We are using the group-theory methods for justification of
algebraic method in cryptanalysis. The obtained results are using
for investigation of  Boolean functions cryptographic properties

A. A.  Salnikov

O. A.  Logachev

V. V.  Yaschenko

Cryptology ePrint Archive

Polyhedrons over Finite Abelian Groups andTheir Cryptographic Applications∗Logachev O.A. Salnikov A.A. Yaschenko V.V.Institute for Information Security Issues of Moscow University,RUSSIAorfeo@rambler.ru1 IntroductionThe algebraic method for stream-cipher key recovering was developedin [5]. The essence of this method is in solving the system of nonlinear equa-tions which are the simplified consequences of the enciphering equations.The different questions on this method were investigated in [5, 6, 7]. Weare using the group-theory methods for justification of algebraic method incryptanalysis. We are considering the case of general Abelian group trans-formations instead of elementary Abelian 2-groups transformations. On thegroup-theory setting we consider the embedding of a subset into a certaincoset of Abelian group. We apply those results for investigation of Booleanfunctions cryptographic properties.2 Polyhedrons over Finite Abelian GroupsLet G be a finite Abelian group with respect to the multiplicative oper-ation; by N we denote the order of G. Let Ĝ be the character group of G.For any set D ⊆ G let ZD be the complex-valued map of Ĝ such thatZD(χ) =∑x∈Dχ(x) ,∗Partially supported by Russian Found on Basic Research (project numbers 02-01-00581 and 02-01-00687)1for all χ ∈ Ĝ. The set D is uniquely defined by ZD since orthogonal relationsfor group characters (see [2]):1N∑χ∈ bG ZD(χ)χ(y−1) ={1, if y ∈ D,0, if y 6∈ D.For values ZD(χ) we have the equation similar to Parseval equation forFourier coefficients of finite Abelian group (see [2]):∑χ∈ bG |ZD(χ)|2 =∑χ∈ bG∑x,y∈Dχ(x)χ(y) =∑x,y∈D∑χ∈ bG χ(xy−1) = N ·#D . (1)Using equation (1) we getLemma 1. The set D coincides with the group G iffZD(χ) =∑x∈Dχ(x) = 0 for all χ ∈ Ĝ, χ 6= χ0.Proof. If we distinguish in the sum∑χ∈ bG |ZD(χ)|2 the summand for χ = χ0then from (1) we obtain∑χ∈ bGχ 6=χ0|ZD(χ)|2 = #D (N −#D) . (2)Therefor, #D = N iffZD(χ) = 0 for all χ ∈ Ĝ, χ 6= χ0.¥Any coset in finite Abelian group we will call polyhedron in order todistinguish them among all subsets. This term will help us to use in somecases geometric intuition. A useful tool for structure investigation of a finiteAbelian group subset is it’s ”localization” by imbedding into the least possiblepolyhedron. More formally the task of ”localization” is formulated in thefollowing way: for any set D ⊆ G find the least subgroup H < G such thatD ⊆ x0H for some x0 ∈ D. We will use the following notions.D̂ ={χ ∈ Ĝ | χ(x) = const for any x ∈ D},A(D̂)={x ∈ G | χ(x) = 1 for any χ ∈ D̂}.It is obvious that D̂ is subgroup in Ĝ and that A(D̂) is subgroup in G.2Theorem 2. A(D̂) is the least subgroup among all subgroups H of group Gfor whichx−10 D ⊆ H for some x0 ∈ D.Proof. To each subgroup H of group G assign the subset H∗ of group ĜH∗ ={χ ∈ Ĝ | χ(x) = 1 for any x ∈ H}.It is well known [1] that the map H 7→ H∗ is antiisomorphism for subgroupsstructures of group G and group Ĝ. For the set D ⊆ G consider two set ofsubgroupsG(D) ={H < G | x−10 D ⊆ H for some x0 ∈ D},Ĝ(D) = the set of all subgroups of the group D̂ .Let’s proof that the map H 7→ H∗ is the antiisomorphism from G(D) toĜ(D). If H ∈ G(D) then for any χ ∈ H∗ and y ∈ D we have χ(x−10 y) = 1.The last equation holds iff any character χ ∈ H∗ is constant on the set Dand this means that H∗ ∈ Ĝ(D). It easy to check that the inverse inclusionis held. Note that (A(D̂))∗= D̂ .As the map H 7→ H∗ is antiisomorphism and D̂ is the greatest element inĜ(D) then A(D̂)is the least element in G(D). ¥Note that the function ZD(χ) is helpful for searching the set D̂ due tothe following evident equationsD̂ ={χ ∈ Ĝ | |ZD(χ)| = #D}.The absolute value of function ZD(χ) is constant on the cosets Ĝ for D̂because for any χ′ ∈ D̂ and any χ ∈ Ĝ and some x0 ∈ D we getZD(χχ′) = ZD(χ)χ′(x0) .It is evident that in the last equation it is sufficient to consider χ from thecharacter group of the group A(D̂). Using the last remarks, lemma 1 andtheorem 2 it is easy to proof the following theorem.Theorem 3. The set D ⊆ G is polyhedron in group G iff the absolute valueof function ZD(χ) over Ĝ takes only two values — 0 or #D.33 Applications for Boolean FunctionsNow we consider applications of those results for investigation of Booleanfunctions’ cryptographic properties. We will use the notions and resultsfrom [8]. Let G = Vn be n-dimensional vector space over the field of twoelements, Ĝ ={(−1)〈,x〉 | α,x ∈ Vn}, 〈α,x〉 = α1x1 + . . . + αnxn, D ={x ∈ Vn | f(x) = 1 }, where f(x) is a Boolean function. ThenZD(χ) = Zf (α) =∑x:f(x)=1(−1)〈,x〉 ==12(∑x∈Vn(−1)〈,x〉 −∑x∈Vn(−1)f(x)+〈,x〉)==2n−1 − 12Wf (0), α = 0;−12Wf (α), α 6= 0,where Wf (α) is the Walsh-Hadamard coefficients and thenD̂ ={α ∈ Vn | α 6= 0, |Wf (α)| = 2n −Wf (0)} ∪ {0 } . (3)Polyhedrons in Vn are cosets with respect to subspaces of Vn or in the termsof finite geometries they are plains.Theorem 3 for Boolean case is formulated in the following way.Corollary 4. Function f(x) is indication-function for a coset of k-dimensionalsubspace iff |Wf (α)| for all α ∈ Vn, α 6= 0 takes only two values 0 and 2k+1.Let α1, . . . , αk ∈ Vn be a basis of subspace D̂ defined by (3), x0 ∈ Vn isan arbitrary vector such that f(x0) = 1. ThenA(D̂)= {x ∈ Vn | 〈αi, x〉 = 0, i = 1, . . . , k } ,and theorem 2 states, that if f(x) = 1 then 〈αi,x〉 = 〈αi,x0〉, i = 1, . . . , k.In other words, the truth set of Boolean function f(x) is embedded into theplain defined by the following linear equations〈α1,x〉 = 〈α1,x0〉,. . .〈αk,x〉 = 〈αk, x0〉.(4)So, for Boolean functions theorem 2 can be reformulated in the followingway.4Theorem 5. For any Boolean function f(x) there is a decompositionf (x1, . . . , xn) == (〈α1,x + x0〉+ 1) · . . . · (〈αk,x + x0〉+ 1) ψ (〈αk+1,x〉 , . . . , 〈αn, x〉) .(5)Decomposition (5) for function f(x) defined uniquely in the following sense— α1, . . . , αk is an arbitrary basis of a subspace uniquely defined for func-tion f(x);— αk+1, . . . , αn is an arbitrary complementation of α1, . . . , αk for basisof Vn;— x0 ∈ Vn is an arbitrary vector such that f(x) = 1;— Boolean function ψ(y1, . . . , yn−k)over n− k variables can’t be decom-posed in the form of (5) and defined uniquely for the function f(x).Clear that it is more easy to investigate the properties of function f(x)when it is decomposed in the form (5). Particulary, decomposition (5) isconnected with the annihilator group introduced in [5, 6, 7] for algebraicmethod of cryptanalysis. Function ϕ(x) is called annihilator for functionf(x) if for all x ∈ Vn the following equation hold:ϕ(x)f(x) = 0 .From the previous the following statement is evident.Corollary 6. Let function f(x) be decomposed in the form (5). Then theaffine annihilator group for function f(x) coincides with the linear span of theaffine functions set 〈α1,x〉 + 〈α1,x0〉, . . . , 〈αk,x〉 + 〈αk, x0〉, and functionψ(y1, . . . , yn−k)has a trivial affine annihilator group (i.e. only the zero-function).So, all the previous constructions lead to the algorithm for searching of allaffine annihilator for a given Boolean function f(x) from it’s Walsh-Hadardcoefficients Wf (α). It is interesting to find other annihilator for functionf(x) from it’s Walsh-Hadard coefficients.Theorem 7. Boolean function ϕ(x) is annihilator for function f(x) iff oneof two equivalent conditions hold:1. Wf (0) + Wϕ(0)−Wf+ϕ(0) = 2n;52. Wf (α) + Wϕ(α)−Wf+ϕ(α) = 0 for all α ∈ Vn, α 6= 0.Proof. From following evident equation(−1)f(x)ϕ(x) = (−1)0 + (−1)f(x) + (−1)ϕ(x) − (−1)f(x)+ϕ(x)2,for all α ∈ Vn we getWfϕ(α) =12(W0(α) + Wf (α) + Wϕ(α)−Wf+ϕ(α)) . (6)Equation f(x)ϕ(x) ≡ 0 hold iff one of two equivalent conditions hold:1. Wfϕ(0) = 2n;2. Wfϕ(0) = 0 for all α ∈ Vn, α 6= 0.Then from (6) we get the theorem. ¥Sometimes it is more convenient to put down the terms of theorem 7 inthe following symmetric form:1. Wf+ϕ+1(0) = 2n − (Wf (0) + Wϕ(0));2. Wf+ϕ+1(α) = −(Wf (α) + Wϕ(α))for all α ∈ Vn, α 6= 0.It easy to see that if f(x)ϕ(x) ≡ 0, then Wf (0) + Wϕ(0) > 0. MoreoverWf (0)+Wϕ(0) = 0 iff f(x)+ϕ(x) ≡ 1. Annihilator f(x)+1 is called trivial .From theorem 7 it is easy to getCorollary 8. Functionϕ(x) ={1, if x ∈ L + x0;0, if x 6∈ L + x0,is annihilator for Boolean function f(x) iff∑∈L⊥(−1)〈,x0〉Wf (γ) = 2n .Corollary 9. There are no affine annihilator for nonaffine plateatued andnonaffine balanced Boolean functions.6Proof. All affine annihilator 〈α,x〉+ε, α 6= 0 for function f(x) are describedby (3): ∣∣Wf (α)∣∣ = 2n −Wf (0) .If function f balanced, i.e. Wf (0) = 0 and has affine annihilator then∣∣Wf (α)∣∣ = 2n i.e. f is affine.Plateaued of order 2r functions defined by the condition [3, 4]:∣∣Wf (α)∣∣ takes only two values 0, 2n−r.Then it is evident that if r 6= 0, i.e. function is not affine, then condition (3)do not held for every α. ¥In particular quadratic Boolean functions do not have affine annihilator.Corollary 10. Two nonaffine plateaued functions with nonintersecting sup-ports do not annihilate each other.Proof. Since the supports of f and ϕ don’t intersect, i.e. Wf (α)Wϕ(α) = 0for all α ∈ Vn, thenWf+ϕ(0) =12n∑∈VnWf (α)Wϕ(α) = 0 .Hence f and ϕ annihilate each other iffWf (0) + Wϕ(0) = 2n .It contradict to the conditions of 10. ¥Lemma 11. Let f(x)ϕ(x) ≡ 0 f(x), ϕ(x) be a bent-function f(x) +ϕ(x) + 1 6≡ 0. Then f(x) + ϕ(x) + 1 is indicator-function for coset ofn/2-dimensional subspace.Proof. From conditions of theorem 7 the lemma we obviously getWf+ϕ+1(0) = 2n − 2n/2+1,Wf+ϕ+1(α) ∈{0,±2n/2+1 } for any α 6= 0.The last equations and the conditions of 4 get lemma. ¥Corollary 12. If f(x), ϕ(x) is bent-function, deg ff < n/2 and f(x) +ϕ(x) 6≡ 1 then functions f(x) and ϕ(x) do not annihilate each other.7Lemma 13. Let f(x) be a plateaued of order 2r function and ϕ(x) be aplateaued of order 2s. If r > 2, s > r + 1 or r = 1, s > 3 then functionsf(x) and ϕ(x) do not annihilate each other.Proof. Suppose contrary. Then from the conditions of theorem 7 we get|2n − (Wf (0) + Wϕ(0))| = |Wf+ϕ+1(0)| 6 max∈Vn|Wϕ(α)| .12n∑∈Vn|Wϕ(α)| = 2n−s · 12n· 2n−r · 22r = 2n−s+r . (7)Obviously there are 4 possible values of Wf (0) + Wf (0). Put them in in-creasing order:2n−s 6 2n−r − 2n−s < 2n−r < 2n−s + 2n−r .Hence the least possible value for |2n − (Wf (0) + Wϕ(0))| is 2n−2n−s−2n−r.If we proof inequality2n − (2n−s + 2n−r) > 2n−s+r , (8)then we will get a contradiction with inequality (7) and hence we will prooflemma. Inequality (8) is equivalent to inequality2n − 2n−s+r > 2n−s + 2n−r ,which is equivalent to inequality2r >2s + 2r2s − 2r = 1 +22s−r − 1 .The right part of the last inequality monotone decreasing when s−r increas-ing and hence inequality (7) is held. ¥Remark 14. We have to consider two more cases to answer the questionwhen do two plateaued functions annihilate each other:1. r = 1, s = 2;2. r = s.8References[1] Birkhoff G. Lattice Theory. 3-d Edition, Amer. Math. Soc., Providence,R.I., 1967.[2] Serre G.-P. Representations Lineares des Groupes Finit. CollectionMethodes, Hermann, Paris, 1967.[3] Zheng Y., Zhang X.-M. On Plateaued Functions. IEEE Trans. on Infor-mation Theory, V. 47, No. 3, Pp. 1215–1223, 2001.[4] Carlet C., Prauff I.E. . On Plateaued Functions and their Constructions.FSE’2003.[5] Courtois N.T., Meier W. Algebraic Attacks on Stream Cipher with LinearFeedback. EUROCRYPT’2003, LNCS 2656, PP. 345–369, 2003.[6] Courtois N.T. Fast Algebraic Attacks on Stream Cipher with LinearFeedback. CRYPTO’2003, LNCS 2729, PP. 176–194, 2003.[7] Meier W., Pasalic E., Carlet C. Algebraic Attacks and Decompositionof Boolean Functions. EUROCRYPT’2004, LNCS 3027, PP. 474–491,2004.[8] Logachev O.A., Salnikov A.A., Yaschenko V.V. Boolean Functions inCoding Theory and Cryptology. MCCME, Moscow, 2004. (in Russian)9

Polyhedrons over Finite Abelian Groups and Their Cryptographic Applications

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive