using english script to denote

the correct pronunciation of x licks but i find it confusing because the symbols happen to match exactly with the word 49. here you go um so i already mentioned that the [Music] hang on there's a slide missing here let me let me um quickly try to recompile my slides and and i'll see um and and i'll i'll make sure that it's there hang on how do i stop sharing my screen here we go feel free to ask me some questions in

the meantime if there are any um recompiling shouldn't take so long but a second here i think there's a there's going to be like a 10 or 15 second lag so we'll probably we'll probably hear questions here in a few seconds why do you recommend sorry for the uh technical hiccup i should have made sure that my slides made sense uh so we have one question that just came through why truncate sponge and uh the sponge function outputs um [Music] infinite many infinitely many field elements and it's kind of difficult to work with

infinitely many field elements in practice um yeah okay uh it's kind of difficult to work with infinitely many field elements in practice so you're going to have to truncate it regardless um and and so you might as well uh define the truncation in the system and then uh and then question what are the material differences between a stark friendly hash function and a stark from the hash function is rescue prime one of the former that's a great question um so uh stark friendly hash function is a hash

function that gives rise to a very small arithmetic intermediate representation which is the cost metric for the stark proof system uh the way you achieve a very small error is by using only a small number of additions and multiplications now the stark proof system is not the only snark proof system in existence there are also pairing-based snarks and even snarks based on groups of unknown order and and uh plenty of constructions out there and very few of them actually use arithmetic intermediate representation

error most of them actually use arithmetic circuits and and uh r1cs or or even hadamard relation these are different representations compared to error of a computation and as a result the complexity metric will be different however the complexity metric is also very small when you're using a small number of additions and multiplications i think for r1cs the number of additions doesn't matter that much but the number of multiplications is key so it highlights that r1cs complexity is

different from error complexity but still a hash function that's going to be efficient for starks is also going to be efficient for r1cs despite the minor dissimilarities in the complexity metric all right in the meantime i recompiled my slides so we can go back uh uh to present all right yeah so um my co-authors wanted to introduce this this anglo-saxon phonetic notation whereas i prefer the international phonetic alphabet [Music]

way to write xlix so the round function of rescue was defined by six layers operating on a state of m elements and we discovered early on that m has to be two or larger because if it's not then the degree of regularity grows very slowly and that's a bad thing from the point of view of defending against algebraic attacks but as you if you choose m equal to 2 or larger it should be fine

so in the first layer we apply the s box what's called the s box uh to every element individually and what this s box does is it sends x to x to the power one over alpha alpha here is the smallest exponent co-prime to the order now when i say order here i mean order of the multiplicative group not the order of the field um so the order of the multiplicative group is p minus one because we're working over prime field and most of the time alpha is going to

be three if three doesn't work then you choose alpha to be five if 5 doesn't work either then you choose alpha to be 7 and so on if possible pick a prime field such that alpha equals to 3 works so in particular the the fourth layer which is once again s boxes that's just regular raising to the power alpha and alpha is three uh so you should think of this first layer of s boxes as the inverse of the fourth layer all right then in the in the second layer we have a multiplication by an mds matrix um

this is just mds is a term borrowed from coding theory and it uh guarantees that your matrix has good properties from the point of view of uh studying propagation of differential patterns and linear dependencies it makes the analysis the security analysis a lot easier if if the matrix is mds over large fields as we define rescue most matrices are mds matrices but nevertheless we give a concrete standard specification how how to find this matrix

both in in rescue and rescue prime so then the the third layer uh consists of injecting the round constants um excuse me rescue specifies the block cipher so these are not the round constants but these are the sub keys where do you get the sub keys from well that's you get them from the the key schedule which is not shown in this figure so anyhow injecting that you just add for every wire there is going to be a sub key and you just add the sub key to that wire

and then the same process repeats except the s boxes are the inverse of what they were at the start you raise every element to the power alpha and then you apply the mds matrix and then you inject the next sequence of sub-keys for rescue prime we flip the order of the s boxes so first we raised to the power alpha and then we raised to the power one over alpha and uh since there is no key schedule uh to be seen anywhere these the constants that you're injecting here

are actually the round constants of the hash function uh so it's it's almost the same thing but but not quite um why are we flipping the order of the s boxes and doesn't this come with a security hazard um [Music] we think not um so if you visualize one execution trace of the of the permutation um and if you look at where you would insert new variables when you start to model

this as a sequence of permutations what you would do is you would at the very start you would have one variable for every wire and at the very end you would have one variable for every wire but then you would make use of the fact that if you go from from the middle of this round to the middle of the next round you can relate the variables from the middles of two subsequent rounds using only degree alpha equations we call that folding and this folding works across the entire um across the entire uh

permutation except it doesn't work at the end so that's what what i've drawn here the the half blocks let's say are the full rounds and then the dotted lines are where you want to [Music] specify variables when you model this as a system of polynomials for a algebraic attack now for rescue prime you want the variables to coincide with the boundaries of the rounds and for the the inner part of of the permutation this

coincidence is exact it matches perfectly but then there's this this odd question what to do at the end at the start and at the at the end and well we in the end we decided to just add a single half round at both ends um and and so as a result of adding the single half rounds it can't be less secure because there are more half rounds now than there were previously and the the arithmetization is more um regular uh in fact there are the same number of variables and the same number of

equations is just the shape of some equations namely the equations that capture the ends that are different so in fact in in some cases this flip of the order of the s boxes improves the arithmetization and in other cases you're as bad or as good off as you was as you were previously um so what does the truncated sponge look like well this is a diagram where you're hashing um two blocks now one block consists of r field elements so

r could be three or something and in that case we're hashing six field elements in total um so a sponge consists of a a state and the state consists of r plus c elements r is the rate and c is the capacity and uh in every iteration of the absorbing phase we read our many field elements and add them to the top r elements of the state and then after every read we apply the xlix permutation and

we do that just as many times as you need in order to to absorb the entire uh input sequence i should note that there is an issue if you're going to hash variable length inputs you cannot forget to include a delimiter but if you know that your inputs are fixed length always then you can safely omit the delimiter so that's the absorbing phase and then in the squeezing phase for sponges you can squeeze out an unlimited number of elements but for rescue prime which is a hash function you're only ever allowed to squeeze out r

field elements and that's just reading the top r elements of the state after the absorbing phase is done all right so let's have a look at the security argument and by the way here there is absolutely no difference between uh rescue and rescue prime so the best performing attack as far as we can tell is the grodner basis attack and what i will be describing in this slide is only very crudely uh grogner basis attack in fact this is more

reminiscent of an xl attack but regardless um it suffices to capture the intuition of where the performance penalty or rather where the complexity of the grignard bases attack comes from because you can always look you can always interpret a grogner basis algorithm through the lens of elementary row operations on a macaulay matrix of degree d so suppose we have a system of equations which we obtain from modeling the cipher and and that shouldn't be difficult

because these ciphers come with the selling point that they should be easy to model as systems of equations because that's what you get when you build a cipher out of only addition and multiplication so once you have a system of equations then you take all the variables that appear in all those equations and i've done i i simplified all those variables to just x and y for the purposes of this picture but in reality that would be all of them and uh you take all monomials

of degree at most d so that's a very big number of monomials for even modest d's so in my picture i took degree 3 so that gives x cubed x squared y x y squared and y cubed those are the degree three monomials then we have the degree two monomials then we have the degree one monomials and then we have the degree zero monomial right so in this matrix it is easy to put the original polynomial equations that you start with because they just give you coefficients that belong to those monomials so you

put those coefficients into their respective position and now you have a matrix where every row corresponds to an equation and every column corresponds to a monomial so far so good um you are allowed to do row operations on this matrix already however that's not going to give you any new information because these polynomials are non-linear and well as a result you cannot bring them into um reduced row echelon form or rather you can bring them in to reduce row echelon form it's just not going to give you any useful information

about the degree one monomials from which you can read out the solution so what you need to do is you need to multiply these polynomials by monomials rather than just scalars you multiply them by monomials that means that the new rows in this matrix are going to occupy columns of a higher degree as a result of multiplying by monomials uh so suppose we have two equations that that we start with then we multiply both equations by x and by y so then we get four new equations um and obviously those numbers

generalize to to higher numbers and then once we we've populated this matrix we run linear algebra for instance gauss and then we get this this nice row reduced echelon form and if everything went smoothly we should be able to read out the values of x and y because they are at the bottom on the on the on this diagonal this diagonal hopefully is one uh so that means that this the the bottom most two elements of this uh column this pink column on the right

should give you the values for x and y respectively question from ferdinand in the chat here and this i think goes back uh to the discussion of uh the perma campus or sorry the um uh yeah xlix um yeah so okay uh correcting me he's they're having discussion in the chat so there is no uh please continue but it has a lot of uh interesting chatter between some folks so uh about that i didn't flow but go ahead all right so um once again

uh this is a very very very crude representation of how grosvenor basis algorithms work but nevertheless it suffices to capture the source of their complexity um right of course step number four i already covered that is you just read out your solution once you have the matrix in this form so the source of their complexity is bringing this matrix into reduced row echelon form and we actually understand this problem quite well uh what we don't understand quite as well is how big

must d be uh how big does this matrix have to be before you get this nice diagonal and column vector form out at the end because if your d is not big enough then you're not going to have enough linearly independent rows and you're going to have you won't be able to read out your solution if your d is too big you will be able to read out solutions but it's going to be too expensive to get to that point so so d is the the big question in this context and that's where the notion of the degree of regularity comes into play

um crudely phrased the degree of regularity is how big this matrix need to be needs to be before you can read out a solution [Music] i bet there are a couple of researchers in paris right now who i've just given a heart attack with that crude phrasing but i i don't think it's that far off from the truth um but if you if you want to know what the truth really is here are is a formula dump uh so the degree of regularity is a property of

the ideal which is to generate the generalization of the vector space if you take the polynomials you start with as basis vectors and you allow not just scalar coefficients but also polynomial coefficients then you get an ideal and not a vector space and the ideal spanned by the polynomials that you start with has a degree of regularity and in the worst case from the point of view of the attacker this is a regular sequence of polynomials and then we

actually have a not very closed form expression but we have a definite expression then we know that the degree of regularity is equal to the degree of the first non-positive term in the formal power [Music] series expansion of this expression uh product of one minus set to the power if polynomials degree over 1 minus set to the power number of variables it's terrible but fortunately

if the number of polynomials equals the number of variables then we get a closed form expression for the degree of regularity known as the macaulay bound and this is much much easier to work with but of course this is still assuming that that that the system of polynomials that you start with is regular or or worst case from the point of view of the attacker and in practice we do not observe that those systems are uh regular in fact we observe that the

concrete degree of regularity is less than what the macaulay bound would predict unfortunately the only way to determine what the concrete degree of regularity is as far as we know is by running a grodner basis algorithm and looking at at what degree [Music] was reached and as a result of that it's prohibitively expensive to get more data points to justify this linear fit but there is a closed form

expression for the for the orange line which matches which with all the the observed data points uh so based on using that closed form expression for the concrete degree of regularity we can estimate the complexity of a grosvenor basis attack and that's actually a surprisingly simple formula which you see here let me let me annotate this so d-reg is the degree of regularity and based on this picture you look at the number of rounds that you're considering and then you look at the value of the orange line that's the degree of regularity and then

n is the number of variables omega is the linear algebra exponent so if you're going to use naive gauss then it it's three but if you're going to use a fast matrix multiplication like strassen it should be 2.8 or something and if it's even fancier matrix multiplication you can get down to 2.4 and even if you use sparse linear algebra techniques well it's not clear how that would work yet but we certainly cannot rule out that possibility so maybe two is feasible uh so in fact two is is the linear algebra exponent that we

chose already in the original marvelous paper uh so the reason why there's a combinatorial expression here is because this means the number of monomials of degree at most d uh so this is the width of your matrix and you need at least as many columns in practice you you can do with slightly less but as as an order of magnitude you need that many rows in order to triangularize or in order to to get that nice diagonal form as a result of running as a result of bringing the matrix into

reduced row echelon form so based on this expression you can compute how much work does it take the attacker to compute a pre-image of a hash function that uses n many rounds and whatever that number was for rescue we doubled it and said rescue needs that many rounds but since the meantime has seen essentially no progress towards breaking rescue or undermining its security we've decided that it's it's okay to change this factor too

into a factor 1.5 so still there is a security margin but it's less extreme than the original security margin that rescue had so that brings me to to the last slide which is essentially a couple of bullet points rescue prime is out and it's a hash function just like rescue hash and you can see the specification on yakur eprint 2020-1143 of course we're still not 100 sure about the security so if you if you have want to have a look at the security

by all means uh also feel free to reach out um and and [Music] i'll be happy to answer your questions both via email and now great hey thanks ellen uh let's give uh folks in the chat uh feel free and ask any questions that you have um and then uh yeah or you know you can ask them in the chat there or i think dara's he's just caveated that he's not a symmetric cryptanalyst but i'm i think that's going to be followed by a cryptanalytic question uh but anyway for everyone else watching if you have a question you can either raise your hand and just click share audio video and i can i can call you up and you can

pronounce um i i can i can you know just call on you and you can ask directly or uh you know just drop it in the chat and and i'll read it aloud so we'll give folks a couple minutes well that has really seen uh uh the chat has really seen a lot of messages i i was afraid it was going to be a bit of a middle of nowhere kind of uh yeah tumbleweed experience actually there's a question for you maybe i'll just rather than verbalize it

i'll just let you read it alan yeah that's the first one and then and then there's this guy all right can there be arithmetization friendly functions as efficient outside of snark starcks as regular hash functions um hang on i think uh i'm not sure i understand the question correctly but i think what you mean is when evaluated on a cpu whether the hash function can be as efficient as chatu or blake the answer is

it's difficult because when you design a non-arithmetization oriented hash function you get to use bit fiddling and bit fiddling is is really fast um and and it can still give you a reasonable security level uh whereas earthquake oriented hash functions generally speaking don't allow bit fiddling now i say generally speaking because if you work over a binary field then you obviously do have access to xor because that's just addition over a binary field but you definitely don't have access to and

or the majority function or rotations and those are operations that are really really really cheap and make traditional hash functions very fast um also uh generally speaking in in the zero knowledge proof you want your soundness to come from the fact that you're using a large field and if you're going to use a large field then multiplication is going to be very expensive compared to to traditional functions where you can just use field elements well field elements it's not really a field element anymore because you're using other operations as well but you can use state elements as small as as a byte or even a nibble

and there's no problem with multiplying them if you would want to multiply in the first place am i worried that there hasn't been enough time since rescue was published to be proposing a new specification well it's hardly a new specification because the the there's a really very very strong similarity um although i i think the question can be recycled with respect to aren't we worried about reducing the security margin uh yeah to a certain degree but at the same time um

[Music] you have to dance around and catch attention to be uh a target and and we certainly want to be a target of cryptanalysis um because the only way that that um we will get a a justified um confidence in the security of this function is for crypt analysts cryptanalysts to direct their attention to rescue prime and to fail and if they should succeed then we're better off if they succeed in breaking rescue prime

sooner rather than later and with with an eye to motivating um cryptanalysis we think it's it's a good idea to to make um to make it appear more vulnerable perhaps okay great um so i think that's uh i think that's the end of the questions and uh yeah with that thank you very much alan for the for the talk i did want to quickly plug um since we're talking about chess at the beginning of this session uh there's going to be a little after event uh after party virtual after party for those of you who are familiar with gather dot town it's kind of a little virtual world that that uh we can virtually explore and i'm told

there's a there's a virtual chess game in the in the world that uh that anna's created so if anyone wants to try their hand at playing allen and chess he's eager to redeem himself after his game this morning i i believe i don't know i'm speaking for you now alan but anyway i'll be happy very gracious of you uh alan thank you very much for the presentation um and i think we all learned quite a bit and uh and thank you everyone who attended uh and look forward to seeing you all throughout the rest of the day and tomorrow