7th International Conference, KES 2003. Proceedings, Part I. Oxford, UK, September 3-5, 2003The design of highly nonlinear functions is relevant for a number of different applications, ranging from database hashing to message authentication. But, apart from useful, it is quite a challenging task. In this work, we propose the use of genetic programming for finding functions that optimize a particular nonlinear criteria, the avalanche effect, using only very efficient operations, so that the resulting functions are extremely efficient both in hardware and in software.Supported by the Spanish Ministerio de Ciencia y Tecnologia research project
TIC2002-04498-C05-4Publicad

Hernández, Julio C.

Isasi, Pedro

Luque, Cristóbal

English

Isasi Viñuela, Pedro

Name not available

Finding efficient nonlinear functions by means of genetic programming

Universidad Carlos III de Madrid e-Archivo

                  Finding Efficient Nonlinear Functionsby Means of Genetic ProgrammingJulio César Hernández Castro1, Pedro Isasi Viñuela2, andCristóbal Luque del Arco-Calderón21 Computer Security Group, Computer Science Department,28911 Leganés, Madrid, Spainjcesar@inf.uc3m.es2 Artificial Intelligence Group, Computer Science Department,28911 Leganés, Madrid, Spain{isasi,cluque}@ia.uc3m.esAbstract. The design of highly nonlinear functions is relevant for anumber of different applications, ranging from database hashing tomessage authentication. But, apart from useful, it is quite a challengingtask. In this work, we propose the use of genetic programming forfinding functions that optimize a particular nonlinear criteria, the ava-lanche effect, using only very efficient operations, so that the resultingfunctions are extremely efficient both in hardware and in software.1 IntroductionThe design of highly nonlinear functions is useful for a number of different applica-tions, from the construction of hash functions for large databases to the developmentof different cryptographic functions (pseudorandom functions, message authentica-tion codes, block ciphers, etc.)For many of these applications, a desirable and conflicting property is efficiency. Itis not difficult to design highly nonlinear functions, nor very efficient functions, butfinding algorithms with both properties is quite a challenging task.1.1 Compression FunctionsA function nm ZZF 22: →  is said to be a compression function if m>n. Differentcompression functions are extensively used in diverse cryptographic primitives, suchas pseudorandom number generator or hash functions (used for digital signatures andmessage authentication). The main advantage of this approach is to allow the simpleprocessing of variable-length input, following the recurrence relation:1              11010)(),(.........++====niiinhMhhMFhIVhMMMMThis scheme is very versatile, as it can be found with some minor differences inblock cipher chaining and cryptographic hash functions, and it can also be used toproduce pseudorandom numbers. We will focus our search to a quite general kind ofcompression functions, where m=2n.2 The Avalanche EffectNonlinearity can be measured in a number of ways or, what is the same, has not acomplete unique and satisfactory definition. In this work we focus our attention in aspecial property, named avalanche effect because it tries to reflect to some extend theintuitive idea of high-nonlinearity: a very small difference in the input producing ahigh change in the output, thus an avalanche of changes. Mathematically:2))(),((1),(|, nyFxFHyxHyx ≈=∀So if F is to have the avalanche effect [1], the Hamming distance between the out-puts of a random input vector and one generated by randomly flipping one of the bitsshould be, on average, n/2. That is, a minimum input change (one single bit) producesa maximum output change (half of the bits).This definition also tries to abstract the more general concept of independence ofthe output from the input. Although it is clear that this is impossible to achieve (agiven input vector always produces the same output) the ideal F will resemble a per-fect random function where inputs and outputs are statistically unrelated. Any such Fwould have perfect avalanche effect, so it is natural to try to obtain such functions byoptimizing the amount of avalanche.3 Genetic ProgrammingGenetic Programming [2] is a method for automatically creating working computerprograms from a set of high-level statements of a given problem. This is achieved bybreeding a population of computer programs using the principles of Darwinian natu-ral selection and other biologically inspired operations that include reproduction,sexual recombination (crossover), mutation, and possibly others. Starting from ainitial population of randomly created programs derived from a given set of  functionsand terminals, populations gradually evolve, giving birth to new, more fitted indi-viduals.2           This is performed by repeating the cycle of fitness evaluation, Darwinian selectionand genetic operations until a certain ending condition is met. Each individual (orprogram in the population) is evaluated to determine how fit is at solving a givenproblem, and then programs are selected probabilistically from the population ac-cording to their fitness values for being applied the rest of genetic operators. It isimportant to note that, while fitter programs have higher probabilities of being se-lected, all programs have a chance. After some generations, a program may emergethat solves, completely or approximately, the problem at hand.Genetic Programming combines the expressive high-level symbolic representa-tions of computer programs with the learning efficiency of genetic algorithms. Ge-netic Programming techniques have been successfully applied to a number of differ-ent problems: apart from classical problems such as function fitting or pattern recog-nition, where other evolutionary computation techniques also work fine, they haveeven produced results that are competitive with humans in some non-trivial tasks asdesigning electrical circuits[3] (some of which have been patented) or at classifyingprotein segments[4].4 Implementation IssuesWe have used the lilgp genetic programming system, available athttp://garage.cps msu.edu/software/lil-gp/lilgp-index html, but a number of modifica-tions were needed for our problem.Firstly, we need to define the set of functions: This is critical for our problem, asthey are the building blocks of the algorithms we would obtain. Being efficiency oneof the paramount objectives of our approach, it is natural to restrict the set of func-tions to include only very efficient operations; so the inclusion of the basic binaryoperations as rotd (right rotation), roti (left rotation), xor (addition mod 2), or (bitwise or), not (bit wise not), and and (bit wise and) are an obvious first step. Otheroperators as the sum (sum mod 232) are necessary in order to avoid linearity, beingitself quite efficient. Another interesting operator introduced was kte, an operationthat, whatever its input, returns the 32-bit constant value 0x9e377969, which are themost significant digits of the expression of the golden ratio in hexadecimal nota-tion).The idea behind this operator was to provide a constant value that, independ-ently from the input, could be used by the aforementioned operators to increase non-linearity , and idea suggested by [5].The inclusion of the mult (multiplication mod 232) operator was not so easy to de-cide, because, depending on the particular implementations, the multiplication of two32 bit values could cost up to fifty times more than an xor or and operation, so it isrelatively inefficient, at least when compared with the other operators used. In fact,we did not include it at first, but after extensively experimentation, we conclude thatits inclusion was beneficial because, apart from improving non-linearity; it at leastdoubled and sometimes tripled the amount of avalanche we were trying to maximize,so we finally include it in the function set.The set of terminals in our case is easy to establish; as said above, we are focusingour attention in compression functions where m=2n, so the input will be formed by3              two 32 bits integers a0 and a1, and these will be the branches of the function treesthat the genetic programming algorithm will construct, with functions from the func-tion set in the nodes.The fitness of every individual (algorithm or function) was evaluated by generat-ing 1024 64-bit random vectors, then randomly flipping one of the bits and calculat-ing the Hamming distance over their outputs. For each of these 1024 experiments aHamming distance between 0 and 32 was obtained and the fitness of the given func-tion was the observed average Hamming distance.Although this is a quite natural way of measuring the avalanche effect as definedin the introduction, some additional explanations are needed. Obviously; the idealobserved value should be 32/2=16, so a more natural approach for the fitness func-tion will be not simply this average but is deviation from the optimum value of 16,that is |16-average| Anyway, after some experiments we observed that, at least for thedepths studied in this work, the resulting functions fitness were far and below the 16optimum value, so simply using the average number of changes as the fitness functionto maximize worked perfectly well.When using genetic programming approaches, it is necessary to put some limits tothe depth and to the number f nodes the resulting trees could have. We preferred tovary only the depth and not to put any limitation (apart from the depth itself) to thenumber of nodes possibly used.We selected a population size of 100 individuals, a crossover probability of 0.8,which produced better results than the default 0.9 probability proposed, and an endingcondition of reaching 500 generations. In many cases, ten different runs were per-formed, each one seeded with the 6 most significant digits of the expression(314159)i. When only one run was possible, the seed was 314159.5 ResultsSelected functions are shown in the Appendix.Table 1 below summarizes some of the results.Basically, Table 1 shows that, by increasing the allowed depth of the functiontrees, better avalanche effects could be obtained. This is intuitively clear, but nottrivial to get. The idea that simply adding more and more complexity (more brancheswith functions and terminals) to any tree will increase the avalanche effect of thefunction can be easily dismounted by a simple inspection to the first two individualsshown at the Appendix.After all the experiments, we can conclude we have found one super-individual,shown in the appendix, that with only a depth of 5 and a little number of nodes iscapable of contesting in terms of avalanche with much more complex rivals.Furthermore, this highly fitted function has many points in common with some ofthe fittest individuals for every depth (as shown at the end of the appendix), so, in away, this is also revealing us a new promising method of construction or a new kindof function design. There are other very fitted functions which have great similitudewith the aforementioned, but we cannot include them in the appendix due to lack ofspace.4           Table 1. Avalanche effect as a function of depth. Averages exclude the maximal and minimalvalues. For some values there are only one result          \Avalanche  Depth\ Maximun Average Minimun2 8.86963 9.4424 9.0725 8.81744 10.1396 9.5619 9.11525 11.2148 9.9919 9.65336 11.1479 10.2296 9.66217 11.3232 10.7037 10.31458 11.52009 10.948210 11.231011 11.351312 11.828413 11.516414 10.970715 12.445116 11.66046 ConclusionsThe average avalanche effect on Table 1 steadily increases when the depth is in-creased; so a natural question is which is the minimum depth at which any algorithmexists that reaches the perfect avalanche of 16.For trying to guess that, we performed a series of additional searches in deeperdepths (but only one run, as they are much more time consuming) until reachingdepth 16. By the slow increase in the avalanche levels observed, our current bestguess is that this could perhaps be achieved at depth 20. This makes that some ques-tions arise naturally as, for example, would it better to dig in some such deep trees,with the associated combinatorial explosion (for example in the number of nodesused) or is it more sensible to search for short, faster functions and apply then twice?What would it better, the best function we can find with this approach at level 12 orthe best function found at depth 6, with the same amount of resources, applied twice?Many other questions remain. One of the more interesting is if it would be possibleto add to every function in the function set a weight or some other measure of itscomplexity or efficiency (for example in number of instructions needed at the proces-sor level, microseconds taken to perform, etc) and allow the genetic programmingtechnique itself to decide whether it is interesting to use that particular function or notin terms of avalanche effect introduced for a given cost. This and other questions andextensions to this work are currently under consideration.5              AcknowledgementsSupported by the Spanish Ministerio de Ciencia y Tecnologia research projectTIC2002-04498-C05-4References[1] Feistel, H.: Cryptography and Computer Privacy. Scientific American, 228 (5)15-23, 1973[2] Koza, J.: Genetic Programming. In: Encyclopedia of Computer Science andTechnology, v.39, 29-43, 1998[3] Koza, J., et. al. Automated Synthesis of analog electrical circuits by means ofgenetic programming. In IEEE Transactions on Evolutionary Computation1(2), 1997[4] Koza, J., Andre, D.: Automatic discovery of protein motifs using genetic pro-gramming. In Evolutionary Computation: Theory and Applications. World Sci-entific Publications, 1996[5] Wheeler, D., Needham, R.: TEA, a Tiny Encryption Algorithm. In: Proceed-ings of the 1994 Fast Software Encryption Workshop, and athttp://www ftp.cl.cam.ac.uk/ftp/papers/djw-rmn/djw-rmn-tea htmlAppendix: Experimental ResultsDepth 5 Run #4 fitness: 11.2148TREE: (mult (kte (rotd a0))       (rotd (sum (roti (xor a0 a1))                  (xor a0 a1))))Depth 14: fitness: 10.9707TREE: (xor (sum (xor (rotd (mult (and a0                                 (mult (mult (mult a1                                                   (mult a1 a1))                                             (rotd a0))                                       (mult a0                                             (mult a1 a0))))                            (rotd (rotd (xor a1                                             (rotd (xor a1                                                        (rotd (sum a0 a1)))))))))                (xor (xor a0 a1)                     (sum a0                          (rotd (sum a0 a1)))))6                      (sum (xor (rotd (roti a1)) a0)                (sum a0 a1)))      (xor (sum (xor (sum (mult (mult a1 a1)                                (sum (sum a0 a0)                                     (xor a1                                          (xor a0                                               (sum a0                                                    (roti a1))))))                          (xor a0                               (sum a0 a1)))                     (xor a0 a1))                (not a0))           (mult (sum a0 a1)                 (mult a0                       (mult a1 a0)))))===========================================================Run #4 fitness: 11.0957TREE: (mult (kte (xor (roti (roti a1)) a1))       (rotd (sum (sum (rotd a0)                       (rotd a1))                  (roti (xor a0 a1)))))DepthMax=7==========Run #4 fitness: 11.3232TREE: (mult (kte (rotd a0))       (rotd (sum (rotd (sum (sum a0 a0)                             (roti (rotd a1))))                  (rotd (sum (sum (rotd a0)                                  (rotd a1))                             (rotd a0))))))7

a Tiny Encryption Algorithm. In:

Automated Synthesis of analog electrical circuits by means of genetic programming.

Automatic discovery of protein motifs using genetic programming. In Evolutionary Computation: Theory and Applications. World Scientific Publications,

Cryptography and Computer Privacy.

Genetic Programming. In:

http://e-archivo.uc3m.es/bitstream/handle/10016/4092/finding-efficient_LNCS_2003_ps.pdf?sequence=1

Finding efficient nonlinear functions by means of genetic programming

Abstract

Similar works

Full text

Available Versions

Name not available

Name not available

Universidad Carlos III de Madrid e-Archivo