Abstract The XOR Lemma states that a mapping is regular or balanced if and only if all the linear combinations of the component functions of the mapping are balanced Boolean functions. The main contribution of this paper is to extend the XOR Lemma to more general cases where a mapping may not be necessarily regular. The extended XOR Lemma has applications in the design of substitution boxes or S-boxes used in secret key ciphers. It also has applications in the design of stream ciphers as well as one-way hash functions. Of independent interest is a new concept introduced in this paper that relates the regularity of a mapping to subspaces

Xian-Mo Zhang

Yuliang Zheng

CiteSeerX

The Generalized XOR Lemma
Yuliang Zheng a, Xian-Mo Zhang b
aDepartment of Software & Information Systems
The University of North Carolina at Charlotte
9201 University City Blvd, Charlotte
NC 28223-0001, USA
Email: yzheng@uncc.edu
bDepartment of Computing
Macquarie University
Sydney, NSW 2109, Australia
Email: xianmo@ics.mq.edu.au
Abstract
The XOR Lemma states that a mapping is regular or balanced if and only if all
the linear combinations of the component functions of the mapping are balanced
Boolean functions. The main contribution of this paper is to extend the XOR Lemma
to more general cases where a mapping may not be necessarily regular. The extended
XOR Lemma has applications in the design of substitution boxes or S-boxes used
in secret key ciphers. It also has applications in the design of stream ciphers as well
as one-way hash functions. Of independent interest is a new concept introduced in
this paper that relates the regularity of a mapping to subspaces.
Key words: XOR Lemma, Hadamard Transformation, Cryptography
1 Introduction
Let F (x1, . . . , xk) = (f1(x1, . . . , xk), . . . , fm(x1, . . . , xk)) be a mapping from Vk
to Vm, where each xj ∈ GF (2), each fi is a function with n variables and Vk
is the vector space of k tuples of elements from GF (2). F is said to be regular
if F goes through all vectors in Vm, each 2
k−m times, when x goes through
all vectors in Vk once. Obviously k ≥ m must hold for a regular mapping
F . The XOR Lemma states that F is regular if and only if every non-zero
linear combination of f1, . . . , fm is balanced. The XOR Lemma is expressed
in terms of independence of random variables in [3] and [2]. It also appears
as Corollary 7.39 of [4]. Note that every permutation on Vk is regular. An
application of the XOR Lemma is to determine the strict regularity of a given
cryptographic mapping by examining whether the linear combinations of its
component functions are biased.
In practice, however, there is a need to study more general cases when F is
not necessarily regular. In this work, we introduce a concept that a mapping is
regular with respect to a subspace and show that for any given mapping P from
Vk to Vm there exists a subspace W such that P is regular with respect to W .
This allows us to look beyond regular mappings by establishing a Generalized
XOR Lemma. The Generalized XOR Lemma can handle not only regular
mappings but also those that are not strictly regular.
A major application of the Generalized XOR Lemma is the design of the so-
called substitution-box or S-boxes employed in a block cipher. In many ciphers,
S-boxes are the only non-linear operation it employs. Therefore these mappings
are the most critical component of the ciphers. In order to ensure that the
ciphers are not vulnerable to attacks that exploit statistical imbalance within
the ciphers, S-boxes used in the ciphers must be regular or very close to regular.
But there are some cases where we cannot hope for the strict regularity. One
typical example is S-boxes that have more output bits than input bits. Such
“expanding” S-boxes are used, for example, in the Cast-128 cipher which is
an Internet standard [1]. Clearly, such expanding S-boxes are not regular;
therefore we need a way for discussing somewhat weaker regularity. This is
where we can use our generalized regularity and Generalized XOR Lemma.
Further applications of the Generalized XOR Lemma include the design and
analysis of other security tools such as one-way hash functions and stream
ciphers [5] both of which rely on good (regular or slightly biased) non-linear
S-boxes for their security.
2 Generalized Regularity
We now define formally the notion of generalized regularity. We generalize
the regularity notion by relaxing its condition, which allows us to consider
mappings with more output bits than input bits, i.e., those mappings from Vk
to Vm with k < m.
Let W be an l-dimensional linear subspace of Vm. From linear algebra, Vm can
be partitioned into 2m−l parts:
Vm = Π0 ∪ Π1 ∪ · · · ∪ Π2m−l−1, where Π0 = W , (1)
such that for any 0 ≤ j ≤ 2m−l − 1, β, γ ∈ Πj if and only if β ⊕ γ ∈ W . It
is known that Πj = 2
l, j = 0, 1, . . . , 2m−l. Each Πj is called a coset of W . It
2
should be noted that for a fixed W , the partition (1) is unique if the order of
the cosets is ignored.
Next we introduce the concept of a mapping regular with respect to a subspace.
Definition 1 Let P be a mapping from Vk to Vm, and W be an l-dimensional
linear subspace of Vm (0 ≤ l ≤ min{k,m}) and sj be zero or a positive integer,
i = 0, 1, . . . , 2m−l − 1, satisfying s0 + s1 + · · · + s2m−l−1 = 2
k−l. We say that
P is regular with respect to W and (s0, s1, . . . , s2m−l−1) if for each fixed j,
0 ≤ j ≤ 2m−l−1 and each vector γ ∈ Πj (defined in (1)), we have #{α|P (α) =
γ, α ∈ Vk} = sj. When the choice of (s0, s1, . . . , s2m−l−1) is not important, we
simply say that P is regular with respect to W .
Though trivial, two extreme cases need to be mentioned here.
Lemma 2 (i) Any regular mapping from Vk to Vm is a mapping regular with
respect to W = Vm.
(ii) For any given mapping P from Vk to Vm, there exists a subspace W of
Vm such that P is regular with respect to W .
PROOF. (i) If we set l = m, i.e., W = Vm in Definition 1, then any regular
mapping from Vk to Vm is a mapping regular with respect to W = Vm and
s0 = 2
k−m. Clearly we have k ≥ m in this case.
(ii) Let l = 0, i.e., W = {0}. Then P is regular with respect to W = {0}.
In general, from Definition 1, we know that P is unbiased for all the vec-
tors in each fixed coset Πj . We give an example to explain Definition 1. Let
m = k + 2 and l = k in Definition 1. Let P be a mapping from Vk to Vk+2
such that P (a1, . . . , ak) = (1, 0, a1, . . . , ak). Let W be a k-dimensional sub-
space such as W = {(0, 0, x1, . . . xk)| each xj ∈ GF (2)}. Set Π0 = W , Π1 =
{(0, 1, x1, . . . xk)| each xj ∈ GF (2)}, Π2 = {(1, 0, x1, . . . xk)| each xj ∈ GF (2)},
Π3 = {(1, 1, x1, . . . xk)| each xj ∈ GF (2)}. Hence Vk+2 = Π0 ∪ Π1 ∪ Π2 ∪ Π3
where Πj ∩ Πi = ∅, where ∅ denotes the empty set, if j 6= i. Note that
P (Vk) = Π2 where P (Vk) = {P (α)| α ∈ Vk}. Since P takes all vectors in Π2
once, but not any vector in Π0 ∪Π1 ∪Π3, P is a regular mapping with respect
to W and (s0, s1, s2, s3) where s0 = 0, s1 = 0, s2 = 1 and s3 = 0. Obviously P
is unbiased for all the vectors in any fixed Πj .
The following theorem indicates the existence of a mappings from Vk to Vm,
that is regular with respect to a given subspace W of Vm.
Theorem 3 Let m and k be two positive integers, W be an l-dimensional
linear subspace of Vm, and integers s0, s1, . . . , s2m−l−1 satisfy sj ≥ 0, j =
3
0, 1, . . . , 2m−l−1 and s0+s1+· · ·+s2m−l−1 = 2
k−l. Then there exists a mapping
from Vk to Vm, that is regular with respect to W and (s0, s1, . . . , s2m−l−1).
PROOF. Let R = {j|sj 6= 0, j = 0, 1, . . . , 2
m−l − 1} and write R =
{j1, . . . , jt}. Hence sj1 + · · · + sjt = 2
k−l. We choose µj1 ∈ Πj1, . . ., µjt ∈ Πjt ,
where each Πj has been defined in the partition (1). Divide Vk into t dis-
joint subsets: Vk = S1 ∪ · · · ∪ St such that Sj ∩ Si = ∅ whenever j 6= i
and #S1 = sj12
l, . . . ,#St = sjt2
l. Divide each Su into 2
l disjoint subsets:
Su = S
(1)
u ∪ · · · ∪ S
(2l)
u such that S
(j)
u ∩ S
(i)
u = ∅ whenever j 6= i and #S
(1)
u =
#S(2)u = · · ·#S
(2l)
u = sju . Write Πju = {γ
(1)
u , . . . , γ
(2l)
u }. Define a mapping P ,
from Vk to Vm, such that for each u, 1 ≤ u ≤ t and each i, 1 ≤ i ≤ 2
l,
P (Siu) = {γ
(i)
u }, where P (X) = {P (α)|α ∈ X}. Hence P is mapping from Vk
to Vm, that is regular with respect to W and (s0, s1, . . . , s2m−l−1).
A function is a mapping from Vk to GF (2) (or simply a function on Vk). The
truth table of a function f on Vk is a (0, 1)-sequence defined by (f(α0), f(α1),
. . ., f(α2k−1)), and the sequence of f is a (1,−1)-sequence defined by ((−1)
f(α0),
(−1)f(α1), . . ., (−1)f(α2k−1)). Let ã = (a1, · · · , a2k) and b̃ = (b1, · · · , b2k) be the
sequences of functions f and g on Vk respectively. The scalar product of ã
and b̃, denoted by 〈ã, b̃〉, is defined as 〈ã, b̃〉 = a1b1 ⊕ · · · ⊕ a2kb2k , where the
addition and multiplication are over the reals. An affine function f on Vk is
a function that takes the form of f(x1, . . . , xk) = a1x1 ⊕ · · · ⊕ akxk ⊕ c, where
aj , c ∈ GF (2), j = 1, 2, . . . , k. Furthermore f is called a linear function if
c = 0.
A (1,−1)-matrix N of order k is called a Hadamard matrix if NNT = kIk,
where NT is the transpose of N and Ik is the identity matrix of order k. A
Sylvester-Hadamard matrix of order 2k, denoted by Hk, is generated by the
following recursive relation
H0 = 1, Hk =



Hk−1 Hk−1
Hk−1 −Hk−1


 , k = 1, 2, . . . .
Let ℓi, 0 ≤ i ≤ 2
k − 1, be the i row of Hk. It is known that ℓi is the sequence
of a linear function ϕi(x) defined by the scalar product ϕi(x) = 〈αi, x〉, where
αi is the ith vector in Vk according to the ascending alphabetical order. The
Hamming weight of a (0, 1)-sequence ξ, denoted by HW (ξ), is the number
of ones in the sequence. Given two functions f and g on Vk, the Hamming
distance d(f, g) between them is defined as the Hamming weight of the truth
table of f(x) ⊕ g(x), where x = (x1, . . . , xk).
Let P (y) be a mapping from Vk to Vm, where y ∈ Vk. Write P (y) = (p1(y), . . .
4
, pm(y)), where each pj(y) is a function on Vk. We are concerned with all the
linear combinations of p1(y), . . . , pm(y), denoted by q0(y), q1(y), . . ., q2m−1(y),
where qj(y) =
⊕m
u=1 cupu(y) and (c1, . . . , cm) is the binary representation of an
integer j, j = 0, 1 . . . , 2m − 1.
Let Ri denote the sequence of qi(y), i = 0, 1, . . . , 2
m − 1. Define a 2m × 2k
(1,−1) matrix B∗ as follows:
B∗ =










R0
R1
...
R2m−1










= [h0, h1, · · · , h2k−1]
where Ri is the ith row and hj is the jth column of B
∗. One can verify that
each hj is the sequence of a linear function on Vm, i.e., a column of Hm.
Let L0, L1, . . . , L2m−1 be the row vectors, from the top to the bottom of Hm.
Assume that LTj appears in matrix B
∗ kj times as a column of B
∗. Using the
same argument as that in the Appendix of [7], we know that
(〈R0, R0〉, 〈R0, R1〉, . . . , 〈R0, R2m−1〉) = (k0, k1, . . . , k2m−1)Hm (2)
holds even for the case of k ≥ m or k < m. Note that Lj is the sequence of a
linear function on Vm, ψj(x) = 〈γj, x〉, where γj is the binary representation
of integer j, j = 0, 1, . . . , 2m − 1. Hence, from the definition of kj, kj is also
the number of times that P (y) goes through γj ∈ Vm. Since q0(y) is the zero
function on Vk, R0 is the all-one sequence. Hence 〈R0, Ri〉 is equal to the sum
of the components in Ri. As a result, we have 〈R0, Ri〉 = 0 if and only if qj is
balanced.
Let W be an l-dimensional linear subspace of Vm. From linear algebra, there
exists an (m − l)-dimensional linear subspace of Vm, denoted by W
∗, such
that each γ ∈ Vm can be uniquely expressed as γ = β ⊕ µ where β ∈ W and
µ ∈ W ∗. W ∗ is called a complementary subspace of W in Vm. Furthermore let
W ∗ be composed of µ0 = 0, µ1, . . . , µ2m−l−1 where each µj ∈W
∗. Then
Vm = (µ0 ⊕W ) ∪ (µ1 ⊕W ) ∪ · · · ∪ (µ2m−l−1 ⊕W ) (3)
where µ⊕W = {µ⊕γ|γ ∈W}, (µj⊕W )∩(µi⊕W ) = ∅ for all j 6= i. It should
be noted that W ∗ is not unique except for the special cases where W = Vn
and W = {0}. However, since the partition (1) is unique, (3) is identical to
(1) except for the order of the cosets.
The following Theorem is called the Generalized XOR Lemma.
5
Theorem 4 Let P (y) = (p1(y), . . . , pm(y)) be a mapping from Vk to Vm where
each pj(y) is a function on Vk, W be an l-dimensional linear subspace of Vm,
where l ≤ min{k,m}.
(i) If P (y) is regular with respect to W , then for any complementary W ∗
subset of W in Vm, and any (b1, . . . , bm) ∈ Vm with (b1, . . . , bm) 6∈ W
∗,
b1p1(y) ⊕ · · · ⊕ bmpm(y) is balanced.
(ii) If there exists a complementary subset W ∗ of W in Vm, such that for
any (b1, . . . , bm) ∈ Vm with (b1, . . . , bm) 6∈W
∗, b1p1(y)⊕ · · · ⊕ bmpm(y) is
balanced, then P (y) is regular with respect to W .
PROOF. First we consider the special case of W = {(0, . . . , 0, c1, . . . , cl) |
(0, . . . , 0, c1, . . . , cl) ∈ Vm} and W
∗ = {(d1, . . . , dm−l, 0, . . . , 0) | (d1, . . . ,
dm−l, 0, . . . , 0) ∈ Vm}. Note that each γ ∈ Vm can be uniquely expressed as
γ = (d1, . . . , dm−l, c1, . . . , cl). Set
j = u2l + v, 0 ≤ j ≤ 2m − 1, 0 ≤ u ≤ 2m−l − 1, 0 ≤ v ≤ 2l − 1 (4)
Hence (d1, . . . , dm−l) is the binary representation of u and (c1, . . . , cl) is the
binary representation of v.
Since Hm = Hm−l ×Hl, where × is the Kronecker Product [6], the jth row Lj
of Hm can be expressed as Lj = eu × ℓv, i.e., Lj = (a0ℓv, a1ℓv, . . . , a2m−l−1ℓv)
where eu = (a0, a1, . . . , a2m−l−1) is the uth row of Hm−l and ℓv is the vth row
of Hl.
Comparing the j terms in the two sides of equality (2), we obtain 〈R0, Rj〉 =
〈K,Lj〉 whereK = (k0, k1, . . . , k2m−1). RewriteK asK = (K0, K1, . . . , K2m−l−1)
where Ki = (ki·2l, ki·2l+1, . . ., ki·2l+2l−1), i = 0, 1, . . . , 2
m−l − 1. Hence
〈R0, Rj〉=
2m−l−1
∑
i=0
ai〈Ki, ℓv〉, where eu = (a0, a1, . . . , a2m−l−1) (5)
where u and v are defined in (4).
Suppose that P (y) is regular with respect to W . Then there exist integers
s0, s1, . . . , s2m−l−1, such that sj ≥ 0, i = 0, 1, . . . , 2
m−l − 1, s0 + s1 + · · · +
s2m−l−1 = 2
k−l, and P (y) is regular with respect to W and (s0, s1, . . . , s2m−l−1).
Hence Ki = si(1, . . . , 1), where i = 0, 1, . . . , 2
m−l − 1.
Consider γj = (d1, . . . , dm−l, c1, . . . , cl), where γj is the binary representation
of integer j and γj 6∈ W
∗. Note that γj 6∈ W
∗ implies (c1, . . . , cl) 6= (0, . . . , 0)
and hence v 6= 0, where v is defined in (4). Hence ℓv is (1,−1) balanced.
6
Since Ki = si(1, . . . , 1), i = 0, 1, . . . , 2
m−1 − 1, we have 〈Ki, ℓv〉 = 0 for i =
0, 1, . . . , 2m−1−1 and v 6= 0. From (5), 〈R0, Rj〉 = 0. This means qj is balanced,
where qj = d1p1(y) ⊕ · · · ⊕ dm−lpm−l(y) ⊕ c1pm−l+1(y) ⊕ · · · ⊕ clpm(y) with
(d1, . . . , dm−l, c1, . . . , cl) = γj 6∈ W
∗. By using a nonsingular linear transform
on the variables, we can change the special case of W and W ∗ to any general
case. This proves (i) of the theorem.
Conversely, let us assume that for every γj = (d1, . . . , dm−l, c1, . . . , cl) , where
γj is the binary representation of an integer j and γj 6∈ W
∗, qj is balanced,
where qj = d1p1(y) ⊕ · · · ⊕ dm−lpm−l(y) ⊕ c1pm−l+1(y) ⊕ · · · ⊕ clpm(y). Write
j = u2l + v where j, u and v are defined in (4). Hence (d1, . . . , dm−l) is the
binary representation of u and (c1, . . . , cl) is the binary representation of v.
Note that γj 6∈ W
∗, if and only if (c1, . . . , cl) 6= (0, . . . , 0), and v 6= 0. The
balance of qj implies that 〈R0, Rj〉 = 0. Hence from (5) we have
2m−l−1
∑
i=0
ai〈Ki, ℓv〉 = 0, where eu = (a0, a1, . . . , a2m−l−1) (6)
Since u (or eu, a row of Hm−l), can be arbitrary whenever 0 ≤ u ≤ 2
m−l − 1,
from (6), we conclude (〈K0, ℓv〉, 〈K1, ℓv〉, . . . , 〈K2m−l−1, ℓv〉)Hm−l = (0, 0, . . . , 0),
v = 1, . . . , 2l − 1, from which we have 〈Ki, ℓv〉 = 0, where v = 1, . . . , 2
l − 1,
i = 0, 1, . . ., 2m−l − 1.
We fix i with 0 ≤ i ≤ 2m−l − 1. Note that both 〈Ki, ℓv〉 = 0 and 〈ℓ0, ℓv〉 = 0
hold for v = 1, . . . , 2l − 1. Recall Hl is a Hadamard matrix. Hence Ki = siℓ0
must hold for an integer si with si ≥ 0. Recall ℓ0 = (1, . . . , 1). Hence Ki =
si(1, . . . , 1) and s0 + s1 + · · · + s2m−l−1 = 2
k−l. By using a nonsingular linear
transform on the variables, one can show that Part (ii) of the theorem also
hold more general W and W ∗. This completes the proof for the theorem.
It should be noted that Theorem 4 will be trivial when P is regular with
respect to W = {0}, as in this case we have W ∗ = Vm. Another fact is that
the XOR Lemma is a special case of Theorem 4. In fact, by letting k ≥ m
and l = m in Theorem 4, we have W = Vm and W
∗ = {0} and Theorem 4
becomes the XOR Lemma.
Acknowledgement
The authors would like to thank reviewers for their comments and suggestions
that helped improve the presentation of this paper.
7
References
[1] C. Adams. The cast-128 encryption algorithm. Request for Comments RFC
2144, IETF, 1997.
[2] C. H. Bennett, G. Brassard, and J. M. Robert. Privacy amplification by public
discussion. SIAM J. Computing, 17:210–229, 1988.
[3] Benny Chor, Oded Goldreich, Johan H̊astad, Joel Friedman, Steven Rudich, and
Roman Smolensky. The bit extraction problem or t-resilient functions. IEEE
Symposium on Foundations of Computer Science, 26:396–407, 1985.
[4] Rudoff Lidl and Harald Niederreiter. Finite Fields, Encyclopedia of Mathematics
and Its Applications. Cambridge University Press, 1983.
[5] A. Menezes, P. Oorschot, and S. Vanstone. Handbook of Applied Cryptology.
CRC Press, Inc., 1997.
[6] R. Yarlagadda and J. E. Hershey. Analysis and synthesis of bent sequences. IEE
Proceedings (Part E), 136:112–123, 1989.
[7] X. M. Zhang, Y. Zheng, and Hideki Imai. Relating differential distribution tables
to other properties of substitution boxes. Designs, Codes and Cryptography,
19:45–63, 2000.
8


The Generalized XOR Lemma

http://citeseerx.ist.psu.edu/viewdoc/download;jsessionid=09A1BD12B99F5EB3609AB55F9BB379BF?doi=10.1.1.1052.9397&rep=rep1&type=pdf

The Generalized XOR Lemma

Abstract

Similar works

Full text

Available Versions

CiteSeerX