More About the Corpus of Involutions From Two-to-One Mappings and Related Cryptographic S-Boxes

Abstract

Permutation polynomials have been extensively studied for their applications in cryptography, coding theory, combinatorial design, etc. An important subfamily of permutations is the class of involutions (those permutations are equal to their compositional inverse). Elements of this class have been used frequently for block cipher designs and coding theory. In this article, we further investigate this corpus using new approaches, specifically from two-to-one (2-to-1) functions and (in some cases) using the graph indicators introduced by Carlet in 2020. In our constructions of involutions over the finite field <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\mathbb {F}_{2^{n}}$ </tex-math></inline-formula> of order <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$2^{n}$ </tex-math></inline-formula> , we shall intensively use 2-to-1 mappings over <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\mathbb {F}_{2^{n}}$ </tex-math></inline-formula> . More specifically, we present a new constructive method to design involutions from 2-to-1 mappings through their graph indicator and derive new involutions from known 2-to-1 mappings. Besides, we also propose several new classes of 2-to-1 mappings, including 2-to-1 hexanomials, 2-to-1 mappings of the form <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$(x^{2^{k}}+x+\delta)^{s_{1}}+(x^{2^{k}}+x+\delta)^{s_{2}}+cx$ </tex-math></inline-formula> , and 2-to-1 mappings from linear 2-to-1 mappings. We also exhibit the corresponding involutions of the constructed 2-to-1 mappings. Furthermore, an infinite family of involutions with differential uniformity at most 4 (EA-inequivalent to the inverse function) is obtained. Finally, we highlight that all our derived families of involutions have no fixed point, further accentuating their cryptographic interest.