Almost Perfect Nonlinear Research Articles

Characterizations of the Differential Uniformity of Vectorial Functions by the Walsh Transform

For every positive integers $n$ and $m$ and every even positive integer $\delta $ , we derive inequalities satisfied by the Walsh transforms of all vectorial $(n,m)$ -functions and prove that the case of equality characterizes differential $\delta $ -uniformity. This provides a generalization to all differentially $\delta $ -uniform functions of the characterization of Almost Perfect Nonlinear (APN) functions due to Chabaud and Vaudenay, by means of the fourth moment of the Walsh transform. Such generalization has been missing since the introduction of the notion of differential uniformity by Nyberg in 1994 and since Chabaud-Vaudenay’s result in the same year. Moreover, for each even $\delta \geq 2$ , we find several (in fact, an infinity of) such characterizations. In particular, when $\delta =2$ and $\delta =4$ , we have that, for any $(n,n)$ -function [resp. any $(n,n-1)$ -function)], the arithmetic mean of $W_{F}^{2}(u_{1},v_{1})W_{F}^{2}(u_{2},v_{2})W_{F}^{2}(u_{1}+u_{2},v_{1}+v_{2})$ when $u_{1},u_{2}$ range independently over ${\mathbb F}_{2}^{n}$ and $v_{1},v_{2}$ are nonzero and distinct and range independently over ${\mathbb F}_{2}^{m}$ is at least $2^{3n}$ , and that $F$ is APN (resp. is differentially 4-uniform) if and only if this arithmetic mean equals $2^{3n}$ (which is the value we would get with a bent function if such function could exist). These inequalities give more knowledge on the Walsh spectrum of $(n,m)$ -functions. We deduce in particular a property of the Walsh support of highly nonlinear functions. We also consider the completely open question of knowing if the nonlinearity of APN functions is necessarily non-weak (as it is the case for known APN functions); we prove new lower bounds which cover all power APN functions (and hence a large part of known APN functions), which explain why their nonlinearities are not bad, and we discuss the question of the nonlinearity of APN quadratic functions (since almost all other known APN functions are quadratic).

On APN exponents, characterizations of differentially uniform functions by the Walsh transform, and related cyclic-difference-set-like structures

In this paper, we summarize the results obtained recently in three papers on differentially uniform functions in characteristic 2, and presented at the workshop WCC 2017 in Saint-Petersburg, and we give new results on these functions. Firstly, we recall the recent connection between almost perfect nonlinear (APN) power functions and the two notions in additive combinatorics of Sidon sets and sum-free sets; we also recall a characterization of APN exponents which leads to a property of Dickson polynomials in characteristic 2 previously unobserved, which is generalizable to all finite fields. We also give a new characterization of APN exponents in odd dimension by Singer sets. Secondly, after recalling the recent multiple generalization to differentially $$\delta $$ -uniform functions of the Chabaud–Vaudenay characterization of APN functions by their Walsh transforms, we generalize the method to all criteria on vectorial functions dealing with the numbers of solutions of equations of the form $$\sum _{i\in I}F(x+u_{i,a})+L_a(x)+u_a=0$$ , with $$L_a$$ linear; we give the examples of injective functions and of o-polynomials; we also deduce a generalization to differentially $$\delta $$ -uniform functions of the Nyberg characterization of APN functions by means of the Walsh transforms of their derivatives. Thirdly, we recall the two notions of componentwise APNness (CAPNness) and componentwise Walsh uniformity (CWU). We recall why CAPN functions can exist only if n is odd and why crooked functions (in particular, quadratic APN functions) are CWU. We also recall that the inverse of one of the Gold permutations is CWU and not the others. Another potential class of CWU functions is that of Kasami functions. We consider the difference sets with Singer parameters equal to the complement of $$\varDelta _F=\{F(x)+F(x+1)+1; x\in \mathbb {F}_{2^n}\}$$ where F is a Kasami function. These sets have another potential property, called the cyclic-additive difference set property, which is related to the CWU property in the case of power permutations (n odd). We study cyclic-additive difference sets among Singer sets. We recall the main properties of Kasami functions and of the related set $$\varDelta _F$$ shown by Dillon and Dobbertin and we observe and prove new expressions for $$\varDelta _F$$ .

On an algorithm generating 2-to-1 APN functions and its applications to “the big APN problem”

Almost perfect nonlinear (APN) functions are of great interest to many researchers since they have the optimal resistance to the differential attack. The existence of bijective APN functions in even number of variables is an important open problem, and there is only one known example of such a function at present. In this paper we consider a special subclass of 2-to-1 vectorial Boolean functions that can allow us to search and construct APN permutations. We proved that each 2-to-1 function is potentially EA-equivalent to a permutation and proposed an algorithm that generates special symbol sequences for constructing 2-to-1 APN functions. Also, we described two methods for searching APN permutations, that are based on sequences generated by this algorithm.

Differentially 4-Uniform Permutations with the Best Known Nonlinearity from Butterflies

Many block ciphers use permutations defined over the finite field F22k with low differential uniformity, high nonlinearity, and high algebraic degree to provide confusion. Due to the lack of knowledge about the existence of almost perfect nonlinear (APN) permutations over F22k, which have lowest possible differential uniformity, when k > 3, constructions of differentially 4-uniform permutations are usually considered. However, it is also very difficult to construct such permutations together with high nonlinearity; there are very few known families of such functions, which can have the best known nonlinearity and a high algebraic degree. At Crypto’16, Perrin et al. introduced a structure named butterfly, which leads to permutations over F22k with differential uniformity at most 4 and very high algebraic degree when k is odd. It is posed as an open problem in Perrin et al.’s paper and solved by Canteaut et al. that the nonlinearity is equal to 22k−1−2k. In this paper, we extend Perrin et al.’s work and study the functions constructed from butterflies with exponent e = 2i + 1. It turns out that these functions over F22k with odd k have differential uniformity at most 4 and algebraic degree k +1. Moreover, we prove that for any integer i and odd k such that gcd(i, k) = 1, the nonlinearity equality holds, which also gives another solution to the open problem proposed by Perrin et al. This greatly expands the list of differentially 4-uniform permutations with good nonlinearity and hence provides more candidates for the design of block ciphers.

A generalization of APN functions for odd characteristic

Almost perfect nonlinear (APN) functions on finite fields of characteristic two have been studied by many researchers. Such functions have useful properties and applications in cryptography, finite geometries and so on. However, APN functions on finite fields of odd characteristic do not satisfy desired properties. In this paper, we modify the definition of APN function in the case of odd characteristic, and study its properties.

Some new results on the conjecture on exceptional APN functions and absolutely irreducible polynomials: The gold case

An almost perfect nonlinear (APN) function \begin{document}$f:\mathbb{F}_{2^n}\rightarrow\mathbb{F}_{2^n}$\end{document} (necessarily polynomial) is called exceptional APN if it is APN on infinitely many extensions of \begin{document}$\mathbb{F}_{2^n}$\end{document} . Aubry, McGuire and Rodier conjectured that the only exceptional APN functions are the Gold and the Kasami-Welch monomial functions. They established that a polynomial function of odd degree is not exceptional APN provided the degree is not a Gold number \begin{document}$(2^k+1)$\end{document} or a Kasami-Welch number \begin{document}$(2^{2k}-2^k+1)$\end{document} . When the degree of the polynomial function is a Gold number or a Kasami-Welch number, several partial results have been obtained by several authors including us. In this article we address these exceptions. We almost prove the exceptional APN conjecture in the Gold degree case when \begin{document}$\deg{(h(x))}$\end{document} is odd. We also show exactly when the corresponding multivariate polynomial \begin{document}$φ(x, y, z)$\end{document} is absolutely irreducible. Also, there is only one result known when \begin{document}$f(x)=x^{2^{k}+1} + h(x)$\end{document} , and \begin{document}$\deg(h(x))$\end{document} is even. Here, we extend this result as well, thus making progress in this case that seems more difficult.

A Generalisation of Dillon's APN Permutation With the Best Known Differential and Nonlinear Properties for All Fields of Size $2^{4k+2}$

The existence of almost perfect nonlinear (APN) permutations operating on an even number of variables was a long-standing open problem, until an example with six variables was exhibited by Dillon et al. in 2009. However it is still unknown whether this example can be generalized to any even number of inputs. In a recent work, Perrin et al. described an infinite family of permutations, named butterflies, operating on $(4k+2)$ variables and with differential uniformity at most 4, which contains the Dillon APN permutation. In this paper, we generalize this family, and we completely solve the two open problems raised by Perrin et al. Indeed we prove that all functions in this larger family have the best known nonlinearity. We also show that this family does not contain any APN permutation besides the Dillon permutation, implying that all other functions have differential uniformity exactly four.

On the conjecture on APN functions and absolute irreducibility of polynomials

An almost perfect nonlinear (APN) function (necessarily a polynomial function) on a finite field \(\mathbb {F}\) is called exceptional APN, if it is also APN on infinitely many extensions of \(\mathbb {F}\). In this article we consider the most studied case of \(\mathbb {F}=\mathbb {F}_{2^n}\). A conjecture of Janwa–Wilson and McGuire–Janwa–Wilson (1993/1996), settled in 2011, was that the only monomial exceptional APN functions are the monomials \(x^n\), where \(n=2^k+1\) or \(n={2^{2k}-2^k+1} \) (the Gold or the Kasami exponents, respectively). A subsequent conjecture states that any exceptional APN function is one of the monomials just described. One of our results is that all functions of the form \(f(x)=x^{2^k+1}+h(x)\) (for any odd degree h(x), with a mild condition in few cases), are not exceptional APN, extending substantially several recent results towards the resolution of the stated conjecture. We also show absolute irreducibility of a class of multivariate polynomials over finite fields (by repeated hyperplane sections, linear transformations, and reductions) and discuss their applications.

Boolean and Vectorial Plateaued Functions and APN Functions

Boolean plateaued functions and vectorial functions with plateaued components play a significant role in cryptography, sequences for communications, and the related combinatorics and designs. Our knowledge on them is not at a level corresponding to their importance. We introduce new characterizations of plateaued Boolean functions. We give the characterizations of vectorial functions whose components are all plateaued (with possibly different amplitudes), that we simply call plateaued, by means of the value distributions of their derivatives (we characterize similarly those functions whose components are partially bent) and autocorrelation functions, and of the power moments of their Walsh transform. This allows us to derive several characterizations of almost perfect nonlinear (APN) functions in this framework. We prove that all the main results known for quadratic APN functions extend to plateaued functions, allowing the study of their APN-ness to be simplified. We show that if, additionally, the component functions are all unbalanced, this study is still simpler: the APN-ness of such functions depends only on their value distribution. This allows proving, for instance, that any plateaued $(n,n)$ -function, $n$ even, having similar value distribution as the APN power functions, is APN, and has the same extended Walsh spectrum as the APN Gold functions. As by-products, we obtain a few other new results. For instance, any plateaued function in even dimension, which is Carlet-Charpin-Zinoviev (CCZ)-equivalent to a Gold or Kasami APN function, is necessarily extended affine (EA)-equivalent to it.

Almost perfect nonlinear trinomials and hexanomials

In this paper we give a new family of almost perfect nonlinear (APN) trinomials of the form X2k+1+(trmn(X))2k+1 on F2n where gcd(k,n)=1 and n=2m=4t, and prove its important properties. The family satisfies for all n=4t an interesting property of the Kim function which is, up to equivalence, the only known APN function equivalent to a permutation on F22m. As another contribution of the paper, we consider a family of hexanomials gC,k which was shown to be differentially 2gcd(m,k)-uniform by Budaghyan and Carlet (2008) when a quadrinomial PC,k has no roots in a specific subgroup. In this paper, for all (m,k) pairs, we characterize, construct and count all C∈F2n satisfying the condition. Bracken, Tan and Tan (2014) and Qu, Tan and Li (2014) constructed some elements C satisfying the condition when m≡2 or 4(mod 6) and m≡0(mod 6) respectively, both requiring gcd(m,k)=1. Bluher (2013) proved that such C exists if and only if k≠m without characterizing, constructing or counting those C. To prove the results, we effectively use a Trace-0/Trace-1 (relative to the subfield F2m) decomposition of F2n.

Perfect nonlinear functions and cryptography

In the late 1980s the importance of highly nonlinear functions in cryptography was first discovered by Meier and Staffelbach from the point of view of correlation attacks on stream ciphers, and later by Nyberg in the early 1990s after the introduction of the differential cryptanalysis method. Perfect nonlinear (PN) and almost perfect nonlinear (APN) functions, which have the optimal properties for offering resistance against differential cryptanalysis, have since then been an object of intensive study by many mathematicians. In this paper, we survey some of the theoretical results obtained on these functions in the last 25 years. We recall how the links with other mathematical concepts have accelerated the search on PN and APN functions. To illustrate the use of PN and APN functions in practice, we discuss examples of ciphers and their resistance to differential attacks. In particular, we recall that in cryptographic applications suboptimal functions are often used.

Differentially 4-uniform bijections by permuting the inverse function

Block ciphers use substitution boxes (S-boxes) whose aim is to create confusion into the cryptosystems. Functions used as S-boxes should have low differential uniformity, high nonlinearity and algebraic degree larger than 3 (preferably strictly larger). They should be fastly computable; from this viewpoint, it is better when they are in even number of variables. In addition, the functions should be bijections in a substitution-permutation network. Almost perfect nonlinear (APN) functions have the lowest differential uniformity 2 and the existence of APN bijections over $$\mathbb {F}_{2^n}$$F2n for even $$n\ge 8$$n?8 is a big open problem. In the present paper, we focus on constructing differentially 4-uniform bijections suitable for designing S-boxes for block ciphers. Based on the idea of permuting the inverse function, we design a construction providing a large number of differentially 4-uniform bijections with maximum algebraic degree and high nonlinearity. For every even $$n\ge 12$$n?12, we mathematically prove that the functions in a subclass of the constructed class are CCZ-inequivalent to known differentially 4-uniform power functions and to quadratic functions. This is the first mathematical proof that the functions in an infinite class of differentially 4-uniform bijections are CCZ-inequivalent to known differentially 4-uniform power functions and to quadratic functions. We also get a naive lower bound on the nonlinearity of our functions, which can be very high in some cases, and obtain improved lower bounds on the nonlinearity for three special subcases of functions which are extremely large.

A note on cyclic codes from APN functions

Cyclic codes, as linear block error-correcting codes in coding theory, play a vital role and have wide applications. Ding (SIAM J Discret Math 27(4):1977–1994, 2013), Ding and Zhou (Discret Math, 2014) constructed a number of classes of cyclic codes from almost perfect nonlinear (APN) functions and planar functions over finite fields and presented some open problems on cyclic codes from highly nonlinear functions. In this paper, we consider two open problems involving the inverse APN function \(f(x)=x^{q^m-2}\) and the Dobbertin APN function \(f(x)=x^{2^{4i}+2^{3i}+2^{2i}+2^{i}-1}\). From the calculation of linear spans and the minimal polynomials of two sequences generated by these two classes of APN functions, the dimensions of the corresponding cyclic codes are determined and lower bounds on the minimum weight of these cyclic codes are presented. Actually, we present a framework for the minimal polynomial and linear span of the sequence \(s^{\infty }\) defined by \(s_t={\mathrm {Tr}}((1+\alpha ^t)^e)\), where \(\alpha \) is a primitive element in \({\mathrm {GF}}(q)\). These techniques can also be applied to other open problems in Ding (SIAM J Discret Math 27(4):1977–1994, 2013), Ding and Zhou (Discret Math, 2014).

Two Classes of Quadratic Crooked Functions

It is known that almost perfect nonlinear (APN) functions have many applications in cryptography, and a quadratic function is crooked if and only if it is APN. In this paper, we introduce two infinite classes of quadratic crooked multinomials on fields of order 22m. One class of APN functions constructed in [8] is a particular case of the one we construct in Theorem 1. Moreover, we prove that the two classes of crooked functions constructed in this paper are EA inequivalent to power functions and conjecture that CCZ inequivalence between them also holds.

CONSTRUCTING NEW APN FUNCTIONS FROM KNOWN PN FUNCTIONS

We present a method for constructing almost perfect nonlinear (APN) functions in odd characteristic by modifying some values of known perfect nonlinear functions. As a consequence, new APN polynomial functions such as ones over 𝔽13 which are CCZ-inequivalent to known APN functions are obtained.

On existence of Budaghyan–Carlet APN hexanomials

Budaghyan and Carlet (2008) [4] constructed a family of almost perfect nonlinear (APN) hexanomials over a field with r2 elements, and with terms of degrees r+1, s+1, rs+1, rs+r, rs+s, and r+s, where r=2m and s=2n with GCD(m,n)=1. The construction requires a certain technical condition, which was verified empirically in a finite number of examples. Bracken, Tan, and Tan (2011) [1] proved that the condition holds when m≡2 or 4(mod6). In this article, we prove that the construction of Budaghyan and Carlet produces APN polynomials for all relatively prime values of m and n.More generally, if GCD(m,n)=k⩾1, Budaghyan and Carlet showed that the nonzero derivatives of the hexanomials are 2k-to-one maps from Fr2 to Fr2, provided the same technical condition holds. We prove that their construction produces polynomials with this property for all m and n.

Constructing Differentially 4-Uniform Permutations Over <formula formulatype="inline"><tex Notation="TeX">${\BBF}_{2^{2k}}$</tex> </formula> via the Switching Method

Many block ciphers use permutations defined on F(22k ) with low differential uniformity, high nonlinearity, and high algebraic degree as their S-boxes to provide confusion. It is well known that, for a function on F(2n), the lowest differential uniformity is 2 and the functions achieving this lower bound are called almost perfect nonlinear (APN) functions. However, due to the lack of knowledge on APN permutations on F(22k ), differentially 4-uniform permutations are usually chosen as S-boxes. For example, the currently endorsed Advanced Encryption Standard chooses one such function, the multiplicative inverse function, as its S-box. By a recent survey on differentially 4-uniform permutations over F(22k ), there are only five known infinite families of such functions, and most of them have small algebraic degrees. In this paper, we apply the powerful switching method to discover many CCZ-inequivalent infinite families of such functions on F(22k ) with optimal algebraic degree, where k is an arbitrary positive integer. This greatly expands the list of differentially 4-uniform permutations and hence provide more choices for the S-boxes. Furthermore, lower bounds for the nonlinearity of the functions obtained in this paper are presented and they imply that some infinite families have high nonlinearity.

On the Fourier Spectra of New APN Functions

Almost perfect nonlinear (APN) functions on F2n are functions achieving the lowest possible differential uniformity. All APN functions discovered until now are either power or quadratic ones, except for one sporadic multinomial nonquadratic example on F26 due to Edel and Pott. It is well known that certain binary codes with good properties can be obtained from APN functions, and determining their (Hamming) weight distribution is equivalent to determining the Fourier spectra of the corresponding functions. The Fourier spectra of all known infinite families of quadratic APN functions discovered through 2010 have been determined, and it was found that they are the same as the ones of the Gold APN functions, i.e., a 5-valued set when n is even and a 3-valued set when n is odd, while a sporadic example on F26 found by Dillon has a 7-valued Fourier spectrum. In 2011, two new generic constructions of APN functions were presented in (Y. Zhou and A. Pott, Adv. Math., 234 (2013), pp. 43-60) and (C. Carlet, Des. Codes Cryptogr., 59 (2011), pp. 89-109). In this paper, we determine the Fourier spectra of the APN functions obtained from them and show that their Fourier spectra are again the same as those of the Gold APN functions. Moreover, since the APN functions in (C. Bracken, C. H. Tan, and Y. Tan, On a Class of Quadratic Polynomials with No Zeros and Its Applications to APN Functions, preprint, arXiv:1110.3177v1, 2011), which are demonstrated to exist when n ≡ 0m od 4 and 3� n, are covered by the construction in (C. Carlet, Des. Codes Cryptogr., 59 (2011), pp. 89-109), a positive answer to the conjecture proposed in the former paper on determining their Fourier spectrum is given in this paper.

Equivalences of quadratic APN functions

The following conjecture due to Y. Edel is affirmatively solved: two quadratic APN (almost perfect nonlinear) functions are CCZ-equivalent if and only if they are extended affine equivalent.

On the dimension of an APN code

A map f?:?V:?=?GF(2 m ) ? V is APN (almost perfect nonlinear) if its directional derivatives in nonzero directions are all 2-to-1. If m is greater than 2 and f vanishes at 0, then this derivative condition is equivalent to the condition that the binary linear code of length 2 m ???1, whose parity check matrix has jth column equal to ${\omega^j \brack f(\omega^j)}$ , is double-error-correcting, where ? is primitive in V. Carlet et al. (Designs Codes Cryptogr 15:125---156, 1998) proved that this code has dimension 2 m ???1???2m; but their indirect proof uses a subtle argument involving general code parameter bounds to show that a double-error correcting code of this length could not be larger. We show here that this result follows immediately from a well-known result on bent functions ...a subject dear to the heart of Jacques Wolfmann.