Search

Differential analysis is an important cryptanalytic technique on block ciphers. In one form, this measures the probability of occurrence of the differences between certain input vectors and the corresponding output vectors. For this analysis, the constituent S-boxes of a block cipher need to be studied carefully. In this direction, we derive further cryptographic properties of the multiplicative inverse function, especially the ones related to higher order differentials. This improves some theoretical results of Boukerrou et al. [ToSC 2020(1)]. Further, we prove that the multiplicative inverse function defined over F 2 n has an error (bias) in its second order differential spectrum with probability 1 2 n − 2 , and that error occurs in more than one place. Next, we analyze the Gowers uniformity norm of S-boxes, which is also a measure connected to higher order approximations. Finally, the bounds related to the nonlinearity profile of the multiplicative inverse function are derived using both Gowers U 3 norm and Walsh–Hadamard spectrum. Some of our findings here provide slightly improved bounds over the work of Carlet [IEEE-IT, 2008]. These theoretical insights might have implications towards non-randomness of a block cipher, where the multiplicative inverse function is used as a primitive.

Several constructions of Mutually Unbiased Bases (MUBs) borrow tools from combinatorial objects. In this paper we focus on how one can construct Approximate Real MUBs (ARMUBs) with improved parameters using results from the domain of Resolvable Block Designs (RBDs). We first explain the generic idea of our strategy in relating the RBDs with MUBs/ARMUBs, which are sparse (the basis vectors have small number of non-zero co-ordinates). Then specific parameters are presented, for which we can obtain new classes and improve the existing results. To be specific, we present an infinite family of $\lceil \sqrt {d}\rceil $ many ARMUBs for dimension d = q(q + 1), where q ≡ 3 mod 4 and it is a prime power, such that for any two vectors v1,v2 belonging to different bases, $|\langle {v_{1}|v_{2}}\rangle | < \frac {2}{\sqrt {d}}$ . We also demonstrate certain cases, such as d = sq2, where q is a prime power and sq ≡ 0 mod 4. These findings subsume and improve our earlier results in [Cryptogr. Commun. 13, 321-329, January 2021]. This present construction idea provides several infinite families of such objects, not known in the literature, which can find efficient applications in quantum information processing for the sparsity, apart from suggesting that parallel classes of RBDs are intimately linked with MUBs/ARMUBs.

In this paper we exploit elementary combinatorial techniques to settle different cryptanalytic observations on RC4 that remained unproved for more than two decades. At the same time, we present new observations with theoretical proofs. We first prove the biases (non-randomness) presented by Fluhrer and McGrew (FSE 2000) two decades ago. It is surprising that though the biases have been published long back, and there are many applications of them in cryptanalysis till recent days as well, the proofs have never been presented. In this paper, we complete that task and also show that any such bias immediately provides a glimpse of hidden variables in RC4. Further, we take up the biases of two non-consecutive key-stream bytes skipping one byte in between. We show the incompleteness of such a result presented by SenGupta et al. (JoC, 2013) and provide new observations and proofs in this direction relating the key-stream bytes and glimpses. Similarly, we streamline certain missed observation in the famous Glimpse theorem presented by Jenkins in 1996. Our results point out how biases of RC4 key-stream and the Glimpses of the RC4 hidden variables are related. It is evident from our results that the biases and glimpses are everywhere in RC4 and it needs further investigation as we provide very high magnitude of glimpses that were not known earlier.

Construction of Mutually Unbiased Bases (MUBs) is a very challenging combinatorial problem in quantum information theory with several long standing open questions in this domain. With certain relaxations, the object Approximate Mutually Unbiased Bases (AMUBs) is defined in this context. In this paper we provide a method to construct upto $(\sqrt {d} + 1)$ many AMUBs in dimension d = q2, where q is a positive integer. The result is particularly important when q ≡ 0 mod 4, as we obtain Approximate Real MUBs (ARMUBs) assuming the cases where a Hadamard matrix of order q exists. In this construction, we also characterize the inner product values between the elements of two different bases. In particular, when d is of the form (4x)2 where x is a prime, we obtain $(\frac {\sqrt {d}}{4}+1)$ ARMUBs such that for any two vectors v1,v2 belonging to different bases, $|{\left \langle \left . v_{1} \right | v_{2} \right \rangle }| \leq \frac {4}{\sqrt {d}}$ .

In this paper we provide a theoretical argument towards an unsolved question related to Mantin’s “Digraph Repetition Bias” (Eurocrypt 2005) that is observed in the key-stream of RC4. The open question, that depends on the observation that arrival of four consecutive same bytes (of the form AAAA) in RC4 key-stream is slightly negatively biased, was posed by Bricout et al (Des. Codes Cryptogr. 86:743–770, 2018) in 2016. Moreover, for the first time, we consider the “Reverse Digraph Repetition Bias” and show that there is significant negative bias in arrival of ABBA (A, B two distinct bytes) in RC4 key-stream.

In this paper we investigate different questions related to bent–negabent functions. We first take an expository look at the state-of-the-art research in this domain and point out some technical flaws in certain results and fix some of them. Further, we derive a necessary and sufficient condition for which the functions of the form $${\mathbf{x}}\cdot \pi ({\mathbf{y}})\oplus h({\mathbf{y}})$$ [Maiorana–McFarland ( $${\mathcal {M}}$$ )] is bent–negabent, and more generally, we study the non-existence of bent–negabent functions in the $${\mathcal {M}}$$ class. We also identify some functions that are bent–negabent. Next, we continue the recent work by Mandal et al. (Discrete Appl Math 236:1–6, 2018) on rotation symmetric bent–negabent functions and show their non-existence in larger classes. For example, we prove that there is no rotation symmetric bent–negabent function in $$4p^k$$ variables, where p is an odd prime. We present the non-existence of such functions in certain classes that are affine transformations of rotation symmetric functions. Keeping in mind the existing literature, we correct here some technical issues and errors found in other papers and provide some novel results.

Exact requirement of controlled NOT (CNOT) and single-qubit gates to implement a quantum algorithm in a given architecture is one of the central problems in this computational paradigm. In this article, we take a tutorial approach in explaining the preparation of Dicke states (|Dkn〉) using concise realizations of partially defined unitary transformations. We show how to efficiently implement the state-of-the-art deterministic Dicke state preparation circuits and in turn optimize them in terms of CNOT and single-qubit gate counts. We explain theoretical ideas in reducing the gate counts and observe how these improvements are reflected in actual implementation of the circuits. To emphasize the advantages, we describe the circuit for preparing |D24〉 on the “ibmqx2” machine of the IBM quantum experience (QX) service. Our approach shows that the error induced due to noise in the system is lesser in comparison to the existing works. We conclude by describing the CNOT map of the generic |Dkn〉 preparation circuit and analyze different ways of distributing the CNOT gates in the circuit and its effect on the induced error in the Noisy Intermediate Scale Quantum environment.

Quantum dialogue (QD) refers to secure full-duplex quantum communication which was first proposed by Nguyen in 2004. Later on, Tan and Cai (Int J Quant Inf, 2008) pointed the vulnerabilities of Nguyen’s proposal. To enhance the overall security, Maitra (Quant Inf Process, 2017) recently proposed a measurement device independent (MDI) scheme in this direction. In this current initiative, we propose a reference frame independent measurement device independent quantum dialogue (RFI-MDI QD) scheme to obtain the advantages of both practicality and security. To the best of our knowledge, this is the first initiative to combine the ideas of reference frame independence and measurement device independence in the QD regime. Towards approaching this proposal, we analyse the existing dialogue schemes and show that the claim of Tan and Cai regarding Nguyen’s proposal (Phys Lett A, 2004) has to be revisited to remove certain inaccuracies. We also identify some limitations in Maitra’s MDI-QD proposal and suggest suitable modifications. We evaluate the performance of all our proposed schemes by providing formal security proofs and also discuss the relative advantages of our proposals over the conventional message transfer procedures.

In this study, the authors construct two different distinguishers on Grain-v1 with 112 and 114 initialisation rounds. Their first distinguisher can distinguish Grain-v1 with 112 initialisation rounds from a uniform random source for 99% of the randomly chosen keys from full key space. The second one can distinguish Grain-v1 from a random source for 73% of the randomly chosen keys for one-fourth of the total key space (2 78 keys out of 2 80 keys). Our results improve upon the earlier distinguishers. The technique used for the distinguishers is conditional differential cryptanalysis. The existing works in this direction considered only one bit difference in the initialisation vector. However, for the first time, they could handle complicated conditions for the 2-bit difference to obtain better cryptanalytic results. Extending their technique by allowing the 1-bit difference in the pair of keys (i.e. related keys) and the 4-bit difference in IVs, they could observe the non-randomness till 116 initialisation rounds with a success in 62% cases.

In this paper we prove that all bent functions in the Kerdock code, except for the coset of the symmetric quadratic bent function, are bent–negabent. In this direction, we characterize the set of quadratic bent–negabent functions and show some results connecting quadratic bent–negabent functions and the Kerdock code. Further, we note that there are bent–negabent preserving nonsingular transformations outside the well known class of orthogonal ones that might provide additional functions in the bent–negabent set. This is the first time we could identify non-orthogonal (nonsingular) linear transformations that preserve bent–negabent property for a special subset.

Kavut, Selçuk (Balikesir Author), Very recently, a class of cryptographically significant Boolean functions were constructed by Tang and Maitra [IEEE Trans. Inform. Theory, 64 ( 2018), pp. 393-402] by modifying the PSap class of bent functions. The basic ideas used in Tang-Maitra construction were derived from a modification of a subclass of bent functions which is defined over the finite field, and a concern was raised in the same paper whether the implementation of such functions will be as efficient as that of Maiorana-McFarland type bent functions. In this paper, we look at the concrete realization of such functions over a vector space and answer the question positively. The first part of this paper investigates how the finite field implementation of the functions can be viewed as simple truth tables. Next, we present a completely new construction that itself starts from Maiorana-McFarland bent functions which are straightforward concatenations of linear functions., National Natural Science Foundation of China - 61872435 61602394 Fundamental Research Funds for the Central Universities - 2682016CX113 2682018ZT25

In this paper, we study the separation between the deterministic (classical) query complexity (D) and the exact quantum query complexity ( $$Q_E$$ ) of several Boolean function classes using the parity decision tree method. We first define the query friendly (QF) functions on n variables as the ones with minimum deterministic query complexity D(f). We observe that for each n, there exists a non-separable class of QF functions such that $$D(f)=Q_E(f)$$ . Further, we show that for some values of n, all the QF functions are non-separable. Then, we present QF functions for certain other values of n where separation can be demonstrated, in particular, $$Q_E(f)=D(f)-1$$ . In a related effort, we also study the Maiorana–McFarland (MM)-type Bent functions. We show that while for any MM Bent function f on n variables $$D(f) = n$$ , separation can be achieved as $$\frac{n}{2} \le Q_E(f) \le \lceil \frac{3n}{4} \rceil $$ . Our results highlight how different classes of Boolean functions can be analyzed for classical–quantum separation exploiting the parity decision tree method.

Grover’s algorithm provides a square root improvement over its classical counterpart in searching an unsorted array. The most important part of this algorithm is that, it can amplify the amplitude of a subset of states and reduce that of the others. First, we show how the satisfying inputs of a Boolean function can be efficiently discovered by the Grover’s strategy. Further, one can consider the state out of the Deutsch-Jozsa algorithm that is related to Walsh spectrum of a Boolean function, and then try to amplify certain places through Grover to understand the Walsh spectrum distribution with further accuracy. In particular, we provide detailed understanding of how the nonlinearity and resiliency of a Boolean function can be studied in this direction. Examples and Qiskit codes are presented here to explain the idea with complete details.

In this chapter we study the well known Deutsch-Jozsa algorithm and relate it with the Walsh spectrum of a Boolean function. We first introduce the basics of Boolean functions and then proceed with the quantum algorithms that deal with them. Different scenarios are presented to show how the Walsh spectrum of a Boolean function evolves during the execution of the Deutsch-Jozsa and other related algorithms. Necessary implementations in the Qiskit SDK are also presented.

Simon’s algorithm is another important evidence that more efficient evaluations of certain properties are possible in quantum domain over the classical paradigm. Given a vectorial Boolean function on n variables that has certain periodicity, this algorithm is capable of obtaining the period in time complexity polynomial in n. In this chapter, we explain this algorithm in detail. Then we concentrate on the autocorrelation spectrum of a single output Boolean function and study how the quantum strategies fare in this domain. We present quantum algorithms to study the Walsh spectrum of higher order derivatives of a Boolean function. Examples and Qiskit codes are presented to explain the methods.

In this chapter, we describe a detailed design specification of ZUC stream cipher. This cipher forms the core of the third set of integrity and confidentiality algorithm of the 4G LTE architecture. We describe the design specification of ZUC with respective C codes of different phases.

ZUC has been subject to almost a decade of cryptanalysis at the time of this book. There have been some weaknesses found in the earlier versions of the cipher which has led to the improvement in this cipher. The latest version of ZUC, i.e., ZUC 1.6 has withstood cryptanalysis and has not shown any weaknesses as of now. In this chapter, we go over an analysis of the different part of ZUC cipher and also some of the weaknesses found in the earlier version of the cipher, i.e., ZUC 1.4. We first study a few cryptographic properties of the cipher and then we describe a differential attack on ZUC 1.4. Further, we present a forgery attack on an older integrity protocol of EIA3.

In this concluding chapter, we briefly revisit what we have studied in this book and then outline the recent state-of-the-art results related to quantum cryptanalysis of symmetric ciphers.

Here we revisit the quantum algorithms for obtaining Forrelation [Aaronson et al, 2015] values to evaluate some of the well-known cryptographically significant spectra of Boolean functions, namely the Walsh spectrum, the cross-correlation spectrum and the autocorrelation spectrum. We introduce the existing 2-fold Forrelation formulation with bent duality based promise problems as desirable instantiations. Next we concentrate on the $3$-fold version through two approaches. First, we judiciously set-up some of the functions in $3$-fold Forrelation, so that given an oracle access, one can sample from the Walsh Spectrum of $f$. Using this, we obtain improved results than what we obtain from the Deutsch-Jozsa algorithm, and in turn it has implications in resiliency checking. Furthermore, we use similar idea to obtain a technique in estimating the cross-correlation (and thus autocorrelation) value at any point, improving upon the existing algorithms. Finally, we tweak the quantum algorithm with superposition of linear functions to obtain a cross-correlation sampling technique. To the best of our knowledge, this is the first cross-correlation sampling algorithm with constant query complexity. This also provides a strategy to check if two functions are uncorrelated of degree $m$. We further modify this using Dicke states so that the time complexity reduces, particularly for constant values of $m$., Comment: 16 Pages, 5 figures

Digital Contact Tracing (DCT) protocols and systems usually rely upon close-range communication between handheld devices (like smartphones or tablets), primarily using the Bluetooth Low Energy (BLE) interface and a client-server mode of communication between the apps installed on the devices and the backend server(s). Depending upon the role played by the backend server(s), DCT protocols, and systems are usually classified under centralized or decentralized categories. In this chapter, we focus on decentralized DCT protocols, namely, Apple-Google Exposure Notification Framework (ENF), DP3T, East Coast PACT, West Coast PACT, and TCN. Towards the end, we describe Epione, which though categorized under decentralized systems according to the classification provided in Chap. 2, contains many features akin to that of centralized systems.

In this chapter, we discuss the future of digital contact tracing systems and the evolving role of cryptography in this regard. We mostly concentrate on how a decentralized system should be designed maintaining the privacy of the users. We first consider an ideal system and then move forward towards a more realistic one. The assumptions and cryptologic issues are explained. The system may also be used as a centralized one with certain design modifications. We discuss higher order contact tracing in terms of the neighborhood of a neighborhood, i.e., one more level of indirection. This is the concluding chapter of this brief manuscript.

Digital Contact Tracing (DCT) protocols and systems usually rely on close-range communications between handheld devices (like smartphones and tablets), primarily through a Bluetooth Low Energy (BLE) interface and a client-server mode of communication between the apps installed on the devices and the backend server(s). Depending upon the role played by the backend server(s), DCT protocols and systems are usually classified as centralized or decentralized. In Chap. 1, we have discussed some of the competing ways of classifying systems, eventually settling with the following broad-level understanding: for the scope of this book, we shall consider a system (or a protocol) centralized if the backend server(s) plays (or play) a dominant role in deciding the risk level (or risk-score) of an individual being infected. This chapter focuses on centralized systems and protocols like BlueTrace, TraceTogether, COVIDSafe, ROBERT etc. It also presents a generalized framework of centralized systems before going deep into the specific systems. The chapter ends with discussions on systems that lie in between the centralized and decentralized categories, thus setting the stage for decentralized systems in Chap. 3. © 2020, The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.

Boolean functions are usually studied under the assumption that each input bit is considered independent and identically distributed. However, in the case of some stream ciphers, a keystream bit is generated by using a nonlinear Boolean function with inputs from a restricted domain. At Eurocrypt 2016, one such stream cipher (FLIP) has been proposed, where a Boolean function on $n$ variables was exploited with inputs of weight $\frac {n}{2}$ only. Recently, Carlet et al. studied several properties of such functions and obtained certain bounds on linear approximations of direct sum in the restricted domain. In this paper, we observe that for a direct sum like $f=f_{1}+f_{2}$ , the inputs to each sub-function $f_{1}$ , $f_{2}$ do not follow a uniform distribution in the restricted domain. In this regard, we study the properties of the Boolean functions by considering a general probability distribution on the inputs. We further obtain several bounds related to the biases of direct sums. Finally, we obtain a lower bound on the bias of the nonlinear filter function of FLIP. Our results provide a general framework to study security parameters of ciphers over restricted domain.

We present three categories of new non-randomness results on RC4 here. First, using Jenkins’ Glimpse result (1996), we show that for every round, the key-stream value comes from a distant permutation array (S-Box) byte position with a probability higher than the fair chance. Moreover, we show how the Jenkins’ Glimpse gets modified when the two consecutive output keystream bytes are equal to a certain value. Second, we show that corresponding to every Fluhrer-McGrew bias (2000), the key-stream value for each of the two rounds comes from certain array positions with a higher (or a lower) probability than the uniform one, depending upon whether the double-byte is positively or negatively biased. Also, there are four “lag-one digraph” (or alternate pair double-byte) biases that have been summarized in a recent paper. We show that for each of these cases, there are preferred positions of permutation array byte corresponding to the key-stream value in that round. Third, we show that in each of the Fluhrer-McGrew or lag-one cases, the Jenkins’ correlation results must be refined. Surprisingly, in one particular configuration, the Glimpse correlation value becomes almost \(\frac{4}{N}\) instead of Jenkins’ \(\frac{2}{N}\).

Designing S-box with good cryptographic properties still remains as one of the most important areas of research in symmetric key cryptography. For quite sometime, inverse function (\(x\mapsto x^{-1}\), i.e., \(x^{2^n-2}\)) over \(\mathbb {F}_{2^n}\) has been the most popular choice for S-boxes due to good resistance against differential and linear cryptanalysis. Very recently Tang et. al. (2020) proved that inverse function admits a bias (error) of \(\frac{1}{2^{n-2}}\) when considered in its second-order differential spectrum. In this paper we present experimental results related to higher-order differential spectrum of multiplicative inverse functions for \(n=6\) and 8 and compare the result with APN permutation for \(n=6\). In particular, we observe that APN permutation over \(\mathbb {F}_{2^6}\) has larger bias in its second-order differential spectrum with probability \(\frac{1}{8}\) ( \(\frac{1}{2^{n-2}}\)). This fact admits the possibility of higher-order differential attacks against block ciphers which employ APN permutations as a nonlinear layer.

In this chapter, we will discuss the basic understanding of contact tracing software and the related cryptographic techniques. The underlying models of computation and communication will be explained. A standard smartphone can be considered as the basic device and there will be communication among those devices using Bluetooth technology. The data transfer between the mobile device and the backend server (might be controlled by governmental authorities) will be taken care of by the standard data communication channel provided by the service provider. Social issues related to privacy will also be touched upon in this introductory chapter.

It is known that for a stream cipher with state size less than 2.5 times the key size, it is possible to mount a Time-Memory-Data Trade-Off attack with an online complexity lower than the exhaustive key search. The search space is restricted by considering a fixed keystream prefix and deducing certain state bits by formulating equations. We show how by using SAT solving techniques one can automate this process of solving equations and obtain better parameters. This is demonstrated by mounting TMDTO attacks on ACORN v3 and Grain v1. We show that a TMDTO attack can be mounted on ACORN v3 with a preprocessing complexity 2171 and 2180 (without and with the help of a SAT solver) and the maximum of online time, memory and data complexities 2122 and 2120 respectively. For Grain v1, we show that it is possible to obtain parameters as T = 268.06, M = 264, D = 268 with a preprocessing complexity of 296. While our results do not refute any claim of the designers, these observations might be useful for further understanding of the ciphers.

Lizard is a very recently proposed lightweight stream cipher that claims 60 bit security against distinguishing (related to state recovery) and 80 bit security against key recovery attack. This cipher has 121 bit state size. In this paper, we first note that using $\psi$ key stream bits one can recover $\psi$ unknown bits of the state when $\tau$ state bits are fixed to a specific pattern. This is made possible by guessing the remaining state bits. We present certain values of $\psi, \tau$ based on the state size that helps in mounting a generic conditional TMDTO attack following the BSW sampling. For Lizard, we obtain the preprocessing complexity as $2^{67}$ , and the maximum of Data, Time and Memory complexity during the online phase as $2^{54}$ . The parameters in the online phase are significantly less than $2^{60}$ .

In this communication, we present a characterization of bent–negabent functions, which is related to the autocorrelation spectra. A special case of this characterization is then exploited to prove that there is no rotation symmetric Boolean function in n = 2 p k variables which is bent–negabent when p is an odd prime and k is any positive integer.

In this paper, we consider the maximum absolute value $\Delta _{f}$ in the autocorrelation spectrum (not considering the zero point) of a function $f$ . In an even number of variables $n$ , bent functions possess the highest nonlinearity with $\Delta _{f} = 0$ . The long standing open question (for two decades) in this area is to obtain a theoretical construction of balanced functions with $\Delta _{f} . So far, there are only a few examples of such functions for $n = 10, 14$ , but no general construction technique is known. In this paper, we mathematically construct an infinite class of balanced Boolean functions on $n$ variables having absolute indicator strictly lesser than $\delta _{n} = 2^{n/2}-2^{(({n+6})/{4})}$ , nonlinearity strictly greater than $\rho _{n} = 2^{n-1} - 2^{n/2} + 2^{n/2-3} - 5\cdot 2^{(({n-2})/{4})}$ and algebraic degree $n-1$ , where $n\equiv 2 \pmod 4$ and $n\geq 46$ . While the bound $n \geq 46$ is required for proving the generic result, our construction starts from $n = 18$ , and we could obtain balanced functions with $\Delta _{f} and nonlinearity $> 2^{n-1} - 2^{n/{2}}$ for $n = 18, 22$ , and 26.

The differential-linear connectivity table (DLCT) of a vectorial Boolean function was recently introduced by Bar-On et al. at EUROCRYPT'19, whose value at a point is related to the autocorrelation value of its component functions. Further, in INDOCRYPT'19, we proposed a new construction method for vectorial Boolean functions with very low differential-linear uniformity using Maiorana–McFarland bent functions. The difficulty of that construction method was to identify the permutations and the sub-functions that satisfy the conditions to attain good cryptographic properties. In this paper we discover novel techniques to construct such sub-functions to generate vectorial Boolean functions with substantially improved cryptographic properties. Our proposed methods are based on ideas from combinatorics as well as finite fields. In particular, we construct the sub-functions to generate ( 4 t , t − 1 ) -function, t ≥ 5 , in a different manner than our Indocrypt'19 paper. Further our new methods help in obtaining sub-functions to generate balanced ( 4 t + 2 , t − 1 ) -function and ( 2 k , k ) -function with very good nonlinearity and very low differential-linear uniformity, that were never demonstrated earlier.

Lightweight stream ciphers have received serious attention in the last few years. The present design paradigm considers very small state (less than twice the key size) and use of the secret key bits during pseudo-random stream generation. One such effort, Sprout, had been proposed two years back and it was broken almost immediately. After carefully studying these attacks, a modified version named Plantlet has been designed very recently. While the designers of Plantlet do not provide any analysis on fault attacks, we note that Plantlet is even weaker than Sprout in terms of Differential Fault Attack (DFA). Our investigation, following the similar ideas as in the analysis against Sprout, shows that we require only around 4 faults to break Plantlet by DFA in a few hours time. While fault attack is indeed difficult to implement and our result does not provide any weakness of the cipher in normal mode, we believe that these initial results will be useful for further understanding of Plantlet.

International audience; The differential-linear connectivity table (DLCT) of a vectorial Boolean function was recently introduced by Bar-On et al. at EUROCRYPT’ 19. In this paper we construct a new class of balanced vectorial Boolean functions with very low differential-linear uniformity and provide a combinatorial count of hardware gates which is required to implement such circuits. Here, all the coordinate functions are constructed by modifying the Maiorana-McFarland bent functions. Further, we derive some properties of DLCT and differential-linear uniformity of modified inverse functions.

Kavut, Selçuk (Balikesir Author), In a very recent work by Tang and Maitra (IEEE Ttans Inf Theory 64(1):393-402, 2018], a theoretical construction of balanced functions f on n-variables (n2has been presented. The theoretical bounds could be satisfied for all such n46. The case for could not be solved in the said paper and it has also been pointed out that though theoretically not proved, such constructions may provide further interesting examples of Boolean functions. In this follow-up work, we concentrate in two directions. First we present a construction method for balanced functions f on n-variables (and n52) with Secondly, we apply search methods in suitable places to obtain balanced functions on even variables in the interval [10,...,26] with improved parameters that could never be achieved before. As a consequence, for the first time we could provide examples of balanced Boolean functions f having for where n=12,16,20, and 24. Whatever functions we present in this paper have nonlinearity greater than 2n-1-2n/2., National Natural Science Foundation of China - 61602394 Fundamental Research Funds for the Central Universities - 2682018ZT25 2682016CX113