We study the nonlinearity of functions defined on a finite field with 2^m
elements which are the trace of a polynomial of degree 7 or more general
polynomials. We show that for m odd such functions have rather good
nonlinearity properties. We use for that recent results of Maisner and Nart
about zeta functions of supersingular curves of genus 2. We give some criterion
for a vectorial function not to be almost perfect nonlinear

Férard, Eric

Rodier, François

English

arXiv

We study the nonlinearity of functions defined on a finite field with 2^m elements which are the trace of a polynomial of degree 7 or more general polynomials of binary degree equal to 3. We show that for m odd such functions have rather good nonlinearity properties. We use for that recent results of Maisner and Nart about zeta functions of supersingular curves of genus 2. We give some criterion for a vectorial function not to be almost perfect nonlinear

HAL AMU

Nonlinarity of Boolean functions and hyperellipticcurvesEric Fe´rard, Franc¸ois RodierTo cite this version:Eric Fe´rard, Franc¸ois Rodier. Nonlinarity of Boolean functions and hyperelliptic curves. 2007.<hal-00145890>HAL Id: hal-00145890https://hal.archives-ouvertes.fr/hal-00145890Submitted on 11 May 2007HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.L’archive ouverte pluridisciplinaire HAL, estdestine´e au de´poˆt et a` la diffusion de documentsscientifiques de niveau recherche, publie´s ou non,e´manant des e´tablissements d’enseignement et derecherche franc¸ais ou e´trangers, des laboratoirespublics ou prive´s.hal-00145890, version 1 - 11 May 2007Nonlinarity of Boolean functionsand hyperelliptic curvesEric Fe´rard∗, Franc¸ois Rodier†Boolean functions is an important tool in computer sciences. It is espe-cially useful in private key cryptography for designing stream ciphers. Forsecurity reasons, and also because Boolean functions need also to have otherproperties than nonlinearity such as balancedness or high algebraic degree,it is important to have the possibility of choosing among many Boolean func-tions, not only bent functions, that is functions with the highest possiblenon linearity, but also functions which are close to be bent in the sense thattheir nonlinearity is close to the nonlinearity of bent functions. For m odd,it would be particularly interesting to find functions with nonlinearity largerthan the one of quadratic Boolean functions (called almost optimal in [1]).This has been done for instance in the work of Patterson and Wiedemann[9] and also of Langevin-Zanotti [4].Let q = 2m and F2m assimilated as a vector space to Fm2 . In this talk,we want to study functions of the form TrG(x), where G is a polynomial onF2m and Tr the trace of F2m over F2.For m even, many people got interested in finding bent functions of thisform. To only mention the case of monomials, one can get the known cases(Gold , Dillon/Dobbertin, Niho exponents) in the paper of Leander [5].For m odd, one might have expected that among the functions f : x −→TrG(x) where G is a polynomial of degree 7, there are some functions whichare close to being bent in the previous sense. This happens not to be thecase, but we will show that for m odd such functions have rather goodnonlinearity or autocorrelation properties. We use for that recent results ofMaisner and Nart [7] about zeta functions of supersingular curves of genus2.∗Universite´ de Polyne´sie franc¸aise, Tahiti; e-mail ferard@upf.pf†Institut de Mathe´matiques de Luminy – C.N.R.S. 163 avenue de Luminy, Case 907,Marseille Cedex 9, France; e-mail rodier@iml.univ-mrs.fr1On the other hand, vectorial Boolean functions are used in cryptographyto construct block ciphers. An important criterion on these functions is ahigh resistance to the differential cryptanalysis. Nyberg [8] has introducedthe notion of almost perfect nonlinearity (APN) to study differential attacks.We relate this notion to the notion above, and we will give some criterionfor a function not to be almost perfect nonlinear.1 Preliminaries1.1 Boolean functionsLet m be a positive integer and q = 2m.Definition 1.1 A Boolean function with m variables is a map from thespace Vm = Fm2 into F2.A Boolean function is linear if it is a linear form on the vector space Vm.It is affine if it is equal to a linear function up to addition of a constant.1.2 NonlinearityDefinition 1.2 We call nonlinearity of a Boolean function f : Vm −→ F2the distance from f to the set of affine functions with m variables:nl(f) = minh affined(f, h)where d is the Hamming distance.One can show that the nonlinearity is equal tonl(f) = 2m−1 − 12‖f̂‖∞where‖f̂‖∞ = supv∈Vm∣∣∣ ∑x∈Vmχ (f(x) + v · x)∣∣∣,where v · x denote the usual scalar product in Vm and χ(f) = (−1)f . It isthe maximum of the Fourier transform of χ(f) (the Walsh transform of f):f̂(v) =∑x∈Vmχ (f(x) + v · x) .2Parseval identity can be written‖f̂‖22 =1q∑v∈Vmf̂(v)2 = qand we get, for f a Boolean function on Vm:√q ≤ ‖f̂‖∞ ≤ q.1.3 The sum-of-square indicatorLet f be a Boolean function on Vm. Zhang and Zheng introduced the sum-of-square indicator [14], as a measure of the global avalanche criterion:σf =1q∑x∈Vmf̂(x)4 = ‖f̂‖44.We remark that‖f̂‖2 ≤ ‖f̂‖4 ≤ ‖f̂‖∞. (1)Hence the values of ‖f̂‖4 may be considered as a first approximation of ‖f̂‖∞and in some cases they may be easier to compute. The relationship of thisfunction with non-linearity was studied by A. Canteaut et al.[1].2 The functions f : x −→ Tr (G(x)) where G is apolynomial2.1 Divisibility of ‖f̂‖∞Let G(x) be the polynomial∑si=0 aixi with coefficients in Fq and f theBoolean function Tr ◦G.Definition 2.1 The binary degree of G is the maximum value of σ(i) for0 ≤ i ≤ s, where σ(i) is the sum of the binary digits of i.One has the following proposition, due to C. Moreno and O. Moreno [6].Proposition 2.1 Let G be a polynomial with coefficients in Fq and binarydegree d. Then ‖f̂‖∞ is divisible by 2⌈md ⌉.32.2 Case where G is a polynomial of binary degree 2The ‖f̂‖∞ are multiple of 2⌈m2 ⌉. Therefore, if m is even ‖f̂‖∞ is a multipleof q1/2, and if m is odd, of√2q. In particular, if m is odd, the spectralamplitude is higher or equal to√2q which is equal to that of the quadraticBoolean functions, of the maximum rank.3 The functions f : x −→ Tr (G(x)) where G is abinary polynomial of degree 3One simply will study the case where G is a binary polynomial of degree 2to which one adds a monomial of degree 7:G = a7x7 +s∑bix2i+1where a7 6= 0 a polynomial of degree 7 with coefficients in k. We wouldlike to evaluate ‖f̂‖4 on F2m , for f(x) = Tr (G(x)) where Tr indicates thefunction trace of Fq on F2:Tr(x) =m−1∑i=0x2i.One obtains the simple expression of ‖f̂‖4 (cf [10, 11]):‖f̂‖44 =∑x1+x2+x3+x4=0χ (f(x1) + f(x2) + f(x3) + f(x4)) = q2 +∑α∈k∗XαwithXα =(∑x∈kχ ◦ Tr (G(x) +G(x+ α)))2.To compute Xα, one can remark that the curve of equation y2 + y = G(x+α) +G(x) is isomorphic toy2 + y = G(α)++(a7α6 + a1/47 α3/4 + a1/27 α5/2 +∑(biα)2−i +∑biα2i)x++(a7α4 + a1/27 α1/2)x3 + a7α2x5which is an equation of a curve C1 of genus 2 for α 6= 0. One hasXα = (#C1 − q − 1)2.To compute Xα, we will need results of Van der Geer - van der Vlugtand of Maisner - Nart.43.1 Van der Geer and van der Vlugt theoryLet C1 the curve with affine equation:C1 : y2 + y = ax5 + bx3 + cx+ dwith a 6= 0. Let R be the linearized polynomial ax4 + bx2 + c2x. The mapQ : k → F2x 7→ Tr(xR(x))is the quadratic form associated to the symplectic formk × k −→ F2(x, y) 7→ < x, y >R= Tr(xR(y) + yR(x)).The number of zeros of Q determines the number of points of C1:#C1(k) = 1 + 2#Q−1(0).Let W be the radical of the symplectic form <,>R, and w be its dimensionover F2. The codimension of the kernel V of Q in W is equal to 0 or 1.Theorem 3.1 (van der Geer - van der Vlugt [13])If V 6=W , then #C1(k) = 1 + q.If V =W , then #C1(k) = 1 + q ±√2wq.3.2 Values of XαIn [3], we study the factorization of P which determines V and W (seeMaisner-Nart [7]). Thanks to the work of van der Geer - van der Vlugt, wecan compute the number of points of the curves y2 + y = G(x+ α) +G(x).Proposition 3.1 Suppose that m is odd. ThenXα = 0 or 2q or 8q.ßLet ℓ = a−1/37 α−7/3. ThenXα = 8q if and only ifTr ℓ = 0 , ℓ = v + v4 with Tr v = 0 ,Tr((a+ c)αλv3)= 1 , Tr((a+ c)αλ(v + v2))= 1 ;Xα = 2q if and only if Tr ℓ = 1 ;Xα = 0 in the remaining cases.54 Evaluation of ‖f̂‖44Proposition 4.1 The value of ‖f̂‖44 on F2m when m is odd and f(x) =Tr (G(x)) is such that|‖f̂‖44 − 3q2| ≤ 185.2s−1q3/2.ProofOne can evaluate the number of α which gives each case of the precedingproposition. The proves of these evaluations are linked with the computa-tions of exponential sums over the curve v + v4 = γx7. We get∣∣∣#{α | Xα = 8q} − 18∣∣∣ ≤ 23.2s−1q1/2∣∣∣#{α | Xα = 2q} − 12∣∣∣ ≤ 3q1/2 + 1One deduce easily the evaluation of ‖f̂‖44. The details of the proof willappear in [3].Remark 4.1 This result is to be compared with proposition 5.6 in [10] wherethe distribution of ‖f̂‖44 for all Boolean function is shown to be concentratedaround 3q2.5 Bound for ‖f̂‖∞From the theorem, we can deduce some lower bounds for ‖f̂‖∞.Proposition 5.1 For the functions f : x −→ Tr (G(x)) on F2m where G isthe polynomial G = a7x7+∑s bix2i+1 and m is odd one has, for m ≤ 11+2s:√2q ≤ ‖f̂‖∞.For m ≥ 15 + 2s, one has moreover:√2q < ‖f̂‖∞.ProofThe evaluation of the number of α such that Tr ℓ = 1 in proposition 3.1gives:2q2 − 6q3/2 ≤ ‖f̂‖44.6As it is easy to show that‖f̂‖44 ≤ q‖f̂‖2∞we get 2q− 6q1/2 ≤ ‖f̂‖2∞ whence the result, as ‖f̂‖∞ is divisible by 2⌈m/3⌉.The second inequality is a consequence of theorem 4.1.Remark 5.1 So f is not almost optimal (in the sense of [1]), for m ≥15 + 2s.6 APN FunctionsLet us consider a function G : Fq −→ Fq.Definition 6.1 The function G is said to be APN (almost perfect nonlin-ear) if for every a ∈ F∗q and b ∈ Fq, there exists at most 2 elements of Fqsuch that G(z + a) +G(z) = b.Proposition 6.1 The functionG : Fq −→ Fqx 7→ a7x7 +s∑0bix2i+1is not APN for m ≥ 13 + 2s.ProofFor γ ∈ Fq, consider the function fγ(x) = Tr(G(γx)). The propo-sition follows from proposition 4.1 and the following result from Chabaud-Vaudenay [2].Proposition 6.2 One has∑γ∈k∗σ(fγ) ≥ 2q2(q − 1).The function G is APN if and only if the equality is true.For s ≤ 2, one can even say more. The following theorem [12] provesthat the function G is not APN for m ≥ 11.Theorem 6.1 Let G be a polynomial from F2m to F2m , d its degree. Letus suppose that the curve X∞ of equationxd0 + xd1 + xd2 + (x0 + x1 + x2)d(x0 + x1)(x2 + x1)(x0 + x2)= 0is smooth. Then if m ≥ 6 and d < q1/6 + 3.9, G is not APN.7References[1] A. Canteaut, C. Carlet, P. Charpin, C. Fontaine Propagation char-acteristics and correlation-immunity of highly nonlinear Booleanfunctions, Advances in cryptology, EUROCRYPT 2000 (Bruges),507–522, Lecture Notes in Comput. Sci., Vol. 1807, Springer,Berlin, 2000.[2] Chabaud, Florent; Vaudenay, Serge Links between differential andlinear cryptanalysis. De Santis, Alfredo (ed.), Advances in cryptol-ogy - EUROCRYPT ’94. Workshop on the theory and applicationof cryptographic techniques, Perugia, Italy, May 9-12, 1994. Pro-ceedings. Berlin: Springer-Verlag. Lect. Notes Comput. Sci. 950,356-365 (1995).[3] E. Fe´rard, F. Rodier, Nonlinearity of some Boolean functions, workin preparation.[4] P. Langevin, J-P. Zanotti, A note on the counter-example ofPatterson-Wiedemann, Finite fields with applications to codingtheory, cryptography and related areas (Oaxaca, 2001), 214–219,Springer, Berlin, 2002.[5] G. Leander Monomial Bent Functions, WCC05 (InternationalWorkshop on Coding and Cryptography, March 2005, Bergen, Nor-way), Oyvind Ytrehus, Springer-Verlag New York.[6] C. Moreno and O. Moreno The MacWilliams-Sloane conjecture onthe tightness of the Carlitz- Uchiyama bound and the weights ofduals of BCH codes, IEEE Trans. Inf. Theory 40, No.6, 1894-1907(1994).[7] D. Maisner and E. Nart, Zeta functions of supersingular curves ofgenus 2, arXiv:math.NT/0408383[8] Nyberg, Kaisa Differentially uniform mappings for cryptography.Advances in cryptology—EUROCRYPT ’93 (Lofthus, 1993), 55–64, Lecture Notes in Comput. Sci., 765, Springer, Berlin, 1994.[9] N. Patterson and D. Wiedemann, The covering radius of the(215, 16) Reed-Muller code is at least 16 276, IEEE Trans. Inform.Theory 29, no. 3 (1983), 354-356.8[10] F. Rodier, Sur la non-line´arite´ des fonctions boole´ennes,Acta Arithmetica, vol 115, (2004), 1-22, preprint: arXiv:math.NT/0306395.[11] F. Rodier, On the nonlinearity of Boolean functions, Proceedings ofWCC2003, Workshop on coding and cryptography 2003 (D. Augot,P. Charpin, G. Kabatianski eds), INRIA (2003), pp. 397-405.[12] F. Rodier, Borne sur le degre´ des polynoˆmes presque parfaitementnon-line´aires; ArXiv: math.AG/0605232, 2006.[13] G. van der Geer, M. van der Vlugt, Reed-Muller codes and super-singular curves. I, Compositio Math. 84, (1992), 333-367.[14] Xian-Mo Zhang and Yuliang Zheng, GAC —the Criterion forGlobal Avalanche Characteristics of Cryptographic Functions,Journal of Universal Computer Science, vol. 1, no. 5 (1995), 316-3339

Nonlinarity of Boolean functions and hyperelliptic curves

Abstract

Similar works

Full text

Available Versions

HAL AMU