Search

We study the application of Hamming codes to wet paper steganography. To that end, we propose the use of decoding algorithms that do not verify the minimum distance property and present one of these algorithms. We study its properties and show results of some numerical experiments.

Let $$p$$ p and $$q$$ q be two odd primes with $$p=Mf+1$$ p = Mf + 1 and $$M$$ M is even. A new construction of $$M$$ M -ary sequences of period $$pq$$ pq with low periodic autocorrelation is presented in this paper based on interleaving the $$M$$ M -ary power residue sequence of period $$p$$ p according to the quadratic residue with respect to $$q$$ q . This construction can generate the well-known twin-prime sequence and generalized cyclotomy sequence of order two if $$M=2$$ M = 2 . For $$M=4$$ M = 4 , a new class of quaternary sequences of period $$pq$$ pq with maximal nontrivial autocorrelation value being either $$\sqrt{5}$$ 5 or $$3$$ 3 is obtained. This achieves the best known results for such kind of quaternary sequences.

Linear codes with good parameters have wide applications in secret sharing schemes, authentication codes, association schemes, consumer electronics and communications, etc. During the past four decades, constructions of linear codes with good parameters received much attention and many classes of such codes were presented. In this paper, we obtain a family of linear codes with good parameters over $$\mathbb {F}_p$$ by exploring further properties of constant dimension subspace codes, where p is a prime. The weight distribution of three classes of linear codes presented in this family is determined. Most notably, three classes of linear codes presented in this family are distance-optimal with respect to the Griesmer bound. Also, this paper presents a sufficient and necessary condition for this family of linear codes to have a $$\lambda $$ -dimensional hull. In addition, we show that our linear codes can be used to construct secret sharing schemes with interesting access structures and strongly regular graphs.

In an earlier paper by three of the present authors and Csaba Schneider, it was shown that, for $$m\ge 2$$ m ≥ 2 , a set of $$m+1$$ m + 1 partitions of a set $$\Omega $$ Ω , any m of which are the minimal non-trivial elements of a Cartesian lattice, either form a Latin square (if $$m=2$$ m = 2 ), or generate a join-semilattice of dimension m associated with a diagonal group over a base group G. In this paper we investigate what happens if we have $$m+r$$ m + r partitions with $$r\ge 2$$ r ≥ 2 , any m of which are minimal elements of a Cartesian lattice. If $$m=2$$ m = 2 , this is just a set of mutually orthogonal Latin squares. We consider the case where all these squares are isotopic to Cayley tables of groups, and give an example to show the groups need not be all isomorphic. For $$m>2$$ m > 2 , things are more restricted. Any $$m+1$$ m + 1 of the partitions generate a join-semilattice admitting a diagonal group over a group G. It may be that the groups are all isomorphic, though we cannot prove this. Under an extra hypothesis, we show that G must be abelian and must have three fixed-point-free automorphisms whose product is the identity. (We describe explicitly all abelian groups having such automorphisms.) Under this hypothesis, the structure gives an orthogonal array, and conversely in some cases. If the group is cyclic of prime order p, then the structure corresponds exactly to an arc of cardinality $$m+r$$ m + r in the $$(m-1)$$ ( m - 1 ) -dimensional projective space over the field with p elements, so all known results about arcs are applicable. More generally, arcs over a finite field of order q give examples where G is the elementary abelian group of order q. These examples can be lifted to non-elementary abelian groups using p-adic techniques.

The problem of classifying linear systems of conics in projective planes dates back at least to Jordan, who classified pencils (one-dimensional systems) of conics over $${\mathbb {C}}$$ C and $$\mathbb {R}$$ R in 1906–1907. The analogous problem for finite fields $$\mathbb {F}_q$$ F q with q odd was solved by Dickson in 1908. In 1914, Wilson attempted to classify nets (two-dimensional systems) of conics over finite fields of odd characteristic, but his classification was incomplete and contained some inaccuracies. In a recent article, we completed Wilson’s classification (for q odd) of nets of rank one, namely those containing a repeated line. The aim of the present paper is to introduce and calculate certain combinatorial invariants of these nets, which we expect will be of use in various applications. Our approach is geometric in the sense that we view a net of rank one as a plane in $$\mathrm {PG}(5,q)$$ PG ( 5 , q ) , q odd, that meets the quadric Veronesean in at least one point; two such nets are then equivalent if and only if the corresponding planes belong to the same orbit under the induced action of $$\mathrm {PGL}(3,q)$$ PGL ( 3 , q ) viewed as a subgroup of $$\mathrm {PGL}(6,q)$$ PGL ( 6 , q ) . Since q is odd, the orbits of lines in $$\mathrm {PG}(5,q)$$ PG ( 5 , q ) under this action correspond to the aforementioned pencils of conics in $$\mathrm {PG}(2,q)$$ PG ( 2 , q ) . The main contribution of this paper is to determine the line-orbit distribution of a plane $$\pi $$ π corresponding to a net of rank one, namely, the number of lines in $$\pi $$ π belonging to each line orbit. It turns out that this list of invariants completely determines the orbit of $$\pi $$ π , and we will use this fact in forthcoming work to develop an efficient algorithm for calculating the orbit of a given net of rank one. As a more immediate application, we also determine the stabilisers of nets of rank one in $$\mathrm {PGL}(3,q)$$ PGL ( 3 , q ) , and hence the orbit sizes.

Xiao, Zeng, Li and Helleseth proposed new generalized cyclotomic binary sequences $$s^{\infty }$$ of period $$p^m$$ and showed that these sequences are almost balanced and have very large linear complexity if p is a non-Wieferich prime and $$m=2$$ . Wu, Xu, Chen and Ke determined the values of the k-error linear complexity for $$m=2$$ in terms of the theory of Fermat quotients and the results indicated that sequences $$s^{\infty }$$ have good stability. Edemskiy, Li, Zeng and Helleseth studied the linear complexity of $$s^{\infty }$$ for general integers $$m\ge 2$$ . Furthermore, Ouyang and Xie constructed new $$2p^{m}$$ -periodic binary sequences $${\widehat{s}}^{\infty }$$ and $${\widetilde{s}}^{\infty }$$ and proved that the sequences $${\widehat{s}}^{\infty }$$ and $${\widetilde{s}}^{\infty }$$ are of high linear complexity when $$m\ge 2$$ . In this paper we shall show that despite a high linear complexity the sequences $$s^{\infty }$$ , $${\widehat{s}}^{\infty }$$ and $${\widetilde{s}}^{\infty }$$ have some undesirable features which may not suggest them for cryptography. The properties of multiplicative character sums modulo $$p^m$$ play an important role in the proof of this paper.

This paper investigates the construction of $${\text {MDS}}$$ matrices with generalized Feistel structures ( $${\text {GFS}}$$ ). The approach developed by this paper consists in deriving $${\text {MDS}}$$ matrices from the product of several sparser matrices. This can be seen as a generalization to several matrices of the recursive construction which derives $${\text {MDS}}$$ matrices as the powers of a single companion matrix. In other words, the idea of this paper is to explore a space of matrices with a $${\text {GFS}}$$ structure, and then to search for instantiations of the binary linear functions so that the resulting matrix is both $${\text {MDS}}$$ and efficient to implement with respect to the number of $${\text {XOR}}$$ gates and the depth of the circuit. In this direction we first give some theoretical results on the iteration of $${\text {GFS}}$$ . We then using $${\text {GFS}}$$ with minimal diffusion rounds, propose some types of sparse matrices that are called extended primitive $${\text {GFS}}$$ ( $${\text {EGFS}}$$ ) matrices. Next, by applying binary linear functions to several round of $${\text {EGFS}}$$ matrices, we introduce lightweight $$4\times 4$$ , $$6\times 6$$ and $$8\times 8$$ $${\text {MDS}}$$ matrices that are implemented with 67, 156 and 260 $${\text {XOR}}$$ over 8-bit input, respectively. The results match the best known lightweight $$4\times 4$$ $${\text {MDS}}$$ matrix and improve the best known $$6\times 6$$ and $$8\times 8$$ $${\text {MDS}}$$ matrices. Moreover, we propose $$8\times 8$$ Near- $${\text {MDS}}$$ matrices such that the implementation cost of the proposed matrices are 108 and 204 $${\text {XOR}}$$ over 4-bit and 8-bit inputs, respectively. On the whole, the construction presented in this paper is relatively general and can be applied for other matrix dimensions and finite fields as well.

For differential cryptanalysis under the single-key model, the key schedules hardly need to be exploited in constructing the characteristics, which is based on the hypothesis of stochastic equivalence. In this paper, we study a profound effect of the key schedules on the validity of the differential characteristics. Noticing the sensitivity in the probability of the characteristics to specific keys, we label the keys where a characteristic has nonzero probability by effective keys. We propose the concept of singular characteristics which are characteristics with no effective keys, and exploit an algorithm to sieve them out by studying the key schedule. We show by a differential characteristic of PRINCE whose expected differential probability is much larger than that of a random permutation, i.e., $$2^{-35}$$ vs. $$2^{-64}$$ . Yet, it is indeed singular which could be mis-used to mount a differential attack. Singular characteristics are found for 3-round AES and 3-round Midori-128 as well. Furthermore, taking the possible mismatches of the effective keys in a number of differential characteristics into consideration, we present singular clusters which indicates an empty intersection of the corresponding effective keys, and this is evidenced by showing two differential characteristics of the 2-round AES. We also show that characteristics are tightly linked to the key schedule, as shown in the paper, a valid characteristic in the AES-128 can be singular for the AES-192. Our results indicate a gap over the perspectives of the designers and the attackers, which warns the latter to validate the theoretically-built distinguishers. Therefore, a closer look into the characteristics is inevitable before any attack is claimed.

For any positive integers $$n=2k$$ and m such that $$m\ge k,$$ in this paper we show that the maximal number of bent components of any (n, m)-function is equal to $$2^{m}-2^{m-k},$$ and for those attaining the equality, their algebraic degree is at most k. It is easily seen that all (n, m)-functions of the form $$G(x)=(F(x),0),$$ with F(x) being any vectorial bent (n, k)-function, have the maximal number of bent components. Those simple functions G are called trivial in this paper. We show that for a power (n, n)-function, it has the maximal number of bent components if and only if it is trivial. We also consider the (n, n)-function of the form $$F(x)=xh(\mathrm{Tr}^{n}_{e}(x)),$$ where $$h: \mathbb {F}_{2^{e}} \rightarrow \mathbb {F}_{2^{e}},$$ and show that F has the maximal number of bent components if and only if $$e=k,$$ and h is a permutation over $$\mathbb {F}_{2^{e}}.$$ It essentially shows that all previously known nontrivial functions with maximal number of bent components are subclasses of the class described by F. Based on the Maiorana–McFarland class, we present constructions of large numbers of (n, m)-functions with maximal number of bent components for any integer m in bivariate representation. We also determine the differential spectra and Walsh spectra of the constructed functions. It turns out that our constructions can also provide new plateaued vectorial functions.

Many cryptographic protocols which are based on elliptic curves require to efficiently encode bit-strings into the points of a given elliptic curve such that the encoding function satisfies computability, regularity, and samplability, or generally admissibility. All the admissible encoding functions from the finite field $$\mathbb {F}_q$$ are restricted to the class of elliptic curves with a non-trivial l-torsion $$\mathbb {F}_q$$ -rational point, where $$l\in \{2,3\}$$ . Therefore, there is no admissible encoding function to the class of many cryptographically interesting elliptic curves of prime order. In this paper, we present an admissible 2:1 encoding function from the set $$\{0,1,\ldots , \frac{q-1}{2}\}$$ to the $$\mathbb {F}_q$$ -rational points of arbitrary elliptic curves. We also propose an injective encoding function to elliptic curves with a non-trivial $$\mathbb {F}_q$$ -rational point of order two, that acts the same as the Bernstein et al.’s injective encoding function. Conversely, occasionally we have to transmit points of a known curve through an insecure channel. Traditional methods for transferring points enable an adversary to recognize patterns in the transmitted data. Consequently, one finds valuable information to attack the cryptosystem using the network traffic. By the help of the inverse of the injective encoding functions, Bernstein et al. introduced an interesting solution to this problem, namely Elligator. In this paper, we present an indistinguishable elliptic curve point representation using our given encoding function, which unlike the previous well-known encoding functions is not injective but covers almost all of elliptic curves over odd characteristic finite fields. Indeed, since we proposed a 2:1 encoding function to elliptic curves in short Weierstrass form, we have to select one pre-image randomly and transmit its corresponding bit-string instead of the point.

In this paper, we produce new classes of MDS self-dual codes via (extended) generalized Reed-Solomon codes over finite fields of odd characteristic. Among our constructions, there are many MDS self-dual codes with new parameters which have never been reported. For odd prime power $q$ with $q$ square, the total number of lengths for MDS self-dual codes over $\mathbb{F}_q$ presented in this paper is much more than those in all the previous results.

In 2014, Tamo and Barg have presented in a very remarkable paper a family of optimal linear locally recoverable codes (LRC codes) that attain the maximum possible distance (given code length, cardinality, and locality). The key ingredients for constructing such optimal linear LRC codes are the so-called r-good polynomials, where r is equal to the locality of the LRC code. In 2018, Liu et al. presented two general methods of designing r-good polynomials by using function composition, which led to three new constructions of r-good polynomials. Next, Micheli provided a Galois theoretical framework which allows to construct r-good polynomials. The well-known Dickson polynomials form an important class of polynomials which have been extensively investigated in recent years in different contexts. In this paper, we provide new methods of designing r-good polynomials based on Dickson polynomials. Such r-good polynomials provide new constructions of optimal LRC codes.

Coding theory and t-designs have close connections and interesting interplay. In this paper, we first introduce a class of ternary linear codes and study their parameters. We then focus on their three-weight subcodes with a special weight distribution. We determine the weight distributions of some shortened codes and punctured codes of these three-weight subcodes. These shortened and punctured codes contain some codes that have the same parameters as the best ternary linear codes known in the database maintained by Markus Grassl at http://www.codetables.de/ . These three-weight subcodes with a special weight distribution do not satisfy the conditions of the Assmus–Mattson theorem and do not admit 2-transitive or 2-homogeneous automorphism groups in general. By employing the theory of projective geometries and projective generalized Reed–Muller codes, we prove that they still hold 2-designs. We also determine the parameters of these 2-designs. This paper mainly confirms some recent conjectures of Ding and Li regarding Steiner systems and 2-designs from a special type of ternary projective codes.

Impossible differential and zero correlation linear cryptanalysis are two important cryptanalytic methods. In this paper, we study the security of some Feistel structures against these two cryptanalytic methods. Throughout this paper, we consider the impossible differential and zero correlation linear hull that are independent of the choices of the non-linear parts. Based on that, a method is introduced to estimate the number of rounds that the longest impossible differential could cover for one kind of Feistel-SP structure. Fortunately, our method also applies to some generalized Feistel structures, such as the Type-2 generalized Feistel structure. Then we project our results to zero correlation by the links between impossible differential and zero correlation linear hull. Lastly, as an application of our method, we prove that there do not exist 15-round impossible differential and zero correlation linear hull for LBlock and TWINE.

In a recent paper by the first author in this journal it was pointed out that the literature on zero-difference balanced functions is often repetitive and of little value. Indeed it was shown that some papers published in the last decade on this topic reproduced in a very convoluted way simple results on difference families which were known since the 90s or even earlier. In spite of this fact, unfortunately, a new paper of the same kind has recently appeared in this journal. Its main result was indeed already obtained by Furino in 1991 and here it will be shown that it is only a very special case of a much more general result by the first author. We take this opportunity to make a comparison between the equivalent notions of a partitioned difference family (PDF) and a zero-difference balanced function (ZDBF), explaining the reasons for which we prefer to adopt the terminology and notation of PDFs. Finally, “playing” with some known results on difference families, we produce a plethora of disjoint difference families with new parameters. Each of them can be viewed as a PDF with many blocks of size 1; therefore, even though the ZDBF community do not appear concerned about this, they are not so relevant from the design theory perspective. The main goal of this note is to explain the relationships between ZDBFs and the prior research, giving an example of how seemingly novel ZBDF results can be readily obtained from well known results on difference families.

An equiangular tight frame (ETF) is a type of optimal packing of lines in a real or complex Hilbert space. In the complex case, the existence of an ETF of a given size remains an open problem in many cases. In this paper, we observe that many of the known constructions of ETFs are of one of two types. We further provide a new method for combining a given ETF of one of these two types with an appropriate group divisible design (GDD) in order to produce a larger ETF of the same type. By applying this method to known families of ETFs and GDDs, we obtain several new infinite families of ETFs. The real instances of these ETFs correspond to several new infinite families of strongly regular graphs. Our approach was inspired by a seminal paper of Davis and Jedwab which both unified and generalized McFarland and Spence difference sets. We provide combinatorial analogs of their algebraic results, unifying Steiner ETFs with hyperoval ETFs and Tremain ETFs.

Little theoretical work has been done on (n, m)-functions when $$\frac{n}{2}\frac{n}{2}$$ . In this paper, we first characterize the differential uniformity of those (n, m)-functions of the form $$F(x,z)=\phi (z)I(x)$$ , where I(x) is the (m, m)-inverse function and $$\phi (z)$$ is an $$(n-m,m)$$ -function. Using this characterization, we construct an infinite family of differentially $$\Delta $$ -uniform $$(2m-1,m)$$ -functions with $$m\ge 3$$ achieving Nyberg’s bound with equality, which also have high nonlinearity and not too low algebraic degree. We then discuss an infinite family of differentially 4-uniform $$(m+1,m)$$ -functions in this form, which leads to many differentially 4-uniform permutations. We also present a method to construct infinite families of $$(m+k,m)$$ -functions with low differential uniformity and construct an infinite family of $$(2m-2,m)$$ -functions with $$\Delta \le 2^{m-1}-2^{m-6}+2$$ for any $$m\ge 8$$ . The constructed functions in this paper may provide more choices for the design of Feistel ciphers.

Linear codes, the most significant class of codes in coding theory, have diverse applications in secret sharing schemes, authentication codes, communication, data storage devices and consumer electronics. The main objectives of this paper are twofold: to construct three-weight linear codes from plateaued functions over finite fields, and to analyze the constructed linear codes for secret sharing schemes. To do this, we generalize the recent contribution of Mesnager given in (Cryptogr Commun 9(1):71–84, 2017). We first introduce the notion of (non)-weakly regular plateaued functions over $${{\mathbb {F}}}_p$$ , with p being an odd prime. We next construct three-weight linear p-ary (resp. binary) codes from weakly regular p-ary plateaued (resp. Boolean plateaued) functions and determine their weight distributions. We finally observe that the constructed linear codes are minimal for almost all cases, which implies that they can be directly used to construct secret sharing schemes with nice access structures. To the best of our knowledge, the construction of linear codes from plateaued functions over $${{\mathbb {F}}}_p$$ , with p being an odd prime, is studied in this paper for the first time in the literature.

In this paper, we summarize the results obtained recently in three papers on differentially uniform functions in characteristic 2, and presented at the workshop WCC 2017 in Saint-Petersburg, and we give new results on these functions. Firstly, we recall the recent connection between almost perfect nonlinear (APN) power functions and the two notions in additive combinatorics of Sidon sets and sum-free sets; we also recall a characterization of APN exponents which leads to a property of Dickson polynomials in characteristic 2 previously unobserved, which is generalizable to all finite fields. We also give a new characterization of APN exponents in odd dimension by Singer sets. Secondly, after recalling the recent multiple generalization to differentially $$\delta $$ -uniform functions of the Chabaud–Vaudenay characterization of APN functions by their Walsh transforms, we generalize the method to all criteria on vectorial functions dealing with the numbers of solutions of equations of the form $$\sum _{i\in I}F(x+u_{i,a})+L_a(x)+u_a=0$$ , with $$L_a$$ linear; we give the examples of injective functions and of o-polynomials; we also deduce a generalization to differentially $$\delta $$ -uniform functions of the Nyberg characterization of APN functions by means of the Walsh transforms of their derivatives. Thirdly, we recall the two notions of componentwise APNness (CAPNness) and componentwise Walsh uniformity (CWU). We recall why CAPN functions can exist only if n is odd and why crooked functions (in particular, quadratic APN functions) are CWU. We also recall that the inverse of one of the Gold permutations is CWU and not the others. Another potential class of CWU functions is that of Kasami functions. We consider the difference sets with Singer parameters equal to the complement of $$\varDelta _F=\{F(x)+F(x+1)+1; x\in \mathbb {F}_{2^n}\}$$ where F is a Kasami function. These sets have another potential property, called the cyclic-additive difference set property, which is related to the CWU property in the case of power permutations (n odd). We study cyclic-additive difference sets among Singer sets. We recall the main properties of Kasami functions and of the related set $$\varDelta _F$$ shown by Dillon and Dobbertin and we observe and prove new expressions for $$\varDelta _F$$ .

Linear codes are an important class of error-correcting codes and widely used in secret sharing schemes, combinational designs, authentication codes and so on. The objective of this paper is to construct q-ary linear codes with good parameters from irreducible cyclic codes. Several classes of linear codes with a few weights including infinite families of distance-optimal ones are derived. The nonzero codewords of some of the codes in this paper have minimal support for inclusion and such codes can be used to construct secret sharing schemes with interesting access structures.

MORUS is an authenticated cipher submitted to the ongoing CAESAR competition and becomes one of 15 candidates entering the third round. This paper studies the bit-based division property and differential trails of MORUS-640/1280 with Mixed Integer Linear Programming (MILP) tool. The key-recovery attacks are executed against at most 5.5/6.5-step MORUS-640/1280 with the new concept of cube attacks based on the division property proposed by Todo et al. Meanwhile, we take the MILP model of bitwise AND operation with a constant introduced by Sun et al. into consideration, which makes the division trails and the subsequent integral distinguishers more accurate. And we also obtain 6/6.5-step integral distinguishers for MORUS-640/1280 and 4.5-step differential distinguishers of MORUS-1280. Compared to previous work, the cryptanalysis in this paper is the best result in terms of the number of attacked steps and required complexity.

Secure multi-party computation (MPC) enables multiple players to cooperatively evaluate various functions in the presence of adversaries. In this paper, we consider non-interactive MPC (NIMPC) against honest-but-curious adversaries in the information-theoretic setting, which was introduced by Beimel et al. at CRYPTO 2014. Their main focus is to realize stronger security while completely avoiding interaction, and succeeded to show that every function admits a fully robust NIMPC protocol. In this paper, we further develop the study of NIMPC. We first present a simple lower bound on the communication complexity derived from the correctness requirement of NIMPC. Secondly, we present an efficient NIMPC protocol for indicator functions, which is an important building block of NIMPC protocols. An NIMPC protocol for arbitrary functions is also constructed from the proposed NIMPC for indicator functions by using the generic compiler introduced by Beimel et al. in CRYPTO 2014. The communication complexities of NIMPC protocols presented in this paper are much more efficient than the previous ones. In fact, the gap between the lower and upper bounds of the communication complexity is reduced from exponential in the input length to quadratic. Finally, we show some improvements on the efficiency in the so-called offline-online model. Specifically, for some sets of functions, the exponential amount of offline communication reduces the online communication to almost optimum amount in the standard model.

Linear codes with a few weights have applications in data storage systems, secret sharing schemes, and authentication codes. Recently, Ding (IEEE Trans. Inf. Theory 61(6):3265–3275, 2015) proposed a class of ternary linear codes with three weights from a family of cyclic difference sets in $$({\mathbb {F}}_{3^m}^*/{\mathbb {F}}_{3}^*,\times )$$ , where $$m=3k$$ and k is odd. One objective of this paper is to construct ternary linear codes with three weights from cyclic difference sets in $$({\mathbb {F}}_{3^m}^*/{\mathbb {F}}_{3}^*,\times )$$ derived from the Helleseth–Gong functions. This construction works for any positive integer $$m=sk$$ with an odd factor $$s\ge 3$$ , and thus leads to three-weight ternary linear codes with more flexible parameters than earlier ones mentioned above. Another objective of this paper is to determine the weight distribution of the proposed linear codes.

In the paper of Kyureghyan and Pott (Des Codes Cryptogr 29:149–164, 2003), the linear feedback polynomials of the Sidelnikov–Lempel–Cohn–Eastman sequences were determined for some special cases. We found that Corollary 4 and Theorem 2 of that paper are wrong because there exist counterexamples for these two results. In this note, we give some counterexamples of Corollary 4 and Theorem 2, and correct them by readopting the negation of the condition of Lemma 5 as their necessary and sufficient conditions.

Cyclic codes are an interesting type of linear codes and have wide applications in communication and storage systems due to their efficient encoding and decoding algorithms. It was proved that asymptotically good Hermitian LCD codes exist. The objective of this paper is to construct some cyclic Hermitian LCD codes over finite fields and analyse their parameters. The dimensions of these codes are settled and the lower bounds on their minimum distances are presented. Most Hermitian LCD codes presented in this paper are not BCH codes.

This paper evaluates the security level of the River Keyak against the cube-like attack. River Keyak is the only lightweight scheme of the Keccak-permutation-based authenticated encryption cipher Keyak, which is one of the 16 survivors of the third round CAESAR competition. Dinur et al. gave the seven-round cube-like attack on Lake Keyak (1600-bit) using the divide-and-conquer method at EUROCRYPT 2015, then Huang et al. improved the result to eight-round using a new conditional cube attack at EUROCRYPT 2017. While for River Keyak, the 800-bit state is so small that the equivalent key (256-bit capacity) occupy double lanes, the attacks can not be applied to the River Keyak trivially. In this paper, we comprehensively explore the conditional cube attack on the small state (800-bit) River Keyak. Firstly, we find a new conditional cube variable which has a much weaker diffusion than Huang et al.’s, this makes the conditional cube attack possible for small state (800-bit) River Keyak. Then we find enough cube variables for six/seven-round River Keyak and successfully launch the key recovery attacks on six/seven-round River Keyak with the time complexity $$2^{33}$$ and $$2^{49},$$ respectively. We also verify the six and seven-round attack on a laptop. Finally, by using linear structure technique with our new conditional cube variable, we greatly increase the freedom degree to find more cube variables for conditional cube attacks as it is complex for 800-bit state to find enough cube variables for eight-round attack. And then we use the new variables by this new method to launch eight-round conditional cube attack with the time complexity $$2^{81}.$$ These are the first cryptanalysis results on round-reduced River Keyak. Our attacks do not threaten the full-round (12) River Keyak.

A cyclic $$(n,d,w)_q$$ code is a cyclic q-ary code of length n, constant-weight w and minimum distance d. A cyclic $$(n,d,w)_q$$ code with the largest possible number of codewords is said to be optimal. Optimal nonbinary cyclic $$(n,d,w)_q$$ codes were first studied in our recent paper (Lan et al. in IEEE Trans Inf Theory 62(11):6328–6341, 2016). In this paper, we continue to discuss the constructions of optimal cyclic $$(n,4,3)_q$$ codes. We establish the connection between cyclic $$(n,4,3)_{q}$$ codes and $$q-1$$ mutually orbit-disjoint cyclic (n, 3, 1) difference packings (briefly (n, 3, 1)-CDPs). For the case of $$q=4$$ , we construct three mutually orbit-disjoint (n, 3, 1)-CDPs by constructing a pair of strongly orbit-disjoint (n, 3, 1)-CDPs, which are obtained from Skolem-type sequences. As a consequence, we completely determine the number of codewords of an optimal cyclic $$(n,4,3)_{4}$$ code.

It has been known for a long time that t-designs can be employed to construct both linear and nonlinear codes and that the codewords of a fixed weight in a code may hold a t-design. While a lot of progress in the direction of constructing codes from t-designs has been made, only a small amount of work on the construction of t-designs from codes has been done. The objective of this paper is to construct infinite families of 2-designs and 3-designs from a type of binary linear codes with five weights. The total number of 2-designs and 3-designs obtained in this paper are exponential in any odd m and the block size of the designs varies in a huge range.

Subspace codes have been intensely studied in the last decade due to their application in random network coding. In particular, cyclic subspace codes are very useful subspace codes with their efficient encoding and decoding algorithms. In a recent paper, Ben-Sasson et al. gave a systematic construction of subspace codes using subspace polynomials. In this paper, we mainly generalize and improve their result so that we can obtain larger codes for fixed parameters and also we can increase the density of some possible parameters. In addition, we give some relative remarks and explicit examples.

Nowadays sparse systems of equations occur frequently in science and engineering. In this contribution we deal with sparse systems common in cryptanalysis. Given a cipher system, one converts it into a system of sparse equations, and then the system is solved to retrieve either a key or a plaintext. Raddum and Semaev proposed new methods for solving such sparse systems common in modern ciphers which are combinations of linear layers and small S-boxes. It turns out that the solution of a combinatorial MaxMinMax problem provides an upper bound on the average computational complexity of those methods. In this paper we initiate the study of a linear algebra variation of the MaxMinMax problem. The complexity bound proved in this paper significantly overcomes conjectured complexity bounds for Grobner basis type algorithms.

It has become common knowledge that constructing q-ary quantum MDS codes with minimum distance bigger than \(q/2+1\) is significantly more difficult than constructing those with minimum distance less than or equal to \(q/2+1\). Despite of various constructions of q-ary quantum MDS codes, all known q-ary quantum MDS codes have minimum distance bounded by \(q/2+1\) except for some lengths. The purpose of the current paper is to provide some new q-ary quantum MDS codes with minimum distance bigger than \(q/2+1\). In this paper, we provide several classes of quantum MDS codes with minimum distance bigger than \(q/2+1\). For instance, some examples in these classes include q-ary \([n,n-2k, k+1]\)-quantum MDS codes for cases: (i) \(q\equiv -1\bmod {5}, n=(q^2+4)/5\) and \(1\le k\le (3q-2)/5\); (ii) \(q\equiv -1\bmod {7}, n=(q^2+6)/7\) and \(1\le k\le (4q-3)/7\); (iii) \(2|q, q\equiv -1\bmod {3}, n=2(q^2-1)/3\) and \(1\le k\le (2q-1)/3\); and (iv) \(2|q, q\equiv -1\bmod {5}, n=2(q^2-1)/5\) and \(1\le k\le (3q-2)/5\).

The power of a statistical attack is inversely proportional to the number of plaintexts needed to recover information on the encryption key. By analyzing the distribution of the random variables involved in the attack, cryptographers aim to provide a good estimate of the data complexity of the attack. In this paper, we analyze the hypotheses made in simple, multiple, and multidimensional linear attacks that use either non-zero or zero correlations, and provide more accurate estimates of the data complexity of these attacks. This is achieved by taking, for the first time, into consideration the key variance of the statistic for both the right and wrong keys. For the family of linear attacks considered in this paper, we differentiate between the attacks which are performed in the known-plaintext and those in the distinct-known-plaintext model.

MDS matrices allow to build optimal linear diffusion layers in the design of block ciphers and hash functions. There has been a lot of study in designing efficient MDS matrices suitable for software and/or hardware implementations. In particular recursive MDS matrices are considered for resource constrained environments. Such matrices can be expressed as a power of simple companion matrices, i.e., an MDS matrix $$M = C_g^k$$M=Cgk for some companion matrix corresponding to a monic polynomial $$g(X) \in \mathbb {F}_q[X]$$g(X)źFq[X] of degree k. In this paper, we first show that for a monic polynomial g(X) of degree $$k\ge 2$$kź2, the matrix $$M = C_g^k$$M=Cgk is MDS if and only if g(X) has no nonzero multiple of degree $$\le 2k-1$$≤2k-1 and weight $$\le k$$≤k. This characterization answers the issues raised by Augot et al. in FSE-2014 paper to some extent. We then revisit the algorithm given by Augot et al. to find all recursive MDS matrices that can be obtained from a class of BCH codes (which are also MDS) and propose an improved algorithm. We identify exactly what candidates in this class of BCH codes yield recursive MDS matrices. So the computation can be confined to only those potential candidate polynomials, and thus greatly reducing the complexity. As a consequence we are able to provide formulae for the number of such recursive MDS matrices, whereas in FSE-2014 paper, the same numbers are provided by exhaustively searching for some small parameter choices. We also present a few ideas making the search faster for finding efficient recursive MDS matrices in this class. Using our approach, it is possible to exhaustively search this class for larger parameter choices which was not possible earlier. We also present our search results for the case $$k=8$$k=8 and $$q=2^{16}$$q=216.

Let q be a prime power and let $${\mathbb {F}}_q$$Fq be a finite field with q elements. This paper discusses the explicit factorizations of cyclotomic polynomials over $$\mathbb {F}_q$$Fq. Previously, it has been shown that to obtain the factorizations of the $$2^{n}r$$2nrth cyclotomic polynomials, one only need to solve the factorizations of a finite number of cyclotomic polynomials. This paper shows that with an additional condition that $$q\equiv 1 \pmod p$$qź1(modp), the result can be generalized to the $$p^{n}r$$pnrth cyclotomic polynomials, where p is an arbitrary odd prime. Applying this result we discuss the factorization of cyclotomic polynomials over finite fields. As examples we give the explicit factorizations of the $$3^{n}$$3nth, $$3^{n}5$$3n5th and $$3^{n}7$$3n7th cyclotomic polynomials.

Let $$\mathbb {F}_{q}$$Fq be the finite field with $$q=p^{m}$$q=pm elements, where p is an odd prime and m is a positive integer. For a positive integer t, let $$D\subset \mathbb {F}^{t}_{q}$$DźFqt and let $${\mathrm {Tr}}_{m}$$Trm be the trace function from $$\mathbb {F}_{q}$$Fq onto $$\mathbb {F}_{p}$$Fp. In this paper, let $$D=\{(x_{1},x_{2},\ldots ,x_{t}) \in \mathbb {F}_{q}^{t}\setminus \{(0,0,\ldots ,0)\} : {\mathrm {Tr}}_{m}(x_{1}+x_{2}+\cdots +x_{t})=0\},$$D={(x1,x2,ź,xt)źFqt\{(0,0,ź,0)}:Trm(x1+x2+ź+xt)=0}, we define a p-ary linear code $$\mathcal {C}_{D}$$CD by $$\begin{aligned} \mathcal {C}_{D}=\{\mathbf {c}(a_{1},a_{2},\ldots ,a_{t}) : (a_{1},a_{2},\ldots ,a_{t})\in \mathbb {F}^{t}_{q}\}, \end{aligned}$$CD={c(a1,a2,ź,at):(a1,a2,ź,at)źFqt},where $$\begin{aligned} \mathbf {c}(a_{1},a_{2},\ldots ,a_{t})=({\mathrm {Tr}}_{m}(a_{1}x^{2}_{1}+a_{2}x^{2}_{2}+\cdots +a_{t}x^{2}_{t}))_{(x_{1},x_{2},\ldots ,x_{t}) \in D}. \end{aligned}$$c(a1,a2,ź,at)=(Trm(a1x12+a2x22+ź+atxt2))(x1,x2,ź,xt)źD.We shall present the complete weight enumerators of the linear codes $$\mathcal {C}_{D}$$CD and give several classes of linear codes with a few weights. This paper generalizes the results of Yang and Yao (Des Codes Cryptogr, 2016).

This paper is concerned with constructions and orthogonality of generalized Sudoku arrays of various forms. We characterize these arrays based on their constraints; for example Sudoku squares are characterized by having strip and sub-square constraints. First, we generalize Sudoku squares to be multi-dimensional arrays with strip and sub-cube constraints and construct mutually orthogonal sets of these arrays using linear polynomials. We add additional constraints motivated by elementary intervals for low discrepancy sequences and again give a construction of these arrays using linear polynomials in detail for 3 dimensional and a general construction method for arbitrary dimension. Then we give a different construction of these hypercubes due to MDS codes. We also analyze the orthogonality of all of the Sudoku-like hypercubes we consider in this paper.

In this paper we give an explicit construction of basis matrices for a (k, n)-visual cryptography scheme \((k,n){\hbox {-}}\mathrm{VCS}\) for integers k and n with \(2\le k \le n\). In balanced VCS every set of participants with equal cardinality has same relative contrast. The VCS constructed in this paper is a balanced \((k,n){\hbox {-}}\mathrm{VCS}\) for general k. Also we obtain a formula for pixel expansion and relative contrast. We also prove that our construction gives optimal contrast and minimum pixel expansion when \(k=n\) and \(n-1\).

The maximum diffusion round, DRmax is a traditional diffusion criterion for block cipher in the secret-key setting. In recent years, the study of the security of block ciphers in hash function setting or known-key setting has attracted great interest. In this paper, we revisit the security of the hash function based on block cipher by using the sliced-biclique technique. The number of rounds attacked HashR is regarded as a new diffusion criterion for the underlying block cipher in the known-key setting. Intuitively, DRmax is a criterion with only one base and HashR is a criterion with two bases. Besides, we design an automated cryptanalysis tool to compute the value of HashR efficiently. Furthermore, we evaluate the new diffusion property of the improved GFS and EGFN and obtain some interesting results. Firstly, the HashR for the improved GFS structure with a permutation is equal to that for the structure with its inverse permutation. Secondly, we find that several optimum diffusion matrices with the same DRmax have different HashR values. As a result, the numbers of optimum diffusion shuffles for improved GFS with $$k\le 16$$k≤16 are largely reduced referring to the values of HashR. Meanwhile, we illustrate that the shuffle used in the example of EGFN ($$k=8$$k=8) shown in its original published paper is not optimal according to the new criterion HashR. The results give some new suggestions for designers when using the improved GFS or EFGN. All in all, the new criterion may guide the design of the block cipher.

The performances of three major time memory tradeoff algorithms were compared in a recent paper. The algorithms considered there were the classical Hellman tradeoff and the non-perfect table versions of the distinguished point method and the rainbow table method. This paper adds the perfect table versions of the distinguished point method and the rainbow table method to the list, so that all the major tradeoff algorithms may now be compared against each other. Even though there are existing claims as to the superiority of one tradeoff algorithm over another algorithm, the algorithm performance comparisons provided by the current work and the recent paper mentioned above are of higher practical value. We provide comparisons of algorithms at parameters that achieve a common success rate of inversion and which take both the cost of pre-computation and the efficiency of the online phase into account. The comparisons are based on the average case execution behaviors rather than the worst case situations, and non-negligible details such as the effects of false alarms and various storage optimization techniques are no longer ignored. A large portion of this paper is allocated to analyzing the execution behavior of the perfect table distinguished point method. In particular, we obtain a closed-form formula for the average length of chains associated with a perfect distinguished point table.

We present a general purpose algorithm for finding low-weight codewords as well as for decoding a received codeword in any quasi-cyclic code whose length and dimension is a multiple of a power of 2. In this paper, we apply the algorithm on a McEliece variant recently proposed by Misoczki et al. (MDPC-McEliece: New McEliece variants from moderate density parity-check codes, 2013). In their paper, the authors present instances of LDPC codes with increased weight for use in a McEliece type PKC. They claim that all message-recovery and key-recovery attacks can be avoided. We show that this is not true for certain parameters and public-key matrices.

In this paper we put forward an efficient construction, based on linear algebraic technique, of a $$t$$t-$$(k,n)^*$$(k,n)ź-visual cryptographic scheme (VCS) for monochrome images in which $$t$$t participants are essential in a $$(k,n)$$(k,n)-VCS. The scheme is efficient in the sense that it only requires solving a system of linear equations to construct the required initial basis matrices. To make the scheme more efficient, we apply the technique of deletion of common columns from the initial basis matrices to obtain the reduced basis matrices. However finding exact number of common columns in the initial basis matrices is a challenging problem. In this paper we deal with this problem. We first provide a construction and analysis of $$t$$t-$$(k,n)^*$$(k,n)ź-VCS. We completely characterize the case of $$t$$t-$$(n-1,n)^*$$(n-1,n)ź-VCS, $$0 \le t \le n-1$$0≤t≤n-1, by finding a closed form of the exact number of common columns in the initial basis matrices and thereby deleting the common columns to get the exact value of the reduced pixel expansion and relative contrast of the efficient and simple scheme. Our proposed closed form for reduced pixel expansion of $$(n-1,n)$$(n-1,n)-VCS matches with the numerical values of the optimal pixel expansions for every possible values of $$n$$n that exist in the literature. We further deal with the $$(n-2,n)$$(n-2,n)-VCS and resolve an open issue by providing an efficient algorithm for grouping the system of linear equations and thereby show that our proposed algorithm works better than the existing scheme based on the linear algebraic technique. Finally we provide a bound for reduced pixel expansion for $$(n-2,n)$$(n-2,n)-VCS and numerical evidence shows it achieves almost optimal pixel expansion.

In this paper, we review a new method for the universal design of a check digit system over an abelian group of arbitrary order. Furthermore, we challenge the current standards by comparing this system with several well-known and widely used systems such as ISBN, MEID, ISAN and the system over alphanumeric characters. We show that this novel design outperforms all of them in terms of the error detection capability with a comparable computational complexity. In particular, besides the well-known five types of errors to be detected (i.e., single error and four double errors which are adjacent/jump transposition and adjacent/jump twin errors), we address the $$t$$t-jump transpositions and $$t$$t-jump twin errors which generalize the four types of double errors, and aim to design the check digit system with a detection radius as long as possible that depends on $$t$$t and reflects the capability of detecting these two special kinds of double errors. The results of this paper are based on the results of the article by Chen et al. (On some properties of a check digit system, 2012).

The main topics and interconnections arising in this paper are symmetric cryptography (S-boxes), coding theory (linear codes) and finite projective geometry (hyperovals). The paper describes connections between the two main areas of information theory on the one side and finite geometry on the other side. Bent vectorial functions are maximally nonlinear multi-output Boolean functions. They contribute to an optimal resistance to both linear and differential attacks of those symmetric cryptosystems in which they are involved as substitution boxes (S-boxes). We firstly exhibit new connections between bent vectorial functions and the hyperovals of the projective plane, extending the recent link between bent Boolean functions and the hyperovals. Such a link provides several new classes of optimal vectorial bent functions. Secondly, we exhibit surprisingly a connection between the hyperovals of the projective plane in even characteristic and $$q$$q-ary simplex codes. To this end, we present a general construction of classes of linear codes from o-polynomials and study their weight distribution proving that all of them are constant weight codes. We show that the hyperovals of $$PG_{2}(2^m)$$PG2(2m) from finite projective geometry provide new minimal codes (used in particular in secret sharing schemes, to model the access structures) and give rise to multiples of $$2^r$$2r-ary ($$r$$r being a divisor of $$m$$m) simplex linear codes (whose duals are the perfect $$2^r$$2r-ary Hamming codes) over an extension field $${\mathbb F}_{2^{r}}$$F2r of $${\mathbb F}_{2^{}}$$F2. The following diagram gives an indication of the main topics and interconnections arising in this paper. [Figure not available: see fulltext.]

A Boolean function in $$n$$ n variables is $$2$$ 2 -rotation symmetric if it is invariant under even powers of the cyclic permutation $$\rho (x_1,\ldots ,x_n)=(x_2,\ldots ,x_n,x_1)$$ ? ( x 1 , ? , x n ) = ( x 2 , ? , x n , x 1 ) of the variables, but not under the first power (ordinary rotation symmetry); for brevity, we call such a function a $$2$$ 2 -function. A $$2$$ 2 -function is said to be monomial rotation symmetric (MRS) if it is generated by applying powers of $$\rho ^2$$ ? 2 to a single monomial. This paper develops the theory of cubic MRS $$2$$ 2 -functions in $$2n$$ 2 n variables generated by a monomial $$x_1 x_r x_s$$ x 1 x r x s with $$1 $$ > 2. An exact count of the equivalence classes is given and their number is proved to be very small, in fact $$O(n^{\epsilon })$$ O ( n ∈ ) for any $$\epsilon > 0.$$ ∈ > 0 . It is proved that the sequence of Hamming weights $$\{wt(2 \text {-}(1,r,s)_{2n}):~2n \ge s\}$$ { w t ( 2 - ( 1 , r , s ) 2 n ) : 2 n ? s } satisfies a linear recursion with integer coefficients. A similar result for ordinary cubic MRS functions was proved recently (papers by Bileschi, Cusick and Padgett, and by Brown and Cusick), but this paper uses a new method for the $$2$$ 2 -functions proof. Unlike the ordinary MRS function case, both the orders of the recursions for the $$2$$ 2 -functions and the precise values of the roots of the corresponding recursion polynomials can be given explicitly. Finally, a precise value for the weights of the $$2$$ 2 -functions is proved, using a 2011 formula of Cusick and Padgett. These weights are connected to powers of members of the well known Lucas sequence, and so the weights can be found without computing initial values for the recursions.

A one to one correspondence is given between quadratic homogeneous APN functions and a special kind of matrices which we call as QAM's. By modifying the elements of a known QAM, new quadratic APN functions can be constructed. Based on the nice mathematical structures of the QAM's, an efficient algorithm for constructing quadratic APN functions is proposed. On $$\mathbb {F}_{2^7}$$ F 2 7 , we have found 471 new CCZ-inequivalent quadratic APN functions, which is 20 times more than the number of the previously known ones. Before this paper, It is only found 23 classes of CCZ-inequivalent APN functions on $$\mathbb {F}_{2^8}$$ F 2 8 . With the method of this paper, we have found 2,252 new CCZ-inequivalent quadratic APN functions, and this number is still increasing.

In this paper, two constructions of Boolean functions with optimal algebraic immunity are proposed. They generalize previous ones respectively given by Rizomiliotis (IEEE Trans Inf Theory 56:4014---4024, 2010) and Zeng et al. (IEEE Trans Inf Theory 57:6310---6320, 2011) and some new functions with desired properties are obtained. The functions constructed in this paper can be balanced and have optimal algebraic degree. Further, a new lower bound on the nonlinearity of the proposed functions is established, and as a special case, it gives a new lower bound on the nonlinearity of the Carlet-Feng functions, which is slightly better than the best previously known ones. For $$n\le 19$$n≤19, the numerical results reveal that among the constructed functions in this paper, there always exist some functions with nonlinearity higher than or equal to that of the Carlet-Feng functions. These functions are also checked to have good behavior against fast algebraic attacks at least for small numbers of input variables.

In this paper we solve the problem of decomposing $$( \lambda +m)K_{v+u} {\setminus } \lambda K_v$$ ( ? + m ) K v + u \ ? K v into 4-cycles for all $$m>0$$ m > 0 and $$u \ge 1$$ u ? 1 . This paper extends the results of "Enclosings of $$\lambda $$ ? -fold 4-cycle systems" [Newman and Rodger, Des. Codes Cryptogr. 55:297---310 (2010)].

In this paper, relative two-weight and three-weight codes are studied, which are both called relative constant-weight codes. A geometric approach is introduced to construct and characterize relative constant-weight codes, using the finite projective geometry. A sufficient and necessary condition is derived for linear codes to be relative constant-weight codes, based on the geometric approach. A family of infinite number of relative constant-weight codes are constructed, which includes dual Hamming codes and subcodes of punctured Reed---Muller codes as special instances. It is well known that determining all the minimal codewords is a hard problem for an arbitrary linear code. For relative constant-weight codes, minimal codewords are completely determined in this paper. Based on the above-mentioned results, applications of relative constant-weight codes to wire-tap channel of type II and secret sharing are discussed. A comparative study shows that relative constant-weight codes form a new family. They are not covered by the previously well-known three-weight codes or linear codes for which minimal codewords can be determined.

How to build a secure blockcipher is one of the central problems in symmetric cryptography. While the popular approach, initiated by the seminal paper of Luby and Rackoff, is based on a pseudorandom function, Minematsu (in: Dunkelman (ed.) FSE, 2009) and Minematsu and Iwata (in: Chen (ed.) IMA, 2011) proposed different schemes to efficiently achieve a better security. The point of these works is that they use tweakable blockcipher (TBC) as an internal module rather than pseudorandom function. This paper further extends the previous schemes and considers the case that the target blockcipher has much larger block size than that of the TBC we use. Assuming the tweak of TBC is long, we propose a scheme similar to unbalanced Feistel cipher that achieves stronger security than the previous schemes of Minematsu and Minematsu-Iwata. We also present a blockcipher-based instantiation of our scheme for the encryption over some unusual domains, such as decimal space, as a typical problem of format-preserving encryption.

The paper proposes a type of secret sharing schemes called ramp assignment schemes (RAS's) to realize general access structures (AS's). In such a scheme, each participant is assigned a subset of primitive shares of an optimal $$(k,L,m)$$ ( k , L , m ) -ramp scheme in such a way that the number of primitive shares assigned to each qualified subset is not less than $$k$$ k whereas the one corresponding to any forbidden subset is not greater than $$k-L$$ k - L . RAS's can be viewed as a generalization of multiple assignment schemes (MAS's). For a same AS, the minimum information rate achieved by MAS's can not be less than that achieved by RAS's. With our method, one can find efficient suitable decompositions for general AS's. And it provides a possibility to refine an existing $$(\lambda ,\omega )$$ ( ? , ? ) -decomposition. We show that a RAS with minimal worst or/and average information rate can be obtained by linear programming (LP), which is in the complexity class P and much easier than the NP-hard integer programming (IP) applied to constructing optimal MAS's. Several well-designed algorithms are further presented to cut down the size of the LP/IP problems for optimal RAS's/MAS's. Other contributions of the paper include: (1) the current best upper bounds of information rates of two graph AS's on six participants are improved; (2) some specific AS's are recognized so that one can obtain the corresponding optimal RAS's directly, i.e., even without the need of solving LP problems; and (3) we characterize the AS's of ideal RAS's and of ideal MAS's.