Functions with low differential uniformity can be used as the s-boxes of
symmetric cryptosystems as they have good resistance to differential attacks.
The AES (Advanced Encryption Standard) uses a differentially-4 uniform function
called the inverse function. Any function used in a symmetric cryptosystem
should be a permutation. Also, it is required that the function is highly
nonlinear so that it is resistant to Matsui's linear attack. In this article we
demonstrate that a highly nonlinear permutation discovered by Hans Dobbertin
has differential uniformity of four and hence, with respect to differential and
linear cryptanalysis, is just as suitable for use in a symmetric cryptosystem
as the inverse function.Comment: 10 pages, submitted to Finite Fields and Their Application

Beth

Bracken

Budaghyan

Canteaut

Carl Bracken

Charpin

Dillon

Dobbertin

Gold

Gregor Leander

Kasami

Matsui

Nyberg

English

arXiv

AbstractFunctions with low differential uniformity can be used as the s-boxes of symmetric cryptosystems as they have good resistance to differential attacks. The AES (Advanced Encryption Standard) uses a differentially 4 uniform function called the inverse function. Any function used in a symmetric cryptosystem should be a permutation. Also, it is required that the function is highly nonlinear so that it is resistant to Matsui's linear attack. In this article we demonstrate that the highly nonlinear permutation f(x)=x22k+2k+1 on the field F24k, discovered by Hans Dobbertin (1998) [1], has differential uniformity of four and hence, with respect to differential and linear cryptanalysis, is just as suitable for use in a symmetric cryptosystem as the inverse function. Its suitability with respect to other attacks remains to be seen

Bracken, Carl

Leander, Gregor

Elsevier - Publisher Connector 

A highly nonlinear differentially 4 uniform power mapping that permutes fields of even degree 

Crossref

Functions with low differential uniformity can be used as the s-boxes

of symmetric cryptosystems as they have good resistance to differential

attacks. The AES (Advanced Encryption Standard) uses a differentially-

4 uniform function called the inverse function. Any function used in a

symmetric cryptosystem should be a permutation. Also, it is required

that the function is highly nonlinear so that it is resistant to Matsui’s

linear attack. In this article we demonstrate that the highly nonlinear

permutation f(x) = x22k+2k+1, discovered by Hans Dobbertin [7], has

differential uniformity of four and hence, with respect to differential and

linear cryptanalysis, is just as suitable for use in a symmetric cryptosystem

as the inverse function

MURAL - Maynooth University Research Archive Library

arXiv:0901.1824v1  [cs.IT]  13 Jan 2009A Highly Nonlinear Differentially 4 UniformPower Mapping That Permutes Fields of EvenDegreeCarl Bracken1, Gregor Leander21Department of Mathematics, National University of IrelandMaynooth, Co. Kildare, Ireland2Department of Mathematics, Technical University DenmarkCopenhagen, DenmarkJanuary 13, 2009AbstractFunctions with low differential uniformity can be used as the s-boxesof symmetric cryptosystems as they have good resistance to differentialattacks. The AES (Advanced Encryption Standard) uses a differentially-4 uniform function called the inverse function. Any function used in asymmetric cryptosystem should be a permutation. Also, it is requiredthat the function is highly nonlinear so that it is resistant to Matsui’slinear attack. In this article we demonstrate that the highly nonlinearpermutation f(x) = x22k+2k+1, discovered by Hans Dobbertin [7], hasdifferential uniformity of four and hence, with respect to differential andlinear cryptanalysis, is just as suitable for use in a symmetric cryptosystemas the inverse function.1 IntroductionFunctions with a low differential uniformity are interesting from the point ofview of cryptography as they provide good resistance to differential attacks [11].For a function to be used as an s-box of a symmetric cryptosystem it shouldbe a permutation and defined on a field with even degree. It is also essentialthat the function has high nonlinearity so that it is resistant to Matsui’s linearattack [10]. The lowest possible differential uniformity is 2 and functions withthis property are called APN (almost perfect nonlinear). There has been muchrecent work and progress on APN functions (see [2],[3],[4],[5],[6]). However, atpresent there are no known APN permutations defined on fields of even degreeand it is actually the most important open question in this field if such functionsexist. This is why the AES (advanced encryption standard) uses a differentially4 uniform function, namely the inverse function.1For the rest of the paper, let L = F2n for n > 0 and let L∗ denote the set ofnon-zero elements of L. Let Tr : L → F2 denote the trace map from L to F2 .For positive integers r, k by Trrkk we denote the relative trace map from F2rk toF2k and by Trr the absolute trace from F2r to F2 .Definition 1 A function f : L → L∗ is said to be differentially δ uniform. iffor any a ∈ L∗, b ∈ L, we have|{x ∈ L : f(x+ a) + f(x) = b}| ≤ δ.Definition 2 Given a function f : L→ L, the Fourier transform of f is thefunction f̂ : L× L∗ → Z given byf̂(a, b) =∑x∈L(−1)Tr(ax+bf(x)).The Fourier spectrum of f is the set of integersΛf = {f̂(a, b) : a, b ∈ L, b 6= 0}.The nonlinearity of a function f on a field L = F2n is defined asNL(f) := 2n−1 −12maxx∈Λf|x|.The nonlinearity of a function measures its distance to the set of all affinemaps on L. We thus call a function maximally nonlinear if its nonlinearity is aslarge as possible. If n is odd, its nonlinearity is upper-bounded by 2n−1− 2n−12 ,while for n even a conjectured upper bound is 2n−1 − 2n2−1. For odd n, we saythat a function f : L −→ L is almost bent (AB) when its Fourier spectrum is{0,±2n+12 }, in which case it is clear from the upper bound that f is maximallynonlinear.In an article of Hans Dobbertin [7] he offers a list of power mappings thatpermute fields of even degree and meet the conjectured nonlinearity bound of2n−1−2n2−1. Following Dobbertin’s terminology we shall refer to such mappingas highly nonlinear permutations. In [7] Dobbertin conjectured that this listwas complete and noted that this had been verified for n ≤ 22. The inversefunction (used in AES) is highly nonlinear and hence is on the list. One of thefunctions on Dobbertin’s list is the power mapping f(x) = x22k+2k+1, definedon F24k , with k odd.In this article we show that this function has differential uniformity of 4. Wealso provide another proof of this functions nonlinearity property. This meansthat this function has the same resistance to both the linear and differentialattacks as the inverse function.22 Differential Uniformity of f(x) = x22k+2k+1As mentioned above there are no known permutations of even degree fields withdifferential uniformity of two. The following theorem shows that x22k+2k+1 hasthe next best (and best known) differential uniformity, which is four.Theorem 1 Let f(x) = x22k+2k+1 be defined on F24k . Then f(x) has differen-tial uniformity of four.Proof. We need to demonstrate that the equationx22k+2k+1 + (x + a)22k+2k+1 = bhas no more than four solutions for all a ∈ F24k∗ and all b ∈ F24k .Expansion of this expression yieldsax22k+2k+a2kx22k+1+a22kx2k+1+a2k+1x22k+a22k+1x2k+a22k+2kx+a22k+2k+1 = b.Next we replace x with xa and divide by a22k+2k+1 and obtainx22k+2k + x22k+1 + x2k+1 + x22k+ x2k+ x+ c = 0 (1)where c = a−22k−2k−1b+ 1.Let Tr4kk denote the relative trace map from F24k to F2k .As Tr4kk (x22k+2k + x22k+1 + x2k+1 + x22k+ x2k) = 0, Equation (1) impliesTr4kk (x+ c) = 0.Which is equivalent tox+ x2k+ x22k+ x23k= t (2)where t = Tr4kk (c). We note that t ∈ F2k .Equation (1) now becomesx(x2k+ x22k) + x22k+2k + x23k+ t+ c = 0.Which impliesx(x + x23k+ t) + x22k+2k + x23k+ t+ c = 0.From which we obtainx2 + x23k+1 + xt+ x22k+2k + x23k+ t+ c = 0. (3)We raise Equation (3) by 22k and getx22k+1+ x2k+22k + x22kt+ x23k+1 + x2k+ t+ c22k= 0. (4)3Now we add Equations (3) and (4) and make use of (2). This gives(x + x22k)2 + (t+ 1)(x+ x22k) + c2k+ c23k= 0. (5)The remainder of the proof is divided into two cases. They are t = 1 and t 6= 1.If t = 1 then Equation (5) impliesx+ x22k= c2k−1+ c23k−1.We let r = c2k−1+c23k−1. Therefore x22k= x+r. Placing this into Equation(1) yields(x+ r)x2k+ (x+ r)x + x2k+1 + x2k+ c+ r = 0.Which we write asx2 + r(x + x2k) + x2k+ r + c = 0. (6)Raising Equation (6) by 2k we obtainx2k+1+ r2k(x2k+ x+ r) + x+ r + r2k+ c2k= 0. (7)Next we add Equations (6) and (7) to get(x + x2k)2 + (r + r2k+ 1)(x+ x2k) + r2k+1 + c+ c2k+ r2k= 0. (8)Note that r + r2k= x + x2k+ x22k+ x23k= t, hence if t = 1 Equation (8)becomes(x+ x2k)2 + r2k+1 + c+ ck + r2k= 0.This implies x+x2k= s where s =√r2k+1 + c+ ck + r2k . Now we replace x2kby x+ s in Equation (6) and obtainx2 + x+ rs+ s+ r + c = 0,which can have no more than two solutions in x.Next we consider the case t 6= 1.We replace x with (t+ 1)z in Equation (5) and get(t+ 1)2((z + z22k)2 + (z + z22k)) + c2k+ c23k= 0.Now let y = z + z22kso we have(t+ 1)2(y2 + y) + c2k+ c23k= 0.This equation has at most two solutions in y. They are of the form y = p andy = p+ 1 for some fixed p. This implies that z22k= z + p or z22k= z + p+ 1.Note that p ∈ F22k .4If z22k= z + p then Equation (1) becomes(t+ 1)2((z + p)z2k+ (z + p)z + z2k+1) + (t+ 1)(z2k+ p) + c = 0,which gives(t+ 1)2((z + z2k)p+ z2) + (t+ 1)(z2k+ p) + c = 0. (9)We raise Equation (9) by 2k and obtain(t+ 1)2((z + z2k+ p)p2k+ z2k+1) + (t+ 1)(z + p+ p2k) + c2k= 0. (10)Next we add Equations (9) and (10) to get(t+1)2((p+p2k)(z+z2k)+(z+z2k)2+p2k+1)+(t+1)(z+z2k+p2k)+c+c2k= 0,which becomes(t+ 1)2(z + z2k)2 + ((t+ 1)2(p+ p2k) + (t+ 1))(z + z2k)+(t+ 1)2p2k+1 + (t+ 1)p2k+ c+ c2k= 0. (11)Recall t = x+ x2k+ x22k+ x23k= (t+ 1)(z + z2k+ z22k+ z23k).Also p+ p2k= z + z2k+ z22k+ z23k, hence p+ p2k= tt+1 .Therefore Equation (11) becomes(t+ 1)2((z + z2k)2 + (z + z2k)) + (t+ 1)2p2k+1+(t+ 1)p2k+ c+ c2k= 0. (12)It can easily be verified that if we had assumed z22k= z + p + 1 then thesame computations as above would also yield Equation (12), so this case neednot be considered.Next we let z + z2k= w and write Equation (12) as(t+ 1)2(w2 + w) + (t+ 1)2p2k+1 + (t+ 1)p2k+ c+ c2k= 0.This equation has at most two solutions in w which take the form w = q andw = q + 1 for some fixed q.This implies that z2k= z + q or z2k= z + q + 1.If z2k= z + q then z22k= z + q + q2kand Equation (1) becomes(t+1)2((z+ q+ q2k)(z+ q)+ (z+ q+ q2k)z+(z+ q)z)+ (t+1)(z+ q2k)+ c = 0.This simplifies to(t+ 1)2z2 + (t+ 1)z + (t+ 1)2(q2k+1 + q2) + (t+ 1)q2k+ c = 0,which is the same asx2 + x+ (t+ 1)2(q2k+1 + q2) + (t+ 1)q2k+ c = 0.5If on the other hand z2k= z + q + 1, then we would obtainx2 + x+ (t+ 1)2(q2k+1 + q2k+ q2 + q) + (t+ 1)(q + 1)2k+ c = 0.Clearly, this pair of equations will allow no more than four solutions in x andthe proof is complete. Note that we did not need to assume that k is odd to derive the differentialuniformity of four, however it is easy to see that the function is not a permutationif k is even as g.c.d.(24k − 1, 22k + 2k + 1) = 1 if and only if k is odd.3 Nonlinearity of f(x) = x22k+2k+1In this section we give a slightly different proof of the fact that x22k+2k+1 hasNL(f) = 2n−1 − 2n2−1. Most importantly, our proof also covers the case wherethe function is not a permutation, i.e., when k is even.Technically, the main difference to Dobbertin’s proof in [7] is that we are notgoing to use an F2k basis of F24k to express elements in F24k but rather a F22kbasis. This change makes some of the “lengthy but routine” computations, asDobbertin states it, easier.Theorem 2 Let f(x) = x22k+2k+1 be defined on F24k . ThenNL(f) = 2n−1 − 2n2−1.Proof. We have to show that for any non-zero b and any a the absolute valueof the Fourier coefficient f̂(a, b) is smaller or equal to 22k+1. There are twocases to consider. If k is odd, then f is a bijection and it is therefore enough tostudy the case b = 1. If k is even, then gcd(22k + 2k + 1, 24k − 1) = 3 and upto equivalence there are two different b to consider, namely the case b = 1 andb any non-cube. Here we remark that in the case k even we can always choosea non cube in F2k with out loss of generality. Thus, in both cases it is enoughto study b ∈ F2r . Moreover, we can restrict the case to elements b ∈ F2k suchthat Trk(b) = 1.Let γ be any non-zero element in F2k such that Trk(γ) = 1. For simplicitywe denote by gγ2(x) = Tr(γ2x22k+2k+1) (we use γ2 instead of γ to avoid dealingwith square roots later on) . Furthermore, let α ∈ F22k be an element fulfillingthe equation α2+ γα+ γ3 = 0. As Trk(γ) = 1 the polynomial α2+α+ γ = 0 isirreducible over F2k and by replacing α by αγ−1 and multiplying across by γ2we see that the polynomial α2 + γα + γ3 = 0 is irreducible as well. Thereforeα /∈ F2k and furthermore it holds that α2k + α = γ. Thus,Tr2k(α) = Trk(α2k+ α) = Trk(γ) = 1.6This implies that the polynomial x2 + x+ α is irreducible over F22k and finallyevery element in F24k can be represented by y + ωa, where y, a ∈ F22k andω ∈ F24k with ω2 + ω + α = 0. Using this expression for x we computegγ2(x) = gγ2(y + ωa)= Tr(γ2(y + ωa)22k+2k+1)= Tr(γ2y22k+2k+1)+Tr(γ2(y22k+2k(ωa) + y22k+1(ωa)2k+ y2k+1(ωa)22k))+Tr(γ2(y22k(ωa)2k+1 + y2k(ωa)22k+1 + y(ωa)22k+2k))+Tr(γ2(ωa)22k+2k+1)= A+B + C +D.First we note that A = 0 as γ2 and y are in F22k . Furthermore B can besimplified,B = Tr(γ2y2k+1(ωa) + γ2y2(ωa)2k+ γ2y2k+1(ωa)22k)= Tr(γ2y2k+1((ωa) + (ωa)22k) + γ2y2(ωa)2k)= Tr(γ2y2(ωa)2k).where the last equality follows as γ2y2k+1((ωa) + (ωa)22k) is in F22k . Nowconsider the term C. We first remark that γ2y2k(ωa)22k+1 is in the subfieldF22k and thusC = +Tr(γ2(y22k(ωa)2k+1 + y(ωa)22k+2k))= Tr(γ2y((ωa)2k+1 + (ωa)22k+2k)).Thereforeg(x) = g(y + ωa)= Tr(y(γ(ωa)2k−1+ γ2(ωa)2k+1 + γ2(ωa)22k+2k)+ γ2(ωa)22k+2k+1).The important observation is that this expression is linear in y. Thus, the func-tion belongs to the generalized Maiorana McFarland type of functions. Next,we compute an expression of g using the absolute trace on F22k denoted by Tr2k.For this we make use of the following equationsω + ω22k= 1andω22k+2k+1 + (ω22k+2k+1)22k= αthat follow from the fact that the two solutions ofx2 + x+ α = 07are ω and ω22k.g(y + ωa) = Tr2k(y(γa2k−1(ω + ω22k)2k−1+ γ2(a(ω + ω22k))2k+1))+Tr2k(γ2a22k+2k+1(ω22k+2k+1 + (ω22k+2k+1)22k))= Tr2k(y(γa2k−1+ γ2a2k+1)+ αγ2a2k+2).From now on the proof continues very much like Dobbertin’s original proof. Wedenote by µ(y) = (−1)Tr2k(y) andpi(a) = γa2k−1+ γ2a2k+1.We computeĝ(u+ ωv) =∑y,a∈F22kµ(ypi(a) + αγ2a2k+2 + uy + va)=∑aµ(αγ2a2k+2 + va)∑yµ(y(pi(a) + u))= 22k∑a,pi(a)=uµ(αγ2a2k+2 + va).For any u we have to study the set M = {a | pi(a) = u} and in particular itspossible size. First note thatpi(a) = pi(a+ c)implies0 = pi(a) + pi(a+ c) + (pi(a) + pi(a+ c))2k= γ(c2k−1+ c22k−1)= γ(c+ c2k)2k−1and we conclude c ∈ F2k . Therefore, we can equivalently study the set{c2 ∈ F2k | pi(a0 + c2) = u}where a0 is an element in M . Note that we use c2 instead of c to get rid of thepower 2k−1. Considering the equationpi(a0) + pi(a0 + c2) = 0we get the following equation for cc4 + (a2k0 + a0)c2 + γ−1c = 0 (13)which immediately implies |M | ∈ {0, 1, 2, 4}. As (̂g)(u+ωv) ≤ 22k|M | the onlycase we need to care about for proving the theorem is the case |M | = 4. In thiscase the set M consists of elementsM = {a0, a0 + c0, a0 + c1, a0 + c0 + c1}8where c0, c1 are solutions of (13) and thus c0c1(c0+c1) = γ−1. Next we compute∑a∈MTr2k(αγ2a2k+2 + va) = Tr2k(αγ2(a2k+20 + (a0 + c0)2k+2+(a0 + c1)2k+2 + (a0 + c0 + c1)2k+2))= Tr2k(αγ2(c0c21 + c1c20))= Tr2k(αγ2(c0c1(c0 + c1)))= Tr2k(αγ)= Trk(γ(α+ α2k))= Trk(γ2) = 1which impliesĝ(u+ ωv) =∑a∈Mµ(αa2k+2 + va) = ±22k+1.4 Closing Remarks and Open ProblemsWe have demonstrated that the function f(x) = x22k+2k+1 has the same re-sistance to both differential and linear attacks as the inverse function. Thefact that it can permute the field when k is odd means it could be used in acryptosystem acting on 12 bits. We now list all the known highly nonlinear per-mutations with differential uniformity of 4. For power mappings we conjecturethis list to be complete.f(x) Conditions Ref.x2s+1 n = 2k, k odd [8]gcd(n, s) = 2x22s−2s+1 n = 2k, k odd [9]gcd(n, s) = 2x−1 n even [1]x22k+2k+1 n = 4k, k odd This article.9Open Problem 1 Find more highly nonlinear permutations of even degreefields with differential uniformity of 4.Open Problem 2 Find a function, defined on a field of even degree, withhigher nonlinearity than 2n−1 − 2n2−1 or prove that such a function can’t ex-ist.References[1] Thomas Beth, Cunsheng Ding, “On almost perfect nonlinear permuta-tions”, EUROCRYPT, (1993), 65–76.[2] C. Bracken, E. Byrne, N. Markin, G. McGuire, “New families of quadraticalmost perfect nonlinear trinomials and multinomials”, Finite Fields andTheir Applications, Vol. 14, Issue 3, July 2008, 703–714.[3] C. Bracken, E. Byrne, N. Markin, G. McGuire, “A few more quadraticAPN functions”, Cryptography and Communications, to appear.[4] L. Budaghyan, C. Carlet, G. Leander, “Constructing new APN functionsfrom known ones”, Finite Fields and Their Applications, to appear.[5] L. Budaghyan, C. Carlet, P. Felke, and G. Leander, “An infinite class ofquadratic APN functions which are not equivalent to power mappings”,Proceedings of ISIT 2006, Seattle, USA, July 2006.[6] L. Budaghyan, C. Carlet, G. Leander, “Another class of quadratic APNbinomials over F2n : the case n divisible by 4,” Proceedings of WCC 07, pp.49–58, Versaille, France, April 2007.[7] H. Dobbertin, “One-to-one highly nonlinear power functions on GF(2n)”,Appl. Algebra Eng. Commun. Comput, 9, (1998), 139-152.[8] R. Gold, Maximal recursive sequences with 3 valued cross-correlation func-tions, IEEE Trans.inform.theory, 14, (1968), 154-156.[9] T. Kasami, Weight distributions of B-C-H codes, Combinatorial Mathe-matics and applications. ch. 20 (1969)[10] M. Matsui, Linear Cryptanalysis Method for DES Cipher, EURO-CRYPT93, LNCS 765, pp.386-397, Springer-Verlag, 1994.[11] K. Nyberg, “Differentially uniform mappings for cryptography”, Advancesin Cryptology-EUROCRYPT 93, Lecture Notes in Computer Science,Springer-Verlag, pp. 55-64, 1994.10

A Highly Nonlinear Differentially 4 Uniform

Power Mapping That Permutes Fields of Even

Degree

NUI Maynooth Eprint Archive

Maynooth University ePrints and eTheses Archive

Functions with low differential uniformity can be used as the s-boxes of symmetric cryptosystems as they have good resistance to differential attacks. The AES (Advanced Encryption Standard) uses a differentially 4 uniform function called the inverse function. Any function used in a symmetric cryptosystem should be a permutation. Also, it is required that the function is highly nonlinear so that it is resistant to Matsui’s linear attack. In this article we demonstrate that the highly nonlinear permutation f (x) = x22k+2k+1 on the field F24k , discovered by Hans Dobbertin (1998) [1], has differential uniformity of four and hence, with respect to differential and linear cryptanalysis, is just as suitable for use in a symmetric cryptosystem as the inverse function. Its suitability with respect to other attacks remains to be seen

Online Research Database In Technology

A highly nonlinear differentially 4 uniform power mapping that permutes fields of even degree

http://mural.maynoothuniversity.ie/2635/1/CB_Nonlinear.pdf

A Highly Nonlinear Differentially 4 Uniform Power Mapping That Permutes
  Fields of Even Degree

A Highly Nonlinear Differentially 4 Uniform Power Mapping That Permutes Fields of Even Degree

Abstract

Similar works

Full text

Available Versions

Elsevier - Publisher Connector

Crossref

MURAL - Maynooth University Research Archive Library

Elsevier - Publisher Connector

NUI Maynooth Eprint Archive

Maynooth University ePrints and eTheses Archive

Online Research Database In Technology