We discuss the second-order differential uniformity of vectorial Boolean functions. The closely related notion of second-order zero differential uniformity has recently been studied in connection to resistance to the boomerang attack. We prove that monomial functions with univariate form $x^d$ where $d=2^{2k}+2^k+1$ and $\gcd(k,n)=1$ have optimal second-order differential uniformity. Computational results suggest that, up to affine equivalence, these might be the only optimal cubic power functions. We begin work towards generalising such conditions to all monomial functions of algebraic degree 3. We also discuss further questions arising from computational results.
In this article, we introduce new notions $cc$-differential uniformity, $cc$-differential spectrum, PccN functions and APccN functions, and investigate their properties. We also introduce $c$-CCZ equivalence, $c$-EA equivalence, and $c1$-equivalence. We show that $c$-differential uniformity is invariant under $c1$-equivalence, and $cc$-differential uniformity and $cc$-differential spectrum are preserved under $c$-CCZ equivalence. We characterize $cc$-differential uniformity of vectorial Boolean functions in terms of the Walsh transformation. We investigate $cc$-differential uniformity of power…
In this paper we define a new (output) multiplicative differential, and the corresponding $c$-differential uniformity. With this new concept, even for characteristic $2$, there are perfect $c$-nonlinear (PcN) functions. We first characterize the $c$-differential uniformity of a function in terms of its Walsh transform. We further look at some of the known perfect nonlinear (PN) and show that only one remains a PcN function, under a different condition on the parameters. In fact, the $p$-ary Gold PN function increases its $c$-differential uniformity significantly, under some conditions on the p…
We study the differential uniformity of the Wan-Lidl polynomials over finite fields. A general upper bound, independent of the order of the field, is established. Additional bounds are established in settings where one of the parameters is restricted. In particular, we establish a class of permutation polynomials which have differential uniformity at most 5 over fields of order $3\bmod 4$, irrespective of the field size. Computational results are also given.
Modifying the binary inverse function in a variety of ways, like swapping two output points has been known to produce a $4$-differential uniform permutation function. Recently, in \cite{Li19} it was shown that this swapped version of the inverse function has boomerang uniformity exactly $10$, if $n\equiv 0\pmod 6$, $8$, if $n\equiv 3\pmod 6$, and 6, if $n\not\equiv 0\pmod 3$. Based upon the $c$-differential notion we defined in \cite{EFRST20} and $c$-boomerang uniformity from \cite{S20}, in this paper we characterize the $c$-differential and $c$-boomerang uniformity for the $(0,1)$-swapped inv…
The $c$-differential uniformity is recently proposed to reflect resistance against some variants of differential attack. Finding functions with low $c$-differential uniformity is attracting attention from many researchers. For even characteristic, it is known that permutations of low Carlitz rank have good cryptographic parameters, for example, low differential uniformity, high nonlinearity, etc. In this paper we show that permutations with low Carlitz rank have low $c$-differential uniformity. We also investigate $c$-differential uniformity of permutations with Carlitz rank 3 in detail.
Differential cryptanalysis famously uses statistical biases in the propagation of differences in a block cipher to attack the cipher. In this paper, we investigate the existence of more general statistical biases in the differences. To this end, we discuss the $c$-differential uniformity of S-boxes, which is a concept that was recently introduced in Ellingsen et. al. to measure certain statistical biases that could potentially be used in attacks similar to differential attacks. Firstly, we prove that a large class of potential candidates for S-boxes necessarily has large $c$-differential unifo…
Functions with low c-differential uniformity have optimal resistance to some types of differential cryptanalysis. In this paper, we investigate the c-differential uniformity of power functions over finite fields. Based on some known almost perfect nonlinear functions, we present several classes of power functions $f(x)=x^d$ with $_{c}Δ_f\leq3$. Especially, two new classes of perfect c-nonlinear power functions are proposed.
Very recently, a new concept called multiplicative differential and the corresponding $c$-differential uniformity were introduced by Ellingsen et al. A function $F(x)$ over finite field $\mathrm{GF}(p^n)$ to itself is called $c$-differential uniformity $δ$, or equivalent, $F(x)$ is differentially $(c,δ)$ uniform, when the maximum number of solutions $x\in\mathrm{GF}(p^n)$ of $F(x+a)-F(cx)=b$, $a,b,c\in\mathrm{GF}(p^n)$, $c\neq1$ if $a=0$, is equal to $δ$. The objective of this paper is to study the $-1$-differential uniformity of ternary APN power functions $F(x)=x^d$ over $\mathrm{GF}(3^n)$. …
We defined in~\cite{EFRST20} a new multiplicative $c$-differential, and the corresponding $c$-differential uniformity and we characterized the known perfect nonlinear functions with respect to this new concept, as well as the inverse in any characteristic. The work was continued in~\cite{RS20}, investigating the $c$-differential uniformity for some further APN functions. Here, we extend the concept to the boomerang uniformity, introduced at Eurocrypt '18 by Cid et al.~\cite{Cid18}, to evaluate S-boxes of block ciphers, and investigate it in the context of perfect nonlinearity and related funct…
Very recently, a new concept called multiplicative differential (and the corresponding $c$-differential uniformity) was introduced by Ellingsen \textit{et al} in [C-differentials, multiplicative uniformity and (almost) perfect c-nonlinearity, IEEE Trans. Inform. Theory, 2020] which is motivated from practical differential cryptanalysis. Unlike classical perfect nonlinear functions, there are perfect $c$-nonlinear functions even for characteristic two. The objective of this paper is to study power function $F(x)=x^d$ over finite fields with low $c$-differential uniformity. Some power functions …
Building upon the observation that the newly defined~\cite{EFRST20} concept of $c$-differential uniformity is not invariant under EA or CCZ-equivalence~\cite{SPRS20}, we showed in~\cite{SG20} that adding some appropriate linearized monomials increases the $c$-differential uniformity of the inverse function, significantly, for some~$c$. We continue that investigation here. First, by analyzing the involved equations, we find bounds for the uniformity of the Gold function perturbed by a single monomial, exhibiting the discrepancy we previously observed on the inverse function. Secondly, to treat …
Starting with the multiplication of elements in $\mathbb{F}_{q}^2$ which is consistent with that over $\mathbb{F}_{q^2}$, where $q$ is a prime power, via some identification of the two environments, we investigate the $c$-differential uniformity for bivariate functions $F(x,y)=(G(x,y),H(x,y))$. By carefully choosing the functions $G(x,y)$ and $H(x,y)$, we present several constructions of bivariate functions with low $c$-differential uniformity. Many P$c$N and AP$c$N functions can be produced from our constructions.
In this paper, we construct some piecewise defined functions, and study their $c$-differential uniformity. As a by-product, we improve upon several prior results. Further, we look at concatenations of functions with low differential uniformity and show several results. For example, we prove that given $β_i$ (a basis of $\mathbb{F}_{q^n}$ over $\mathbb{F}_q$), some functions $f_i$ of $c$-differential uniformities $δ_i$, and $L_i$ (specific linearized polynomials defined in terms of $β_i$), $1\leq i\leq n$, then $F(x)=\sum_{i=1}^nβ_i f_i(L_i(x))$ has $c$-differential uniformity equal to $\prod_{…
We give some classes of power maps with low $c$-differential uniformity over finite fields of odd characteristic, {for $c=-1$}. Moreover, we give a necessary and sufficient condition for a linearized polynomial to be a perfect $c$-nonlinear function and investigate conditions when perturbations of perfect $c$-nonlinear (or not) function via an arbitrary Boolean or $p$-ary function is perfect $c$-nonlinear. In the process, we obtain a class of polynomials that are perfect $c$-nonlinear for all $c\neq 1$, in every characteristic. The affine, extended affine and CCZ-equivalence is also looked at,…
While the classical differential uniformity ($c=1$) is invariant under the CCZ-equivalence, the newly defined \cite{EFRST20} concept of $c$-differential uniformity, in general is not invariant under EA or CCZ-equivalence, as was observed in \cite{SPRS20}. In this paper, we find an intriguing behavior of the inverse function, namely, that adding some appropriate linearized monomials increases the $c$-differential uniformity significantly, for some~$c$. For example, adding the linearized monomial $x^{p^d}$, where $d$ is the largest nontrivial divisor of $n$, increases the mentioned $c$-different…
Recently, a new concept called the $c$-differential uniformity was proposed by Ellingsen et al. (2020), which allows to simplify some types of differential cryptanalysis. Since then, finding functions having low $c$-differential uniformity has attracted the attention of many researchers. However it seems that, at this moment, there are not many non-monomial permutations having low $c$-differential uniformity. In this paper, we propose new classes of almost perfect $c$-nonlinear non-monomial permutations over a binary field.
Functions with low differential uniformity can be used in a block cipher as S-boxes since they have good resistance to differential attacks. In this paper we consider piecewise constructions for permutations with low differential uniformity. In particular, we give two constructions of differentially 6-uniform functions, modifying the Gold function and the Bracken-Leander function on a subfield.
Differential uniformity is a significant concept in cryptography as it quantifies the degree of security of S-boxes respect to differential attacks. Power functions of the form $F(x)=x^d$ with low differential uniformity have been extensively studied in the past decades due to their strong resistance to differential attacks and low implementation cost in hardware. In this paper, we give an affirmative answer to a recent conjecture proposed by Budaghyan, Calderini, Carlet, Davidova and Kaleyski about the differential uniformity of $F(x)=x^d$ over $\mathbb{F}_{2^{4n}}$, where $n$ is a positive i…
The concept of differential uniformity was recently extended to the $c$-differential uniformity. An interesting problem in this area is the construction of functions with low $c$-differential uniformity and a lot of research has been done in this direction in the recent past. Here, we present three classes of (almost) perfect $c$-nonlinear permutations over finite fields of even characteristic.
On Differential and Boomerang Properties of a Class of Binomials over Finite Fields of Odd Characteristic
Institute of Basic Science, Sungkyunkwan University（基础科学研究院，成均馆大学）；Department of Mathematics, Sungkyunkwan University（数学系，成均馆大学）；Applied Algebra and Optimization Research Center, Sungkyunkwan University（应用代数与优化研究中心，成均馆大学）
Finding permutation polynomials with low differential and boomerang uniformityis an important topic in S-box designs of many block ciphers. For example, AES chooses the inverse function as its S-box, which is differentially 4-uniform and boomerang 6-uniform. Also there has been considerable research on many non-quadratic permutations which are obtained by modifying certain set of points from the inverse function. In this paper, we give a novel approach that shows that plenty of existing modifications of the inverse function are in fact affine equivalent to permutations of low Carlitz rank and …
In a prior paper \cite{EFRST20}, two of us, along with P. Ellingsen, P. Felke and A. Tkachenko, 1defined a new (output) multiplicative differential, and the corresponding $c$-differential uniformity, which has the potential of extending differential cryptanalysis. Here, we continue the work, by looking at some APN functions through the mentioned concept and showing that their $c$-differential uniformity increases significantly, in some cases.
We consider the boomerang uniformity of an infinite class of (locally-APN) power maps and show that its boomerang uniformity over the finite field $\F_{2^n}$ is $2$ and $4$, when $n \equiv 0 \pmod 4$ and $n \equiv 2 \pmod 4$, respectively. As a consequence, we show that for this class of power maps, the differential uniformity is strictly greater than its boomerang uniformity.
In this paper we generalize Dillon's switching method to characterize the exact $c$-differential uniformity of functions constructed via this method. More precisely, we modify some PcN/APcN and other functions with known $c$-differential uniformity in a controllable number of coordinates to render more such functions. We present several applications of the method in constructing PcN and APcN functions with respect to all $c\neq 1$. As a byproduct, we generalize some result of [Y. Wu, N. Li, X. Zeng, {\em New PcN and APcN functions over finite fields}, Designs Codes Crypt. 89 (2021), 2637--2651…
Only three classes of Almost Perfect Nonlinear (for short, APN) power functions over odd characteristic finite fields have been investigated in the literature, and their differential spectra were determined. The differential uniformity of the power function $F(x)=x^{\frac{p^{n}-3}{2}}$ over the finite field $F_{p^n}$ of order $p^n$ (where $p$ is an odd prime), was studied by Helleseth and Sandberg in 1997, where $p^n\equiv3\pmod{4}$ is an odd prime power with $p^n>7$. It was shown that $F$ is PN when $p^n=27$, APN when $5$ is a nonsquare in $F_{p^n}$, and differentially $3$-uniform when $5$ is…
Let $q$ be an odd prime power. Let $F_1(x)=x^{d_1}$ and $F_2(x)=x^{d_2}$ be power mappings over $\mathrm{GF}(q^2)$, where $d_1=q-1$ and $d_2=d_1+\frac{q^2-1}{2}=\frac{(q-1)(q+3)}{2}$. In this paper, we study the the boomerang uniformity of $F_1$ and $F_2$ via their differential properties. It is shown that, the boomerang uniformity of $F_i$ ($i=1,2$) is 2 with some conditions on $q$.
Motivated by the problem of constructing bijective maps with low differential uniformity, we introduce the notion of permutation resemblance of a function, which looks to measure the distance a given map is from being a permutation. We prove several results concerning permutation resemblance and show how it can be used to produce low differentially uniform bijections. We also study the permutation resemblance of planar functions, which over fields of odd characteristic are known not to be bijections and to have the optimal differential uniformity.
On APN Exponents and the Differential and Boomerang Properties of Binomials in Characteristic 3
Institute of Basic Science, Sungkyunkwan University（基础科学研究所，成均馆大学）；Department of Mathematics, Sungkyunkwan University（数学系，成均馆大学）；Applied Algebra and Optimization Research Center, Sungkyunkwan University（应用代数与优化研究中心，成均馆大学）
Functions with low differential uniformity can be used as the s-boxes of symmetric cryptosystems as they have good resistance to differential attacks. The AES (Advanced Encryption Standard) uses a differentially-4 uniform function called the inverse function. Any function used in a symmetric cryptosystem should be a permutation. Also, it is required that the function is highly nonlinear so that it is resistant to Matsui's linear attack. In this article we demonstrate that a highly nonlinear permutation discovered by Hans Dobbertin has differential uniformity of four and hence, with respect to …
Functions with low differential uniformity have relevant applications in cryptography. Recently, functions with low $c$-differential uniformity attracted lots of attention. In particular, so-called APcN and PcN functions (generalization of APN and PN functions) have been investigated. Here, we provide a characterization of such functions via quadratic polynomials as well as non-existence results.
For a function $f$ from $\mathbb{F}_2^n$ to $\mathbb{F}_2^n$, the planarity of $f$ is usually measured by its differential uniformity and differential spectrum. In this paper, we propose the concept of vanishing flats, which supplies a combinatorial viewpoint on the planarity. First, the number of vanishing flats of $f$ can be regarded as a measure of the distance between $f$ and the set of almost perfect nonlinear functions. In some cases, the number of vanishing flats serves as an "intermediate" concept between differential uniformity and differential spectrum, which contains more informatio…
An in-depth study of the power function $x^{q+2}$ over the finite field $\mathbb{F}_{q^2}$: the differential, boomerang, and Walsh spectra, with an application to coding theory
Recently, a new concept called multiplicative differential cryptanalysis and the corresponding $c$-differential uniformity were introduced by Ellingsen et al.~\cite{Ellingsen2020}, and then some low differential uniformity functions were constructed. In this paper, we further study the constructions of perfect $c$-nonlinear (PcN) power functions. First, we give a necessary and sufficient condition for the Gold function to be PcN and a conjecture on all power functions to be PcN over $\gf(2^m)$. Second, several classes of PcN power functions are obtained over finite fields of odd characteristic…
In this paper, we study the boomerang spectrum of the power mapping $F(x)=x^{k(q-1)}$ over ${\mathbb F}_{q^2}$, where $q=p^m$, $p$ is a prime, $m$ is a positive integer and $\gcd(k,q+1)=1$. We first determine the differential spectrum of $F(x)$ and show that $F(x)$ is locally-APN. This extends a result of [IEEE Trans. Inf. Theory 57(12):8127-8137, 2011] from $(p,k)=(2,1)$ to general $(p,k)$. We then determine the boomerang spectrum of $F(x)$ by making use of its differential spectrum, which shows that the boomerang uniformity of $F(x)$ is 4 if $p=2$ and $m$ is odd and otherwise it is 2. Our re…
Recently, a new concept called multiplicative differential was introduced by Ellingsen et al. Inspired by this pioneering work, power functions with low c-differential uniformity were constructed. Wang et al. defined the c-differential spectrum of a power function [27]. In this paper, we present some properties of the c-differential spectrum of a power function. Then we apply these properties to investigate the c-differential spectra of some power functions. A new class of APcN function is also obtained.
EFRST20, the notion of $c$-differentials was introduced as a potential expansion of differential cryptanalysis against block ciphers utilizing substitution boxes. Drawing inspiration from the technique of higher order differential cryptanalysis, in this paper we propose the notion of higher order $c$-derivatives and differentials and investigate their properties. Additionally, we consider how several classes of functions, namely the multiplicative inverse function and the Gold function, perform under higher order $c$-differential uniformity.
Vectorial Boolean functions are crucial building-blocks in symmetric ciphers. Different known attacks on block ciphers have resulted in diverse cryptographic criteria for vectorial Boolean functions, such as differential uniformity and nonlinearity. Very recently, Bar-On et al. introduced at Eurocrypt'19 a new tool, called the differential-linear connectivity table (DLCT), which allows for taking into account the dependency between the two subciphers $E_0$ and $E_1$ involved in differential-linear attacks. This new notion leads to significant improvements of differential-linear attacks on seve…
In the literature, there are many APN-like functions that generalize the APN properties or are similar to APN functions, e.g. locally-APN functions, 0-APN functions or those with boomerang uniformity 2. In this paper, we study the problem of constructing infinite classes of APN-like but not APN power functions. For one thing, we find two infinite classes of locally-APN but not APN power functions over $\gf_{2^{2m}}$ with $m$ even, i.e., $\mathcal{F}_1(x)=x^{j(2^m-1)}$ with $\gcd(j,2^m+1)=1$ and $\mathcal{F}_2(x)=x^{j(2^m-1)+1}$ with $j = \frac{2^m+2}{3}$. As far as the authors know, our infini…
