In this paper we prove all balanced symmetric Boolean functions of fixed degree are trivial when the number of variables grows large enough. We also present the nonexistence of trivial balanced elementary symmetric Boolean functions except for $n=l\cdot2^{t+1}-1$ and $d=2^t$, where $t$ and $l$ are any positive integers, which shows Cusick\u27s conjecture for balanced elementary symmetric Boolean functions is exactly the conjecture that all balanced elementary symmetric Boolean functions are trivial balanced. In additional, we obtain an integer $n_0$, which depends only on $d$, that Cusick\u27s conjecture holds for any $n>n_0$

Guangpu Gao

Yaqun Zhao

Yingming Guo

Cryptology ePrint Archive

1Recent Results on Balanced SymmetricBoolean FunctionsYingming Guo, Guangpu Gao, Yaqun ZhaoAbstractIn this paper we prove all balanced symmetric Boolean functions of fixed algebraic degree are trivial when thenumber of variables grows large enough. We also present the nonexistence of trivial balanced elementary symmetricBoolean function except for n = 2t+1l − 1 and d = 2t, where t and l are any nonnegative integers, which showsCusick’s conjecture for balanced elementary symmetric Boolean function is exactly the conjecture that all balancedelementary symmetric Boolean functions are trivial. In additional, we obtain a bound n0, which depends only on thealgebraic degree, such that Cusick’s conjecture holds for any n > n0.Index TermsCryptography, Boolean functions, Balancedness, Symmetric, Elementary symmetric functionsI. INTRODUCTIONBoolean functions play an important role in the design of symmetric cryptographic systems. They are used forS-Box design in block cipher and utilized as nonlinear filters and combiners in stream ciphers. Symmetric Booleanfunctions, which have the property that their outputs only depend on the Hamming weight of their inputs, are aninteresting subclass of Boolean functions for their advantage in both implementation complexity and storage space.In [1], Canteaut and Videau studied in detail symmetric Boolean functions. They established a link between theperiodicity of simplified value vector of a symmetric function and its algebraic degree. Cai et al. computed a closedformula for the correlation between any two symmetric Boolean functions in terms of their periods [5]. Castro etal. improved the formula for computing the exponential sums of symmetric Boolean functions [2](also see, Lemma1).Balancedness is a primary requirement to resist the attacks on each cryptosystem. In [8], Gathen and Rouche foundall the balanced symmetric boolean functions up to 128 variables. Canteaut et al. proved that balanced symmetricfunctions of degree less than or equal to 7(excluding the trivial cases) only exist for eight variables [1]. Since thenumber of nontrivial balanced functions seems to be very small, they conjectured that balanced symmetric functionsThis work is supported by National Program on Key Basic Research Project (973 Program No. 2012CB315905).The authors are with the Department of Applied Mathematics, Zhengzhou Information Science and Technology Institute, P.O. Box 1001-741,Zhengzhou 450002, China (e-mail:guoyingming123@gmail.com).DRAFT2of fixed degree do not exist when the number of variables grows. For elementary symmetric Boolean functions,Cusick et al. proposed a conjecture in [3] about the nonexistence of nonlinear balanced elementary symmetricBoolean functions σn,d except for n = l · 2t+1 − 1 and d = 2t, where t and l are any positive integers. They alsoobtained many results towards the conjecture in [4]. Later in [6] Gao et al. proved that when n = 3 mod 4, thefunction is balanced if and only if d = 2k, 1 ≤ k ≤ t. It was proved in [4] that Cusick’s conjecture [3] [4] holdsfor sufficient large number of variables, but a certain bound had not been obtained.The paper is organized as follows. Some basics on Boolean functions are introduced in Section II. We discussthe asymptotic behavior of symmetric Boolean functions in Section III. We present the equivalence of Cusick’sconjecture and some other results on balanced symmetric Boolean functions in Section IV. We end in Section Vwith a conclusion.II. PRELIMINARIESLet Fn2 be the vector space of n-tuples over the Field F2 = {1, 0} of two elements. We denote by ⊕ the sum overF2. A Boolean function of n variables is a mapping from Fn2 into F2. A Boolean function is said to be symmetricif its output is invariant under any permutation of its input bits. We denote by Bn (resp. SBn) the set of all Booleanfunctions (resp. symmetric Boolean functions) of n variables. If f : Fn2 → F2, then f can be uniquely representedas a multivariate polynomial over F2, called algebraic normal form (ANF):f(x1, · · · , xn) =⊕µ∈Fn2λµ(n∏i=1xµii), with λµ =⊕xµf(x)Where (x1, · · · , xn)  (µ1, · · · , µn) if and only if ∀i, xi ≤ µi. The addition and multiplication operations arein F2. The number of variables in the highest order product term with nonzero coefficient is called its algebraicdegree (denoted by deg(f) ).Definition 1: For integers n and d, the elementary symmetric Boolean function with n variables σn,d is definedas the sum of all terms of degree d, that isσn,d =⊕1≤i1≤···≤id≤nxi1 · · ·xid .If f(x) = σn,d, then vf (i) =(id)mod 2.A Boolean function of n variables is symmetric if and only if its algebraic normal form can be written as follows:f(x1, · · · , xn) =n⊕i=0λf (i) ⊕µ∈Fn2 wH(µ)=in∏j=1xµjj=n⊕i=0λµσn,i,Where σn,i is the elementary symmetric polynomial of degree i in n variables.A Boolean function is said to be affine if its algebraic degree does not exceed 1. The set of all n-variableaffine functions is denoted by A(n). The Hamming weight wH(x) of a binary vector x ∈ Fn2 is the number ofits nonzero coordinates, and the Hamming weight wH(f) of a Boolean function f is the size of its support{x ∈DRAFT3Fn2 | f(x) = 1}. If wH(x) = 2n−1, we call f(x) balanced. The Hamming distance between two functionsf, g ∈ Bn, denoted by d(f, g) is defined as d(f, g) = wt(f ⊕ g). A symmetric function can be represented by avector vf = (vf (0), · · · , vf (n)), where vf (i) = f(x) for x ∈ Fn2 with Hamming weight wH(x) = i. It was provedthat for any f ∈ SBn, vf is periodic with period 2t, 2t < n, if and only if deg(f) ≤ 2t − 1; deg(f) = 2t if andonly if vf is periodic with period 2t+1 and is a part of (vf (0), · · · , vf (2t − 1), vf (0) ⊕ 1, · · · , vf (2t − 1) ⊕ 1)∞[1].Definition 2: For any f ∈ Bn, we denote by F(f) the following value related to the Fourier transform of fF(f) =∑x∈Fn2(−1)f(x) = 2n − 2wH(f).Definition 3: [1] Let n be an odd integer and f ∈ SBn. We say that f is a trivial balanced function ifvf (i) = vf (n− i) + 1, 0 ≤ i ≤ n.The even case corresponds to affine functions.For an arbitrary positive integer n, we denote its 2-adic expression by n =∑li=0 ni2i. Let a, b be positiveintegers, we denote a  b if for all i(0 ≤ k ≤ l), ai ≤ bi and otherwise a 6 b. The Lucas formula says [7, p. 79],(nk)=(n0k0)(n1k1)· · ·(nlkl)mod 2. Let f(x) = σn,d, by Lucas formula, vf (i) = 1 if and only if d  i.It was proved that if σn,d is balanced, then d ≤ dn2 e [3].III. ASYMPTOTIC BEHAVIOR OF SYMMETRIC BOOLEAN FUNCTIONSIn this section, we characterize the behavior of symmetric Boolean functions with large number of variables. Asa consequence of our discussion using the technique for the correlation of symmetric functions in [5], we provethe following conjecture.Conjecture 1: [1, VIII] Excluding the trivial cases, balanced symmetric functions of fixed degree do not existwhen the number of variables grows.To prove Conjecture 1, we introduce the following lemma.Lemma 1: [2] Let f(x) = σn,ks + · · ·+ σn,k1 , 1 ≤ k1 ≤ · · · ≤ ks and let r = blog2 ksc+ 1. F(f) is given byF(f) =n∑i=0(−1)vf (i)(ni)=12r2r−1∑j=0sjλnj , (1)where ξj = exp(π√−1j2r−1), λj = 1 + ξ−1j , and1sj =2r−1∑i=0(−1)vf (i)ξij .1Here we correct typos of the paper [2], where λj = 1 + ξj should be λj = 1 + ξ−1j and sj =∑2r−1i=0 (−1)vf (i)ξ−ij should besj =∑2r−1i=0 (−1)vf (i)ξij .DRAFT4If f is not affine, then r ≥ 2. Note that ξ2r−j = ξj , s2r−j = sj , λ2r−j = λj and λ2r−1 = 0. We have thefollowing observation on Lemma 1:2r−1F(f) = 122r−1∑j=0sjλnj=12s0λn0 +2r−1−1∑j=1Re(sjλnj)(2)where the second equality holds because the second half of the j-sum (2r−1 ≤ j ≤ 2r−1)is the complex conjugateof the first half. Let us definetj(n) =12r−1Re(sjλnj), 0 ≤ j ≤ 2r−1 − 1.ThusF(f) = 12t0(n) +2r−1−1∑j=1tj(n). (3)If F(f) = 0, there are potentially two reasons for this: either all the tj(n) are zero or several nonzero tj(n)( 12 tj(n) for j = 0) can cancel each other. The next lemma states that the latter cannot happen for large enough n.However, we should point out that the following lemma, although having a different tj(n), contributes to Cai etal. [5].Lemma 2: Let f ∈ SBn, and f is not affine. There exists an integer n0 such that for any n > n0,F(f) = 0⇔ tj(n) = 0, 0 ≤ j ≤ 2r−1 − 1. (4)Proof: Suppose F(f) = 0. We can express tj(n) as 2tj(n) =12r−1|sj |∣∣∣∣2 cos(πj2r)∣∣∣∣n cos(arg(sj)− πnj2r). (5)Clearly, we havetj(n) ≤12r−1|sj |∣∣∣∣2 cos(πj2r)∣∣∣∣n .On the other hand, if tj(n) 6= 0, since the cosine is periodic in n, for any j there exists a constant cj > 0 (cj doesnot depend on n) such thattj(n) ≥ cj∣∣∣∣2 cos(πj2r)∣∣∣∣n .Hence, each |tj(n)| is either zero or in a constant range of∣∣2 cos (πj2r )∣∣n.Since when n is large enough,∣∣2 cos (πj2r )∣∣n dominates ∣∣∣2 cos(π(j+1)2r )∣∣∣n for any j < 2r − 1, any tj(n) 6= 0dominates all the tj′(n) for j < j′ < 2r−1. Thus if j0 is the least j such that tj(n) 6= 0, then the subsequent termscannot cancel tj0(n) (12 tj0(n) for j0 = 0), and hence, F(f) 6= 0. Therefore, tj(n) = 0, for all 0 ≤ j ≤ 2r−1−1.2Any complex number z 6= 0 can uniquely be written as z = |z|(cosϕ+ i sinϕ) = |z|eiϕ. where 0 ≤ ϕ ≤ 2π. ϕ is called the argumentof z, ϕ = arg z. Hence Re(z) = |z| cos arg(z)DRAFT5If sj 6= 0, then for any j, 0 ≤ j ≤ 2r−1 − 1, we havetj(n) = 0⇔ cos(arg(sj)−πnj2r)= 0⇔ ∃l arg(sj)−πnj2r=π2+ lπ⇔ ∃l exp (2i arg(sj)) = exp(2i(πnj2r+π2+ lπ))⇔ |sj | exp (i arg(sj))=−|sj | exp (−i arg(sj)) exp(πi2rnj)⇔ sj = −ξnj sj (6)Note that if sj = 0, we get tj(n) = 0, sj = −ξnj sj = 0. Thustj(n) = 0⇔ sj = −ξnj sj , 0 ≤ j ≤ 2r−1 − 1. (7)holds no matter whether sj is zero.Next, we have the following lemma.Lemma 3: Let f ∈ SBn and f is not affine. The following properties are equivalent.(i) sj = −ξnj sj , 0 ≤ j ≤ 2r − 1,(ii) vf (i) = 1⊕ vf (n− i) , 0 ≤ i ≤ 2r − 1.Proof: If property (ii) is true, then it is clear thatsj =2r−1∑i=0(−1)vf (n−i)+1ξij , (8)Since (−1)vf (i)ξij has period 2r, 0 ≤ j ≤ 2r − 1, thus−ξnj sj = −ξnj2r−1∑i=0(−1)vf (i)ξ−ij= −ξnjn+2r−1∑i=n(−1)vf (i)ξ−ij= −n+2r−1∑i=n(−1)vf (i)ξn−ij=2r−1∑i=0(−1)vf (n−i)+1ξij = sj (9)If property (i) is true, then for any 0 ≤ j ≤ 2r − 1,2r−1∑i=0(−1)vf (i)ξij =2r−1∑i=0(−1)vf (n−i)+1ξij (10)Note that these sums are the Fourier transforms of the functions f(i) and f(n− i), respectively. We can performan inverse Fourier transform by using the relation2r−1∑j=0,j 6=2r−1ξi−i′j = 2r − 1 , i = i′(−1)i−i′+1 , i 6= i′ (11)DRAFT6Now multiply the left and right hand sides of equation (10) by ξ−i′j and sum over j from 0 to 2r − 1. Then wehave2r(−1)vf (i′) −2r−1∑i=0(−1)vf (i) = 2r(−1)vf (n−i′)+1 −2r−1∑i=0(−1)vf (n−i)+1Since∑2r−1i=0 (−1)vf (n−i)+1 = −∑2r−1i=0 (−1)vf (i), thus(−1)vf (i′) + (−1)vf (n−i′) =12r−12r−1∑i=0(−1)vf (i) (12)The left hand side can be ±2 or 0. If it is ±2, then f is constant, which contradicts to the hypothesis. Hence, theleft hand side is 0 and we conclude (−1)vf (i′) = (−1)1+vf (n−i′). The property (ii) follows.Now we prove Conjecture1.Theorem 1: For large enough n, balanced symmetric functions of fixed degree are trivial.Proof: The case that f ∈ SBn being affine is clear, we now assume that f is a non-affine function.Let f be a non-affine function with period 2r. Following Lemma 1 to Lemma 3, there exists an integer n0such that for any n > n0,F(f) = 0⇔ vf (i) = 1⊕ vf (n− i), i = 0, · · · , 2r − 1.Note that when n is even, we get vf (n2 ) = 1 + vf (n2 ), which is a contradiction. That is, for sufficient large n,non-affine balanced symmetric functions are trivial for odd n and do not exist for even n. Therefore, Theorem 1is proved.IV. THE EQUIVALENCE OF CUSICK’S CONJECTUREIn this section, we show the conjecture for elementary symmetric Boolean functions is equal to the conjecturethat all balanced elementary symmetric Boolean functions are trivial balanced. Associating with the theorem in lastsection, we present the conjecture is validated with sufficient large number of variables.Conjecture 2: [3] There are no nonlinear balanced elementary symmetric Boolean functions except for σl·2t+1−1,2t ,where t and l are any positive integers.As mentioned in the proof of Theorem 3 in [3], f(x) = σl·2t+1−1,2t(x) is trivial balanced. In the followingtheorem we prove that all trivial balanced elementary symmetric Boolean functions are of the form σl·2t+1−1,2t .Theorem 2: There are no trivial balanced elementary symmetric Boolean functions except for σl·2t+1−1,2t , wheret and l are any nonnegative integers.Proof: Supposed f(x) = σn,d(x) is trivial balanced. If d = 1, the conclusion follows regardless of the parityof n. Let d > 1, than n must be odd, and vf (i) = vf (n− i), 0 ≤ i ≤ n. Since vf (i) =(id)mod 2 and vf (i) = 1if and only if d  i, we get either d  i or d  (n− i).Let the 2-adic expressions of d, n be d =∑ti=0 di2i, n =∑ki=0 ni2i, k > t and d = dt · · · d0, n = nk · · ·n0.We argue that d = 2t. Otherwise, suppose dt, dj are ones(i.e. d = 1t · · · 1j · · · ). On the one hand, let i =DRAFT70t · · · 1j 0j−1 · · · 00︸ ︷︷ ︸0. Since d  i, we get d  (n − i), which implies nj = 0. On the other hand, let i′ =1t · · · 0j · · · 00︸ ︷︷ ︸0. Since d  i′,we get d  (n− i′), which implies nj = 1. It is a contradiction.Furthermore, we claim that n = l · 2t+1 − 1 (i.e. n = nk · · ·nt+1 1t · · · 10︸ ︷︷ ︸1). Otherwise, suppose nj is the firstzero from the t-th bit to the last bit(i.e. n = nk · · ·nt+1 1t · · · 1j+1︸ ︷︷ ︸10jnj−1 · · ·n0). Let i = 0t 1t−1 · · · 1j︸ ︷︷ ︸10j−1 · · · 00︸ ︷︷ ︸0,then we get n− i = nk · · ·nt+10t 1t−1 · · · 1j+11j︸ ︷︷ ︸1nj−1 · · ·n0, so both d  i and d  n − i are false, which is acontradiction.Hence, we conclude that all trivial balanced elementary symmetric Boolean functions are of the form σl·2t+1−1,2t .Remark 1: By Theorem 2, Conjure 2 shows in essence that all balanced elementary symmetric Booleanfunctions are trivial balanced. According to Theorem 1 and Theorem 2, we conclude that there exists an integern0 such that Conjure 2 holds for any n > n0.At the end of the section, we give an estimation for n0. Let f(x) = σl·2t+1−1,2t(x). By the equation (2) in [1],we getF(f)=2r−1∑i=0(−1)vf (i)2n−r + 21−r 2r−1−1∑j=1(2cj)nc′j= 2n−r2r−1∑i=0(−1)vf (i) + 22r−1−1∑j=12r−1∑i=0(−1)vf (i)cnj c′jwhere cj = cos(j π2r), c′j = cos(j(n− 2i) π2r). It is exactly the equation (3), where for 0 ≤ j ≤ 2r−1 − 1, Aj =jπ2r (n− 2i),tj(n) = 2n−r+1 cosn(jπ2r) 2r−1∑i=0(−1)(id) cosAj . (13)If t0(n) ≥ 2j+1|tj(n)|, it is obvious that F(f) = 0 if and only if t0(n) = tj(n) = 0, 1 ≤ j ≤ 2r−1 − 1. Thuswe have the following result.Theorem 3: Let r = blog2 dc+ 1. All these nonlinear balanced elementary symmetric Boolean functions are ofthe form σl·2t+1−1,2t , where t and l are any positive integers for any n > −2(log2 cos(π2r))−1.Proof: Consider tj(n), 1 ≤ j ≤ 2r−1 − 1,(1) If∑2r−1i=0 (−1)(id) cosAj ≥ 0, then2r−1∑i=0(−1)(id) −2r−1∑i=0(−1)(id) cosAj= 22r−1∑i=0(−1)(id) sin2(Aj2)DRAFT8≥ 22r−1−1∑i=0(−1)(id)(sin2(Aj2)+ cos2(Aj2))= 0 (14)(2) If∑2r−1i=0 (−1)(id) cosAj < 0, then2r−1∑i=0(−1)(id) +2r−1∑i=0(−1)(id) cos(Aj2)= 22r−1∑i=0(−1)(id) cos2(Aj2)≥ 22r−1−1∑i=0(−1)(id)(cos2(Aj2)+ sin2(Aj2))= 0 (15)These two equalities hold if and only if d = 2r−1. Therefore t0(n) ≥ |tj(n)| for 1 ≤ j ≤ 2r−1 − 1.When n > −2/(log2 cos(π2r)), we have cosn(π2r)< 14 , and hence t0(n) > |4t1(n)|. In additional, since forany j, 1 ≤ j ≤ 2r−1 − 1,cos(j2r π)cos(j+12r π) = cos ( j2r π)cos(π2r)cos(j2r π)− sin(π2r)sin(j2r π)>1cos(π2r) > 4, (16)t0(n) > 2j+1|tj(n)| holds for any j, 1 ≤ j ≤ 2r−1 − 1.Hence F(f) = 0 if and only if t0(n) = tj(n) = 0. From the discussion in Section III, if f is balanced, then fis trivial. Therefore, Conjecture 2 is validated for all n > −2(log2 cos(π2r))−1, where 2r−1 ≤ d < 2r.V. CONCLUSIONIn this paper, we study the balancedness of symmetric Boolean functions. We prove the conjecture that allbalanced symmetric Boolean functions of fixed degree are trivial when the number n of variables is sufficient large.We also present the form of trivial balanced elementary symmetric Boolean functions. In addition, we estimate thelower bound of n with which Cusick’s conjecture for elementary symmetric Boolean functions is validated. Butthe bound is rough. We show some properties of the balancedness of a symmetric Boolean function in the viewof the distance from a balanced one, which can be a new and clear way to proof some former results. Althoughan equivalence of Cusick’s conjecture is established, it is till an open problem. It would be helpful to remove thedependence on the degree from the bound, since then the complete proof of the conjecture would be reduced to afinite computation.ACKNOWLEDGMENTThe authors would like to thank Prof. T.W. Cusick for a careful reading of the manuscript and for all his helpfulsuggestions.DRAFT9REFERENCES[1] A. Canteaut and M. Videau, “Symmetric Boolean functions,” IEEE Trans. Inf. Theory, vol.51, no.8, pp.2791–2881, 2005.[2] F.N. Castro, and L.A. Medina, “Linear recurrences and asymptotic behavior of exponential sums of symmetric boolean functions,” TheElectronic Journal of Combinatorics, vol.18, no.2, pp.P8, 2011.[3] T.W. Cusick, Y. Li, and P. Stanica, “Balanced symmetric Boolean functions over GF(p),” IEEE Trans. Inf. Theory, vol.3, no.54, pp.1304–1307, 2008.[4] T.W. Cusick, Y. Li, and P. Stanica, “On a conjecture for balanced symmetric Boolean functions,” J. Math. Crypt., vol. 3. no. 4, pp. 273–290,2009.[5] J. Y. Cai, F.Green. and T. Thierauf., “On the correlation of symmetric functions,” Theory of Computing Systems, vol.29, pp.245–258, 1996.[6] G. Gao, W. Liu, and X. Zhang, “The degree of balanced elementary symmetric Boolean functions of 4k + 3 Variables,” IEEE Trans. Inf.Theory, vol.57, no.7, pp. 4822–4825, 2011[7] L. Comtet, Advanced Combinatorics, Amsterdam. The Netherlands: Reidel, 1974.[8] J. von zur Gathen and J. Roche, “Polynomials with two values,” Combinatorica, vol.17, pp.345-362, 1997.[9] A. Braeken, and B. Preneel, “On the Algebraic Immunity of Symmetric Boolean Functions,” in Proc. INDOCRYPT 2005 (Lecture Notesin Computer Science), Berlin, Germany, 2005, vol.3797, pp. 35-48. [Online]. Available: http://eprint.iacr.org/2005/245.pdf[10] M. Liu, D. Lin and D. Pei, “Fast Algebraic Attacks and Decomposition of symmetric boolean functions,” IEEE Trans. Inf. Theory, vol.57no.7, pp. 4817-4821, 2011.DRAFT

Recent Results on Balanced Symmetric Boolean Functions

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive