Search

Differential branch number and linear branch number are critical for the security of symmetric ciphers. The recent trend in the designs like PRESENT block cipher, ASCON authenticated encryption shows that applying S-boxes that have nontrivial differential and linear branch number can significantly reduce the number of rounds. As we see in the literature that the class of \(4\times 4\) S-boxes have been well-analysed, however, a little is known about the \(n \times n\) S-boxes for \(n \ge 5\). For instance, the complete classification of \(5 \times 5\) affine equivalent S-boxes is still unknown. Therefore, it is challenging to obtain “the best” S-boxes with dimension \(\ge \)5 that can be used in symmetric cipher designs. In this article, we present a novel approach to construct S-boxes that identifies classes of \(n \times n\) S-boxes (\(n = 5, 6\)) with differential branch number 3 and linear branch number 3, and ensures other cryptographic properties. To the best of our knowledge, we are the first to report \(6\times 6\) S-boxes with linear branch number 3, differential branch number 3, and with other good cryptographic properties such as nonlinearity 24 and differential uniformity 4.

International audience; In this paper, we consider the multi-bit Differential Power Analysis (DPA) in the Hamming weight model. In this regard, we revisit the definition of Transparency Order (TO) from the work of Prouff (FSE 2005) and find that the definition has certain limitations. Although this work has been quite well referred in the literature, surprisingly, these limitations remained unexplored for almost a decade. We analyse the definition from scratch, modify it and finally provide a definition with better insight that can theoretically capture DPA in Hamming weight model for hardware implementation with precharge logic. At the end, we confront the notion of (revised) transparency order with attack simulations in order to study to what extent the low transparency order of an s-box impacts the efficiency of a side channel attack against its processing. To the best of our knowledge, this is the first time that such a critical analysis is conducted (even considering the original notion of Prouff). It practically confirms that the transparency order is indeed related to the resistance of the s-box against side-channel attacks, but it also shows that it is not sufficient alone to directly achieve a satisfying level of security. Regarding this point, our conclusion is that the (revised) transparency order is a valuable criterion to consider when designing a cryptographic algorithm, and even if it does not preclude to also use classical countermeasures like masking or shuffling, it enables to improve their effectiveness.

In this work, we completely characterize (1) permutation binomials of the form $$x^{{{2^n -1}\over {2^t-1}}+1}+ ax \in \mathbb {F}_{2^n}[x], n = 2^st, a \in \mathbb {F}_{2^{2t}}^{*}$$x2n-12t-1+1+axźF2n[x],n=2st,aźF22tź, and (2) permutation trinomials of the form $$x^{2^s+1}+x^{2^{s-1}+1}+\alpha x \in \mathbb {F}_{2^t}[x]$$x2s+1+x2s-1+1+źxźF2t[x], where s, t are positive integers. The first result, which was our primary motivation, is a consequence of the second result. The second result may be of independent interest.

An involution is a permutation, such that its inverse is itself (i.e., cycle length ≤ 2). Due to this property, involutions have been used in many applications, including cryptography and coding theory. In this paper, we provide a systematic study of involutions that are defined over a finite field of characteristic 2. We characterize the involution property of several classes of polynomials and propose several constructions. Furthermore, we study the number of fixed points of involutions, which is a pertinent question related to permutations with short cycle. In this paper, we mostly have used combinatorial techniques.

Nonlinear permutations (S-boxes) are key components in block ciphers. The differential branch number measures the diffusion power of a permutation, whereas the linear branch number measures resistance against linear cryptanalysis. There has not been much analysis done on the differential branch number of nonlinear permutations of \(\mathbb {F}_2^n\), although it has been well studied in case of linear permutations. Similarly upper bounds for the linear branch number have also not been studied in general. In this paper we obtain bounds for both the differential and the linear branch number of permutations (both linear and nonlinear) of \(\mathbb {F}_2^n\). We also prove that in the case of \(\mathbb {F}_2^4\), the maximum differential branch number can be achieved only by affine permutations.

This work considers the problem of constructing efficient MDS matrices over the field \(\mathbb {F}_{2^m}\). Efficiency is measured by the metric XOR count which was introduced by Khoo et al. in CHES 2014. Recently Sarkar and Syed (ToSC Vol. 1, 2016) have shown the existence of \(4\times 4\) Toeplitz MDS matrices with optimal XOR counts. In this paper, we present some characterizations of Toeplitz matrices in light of MDS property. Our study leads to improving the known bounds of XOR counts of \(8\times 8\) MDS matrices by obtaining Toeplitz MDS matrices with lower XOR counts over \(\mathbb {F}_{2^4}\) and \(\mathbb {F}_{2^8}\).

International audience; Dickson polynomials which are permutations are interesting combinatorial objectsand well studied.In this paper, we describe Dickson polynomials of the first kind in $\F_2[x]$ that are involutions over finite fields of characteristic $2$. Such description is obtained using modular arithmetic's tools. We give results related to the cardinality and the number of fixed points (in the context of cryptographic application) of this corpus.We also present infinite classes of Dickson involutions. We study Dickson involutions which have a minimal set of fixed points.

In this paper, we study the behavior of the XOR count distributions under different bases of finite field. XOR count of a field element is a simplified metric to estimate the hardware implementation cost to compute the finite field multiplication of an element. It is an important criterion in the design of lightweight cryptographic primitives, typically to estimate the efficiency of the diffusion layer in a block cipher. Although several works have been done to find lightweight MDS diffusion matrices, to the best of our knowledge, none has considered finding lightweight diffusion matrices under other bases of finite field apart from the conventional polynomial basis. The main challenge for considering different bases for lightweight diffusion matrix is that the number of bases grows exponentially as the dimension of a finite field increases, causing it to be infeasible to check all possible bases. Through analyzing the XOR count distributions and the relationship between the XOR count distributions under different bases, we find that when all possible bases for a finite field are considered, the collection of the XOR count distribution is invariant to the choice of the irreducible polynomial of the same degree. In addition, we can partition the set of bases into equivalence classes, where the XOR count distribution is invariant in an equivalence class, thus when changing bases within an equivalence class, the XOR count of a diffusion matrix will be the same. This significantly reduces the number of bases to check as we only need to check one representative from each equivalence class for lightweight diffusion matrices. The empirical evidence from our investigation says that the bases which are in the equivalence class of the polynomial basis are the recommended choices for constructing lightweight MDS diffusion matrices.

In this paper, we study permutation polynomials over the finite fields that have linear structures. We present some results on such a permutation which transforms a hyperplane to another hyperplane. We fully characterize the bilinear polynomial with linear structure. The most important result of this paper is to show the relation between a Maiorana-McFarland function with an affine derivative and a polynomial with a linear structure. Moreover, we highlight this result in the context of resilient functions which are based on Maiorana-McFarland construction.

In this paper we construct a multiset S(f) of a Boolean function f consisting of the weights of the second derivatives of the function f with respect to all distinct two-dimensional subspaces of the domain. We refer to S(f) as the second derivative spectrum of f. The frequency distribution of the weights of these second derivatives is referred to as the weight distribution of the second derivative spectrum. It is demonstrated in this paper that this weight distribution can be used to distinguish affine nonequivalent Boolean functions. Given a Boolean function f on n variables we present an efficient algorithm having O(n22n ) time complexity to compute S(f). Using this weight distribution we show that all the 6-variable affine nonequivalent bents can be distinguished. We study the subclass of partial-spreads type bent functions known as PS ap type bents. Six different weight distributions are obtained from the set of PS ap bents on 8-variables. Using the second derivative spectrum we show that there exist 6 and 8 variable bent functions which are not affine equivalent to rotation symmetric bent functions. Lastly we prove that no non-quadratic Kasami bent function is affine equivalent to Maiorana–MacFarland type bent functions.

In this paper we analyze the combinatorial properties related to the Walsh spectra of rotation symmetric Boolean functions on even number of variables. These results are then applied in studying rotation symmetric bent functions. For the first time we could present an enumeration strategy for all the 10-variable rotation symmetric bent functions.

In this paper we study the neighbourhood of 15-variable Patterson-Wiedemann (PW) functions, i.e., the functions that differ by a small Hamming distance from the PW functions in terms of truth table representation. We exploit the idempotent structure of the PW functions and interpret them as Rotation Symmetric Boolean Functions (RSBFs). We present techniques to modify these RSBFs to introduce zeros in the Walsh spectra of the modified functions with minimum reduction in nonlinearity. Our technique demonstrates 15-variable balanced and 1-resilient functions with currently best known nonlinearities 16272 and 16264 respectively. In the process, we find functions for which the autocorrelation spectra and algebraic immunity parameters are best known till date.

For the first time in the literature, we investigate the negabent Boolean functions in the class of rotation symmetric Boolean functions. We derive a matrix to analyze the negabent property of rotation symmetric negabent Boolean functions. The dimension of this matrix is much smaller than the nega-Hadamard matrix. We show that for even n ≤ 8, there is no rotation symmetric negabent function which is also bent. Taking the cue from this numerical results, we prove that there is no rotation symmetric Boolean function of degree 2 which is both bent and negabent.

International audience; In this paper we study involutions over a finite field of order $\bf 2^n$. We present some classes, several constructions of involutions andwe study the set of their fixed points.

So far there is no systematic attempt to construct Boolean functions with maximum annihilator immunity. In this paper we present a construction keeping in mind the basic theory of annihilator immunity. This construction provides functions with the maximum possible annihilator immunity and the weight, nonlinearity and algebraic degree of the functions can be properly calculated under certain cases. The basic construction is that of symmetric Boolean functions and applying linear transformation on the input variables of these functions, one can get a large class of non-symmetric functions too. Moreover, we also study several other modifications on the basic symmetric functions to identify interesting non-symmetric functions with maximum annihilator immunity. In the process we also present an algorithm to compute the Walsh spectra of a symmetric Boolean function with O(n2) time and O(n) space complexity.

From the first principle, we concentrate on the Differential Power Analysis (DPA) in the Hamming weight model. Based on the power related data of an \((n, n)\) permutation S-box, we propose a spectrum (we call it Relative Power Spectrum, RPS in short) at \(2^n\) points each providing a vector containing \(n\) coordinates. Each coordinate contains the data related to single-bit DPA, and taking them together we provide relevant results in the domain of multi-bit DPA. For two affine equivalent \((n,n)\) permutation S-boxes \(F\) and \(G\), such that \(G(x) = F(Ax \oplus b)\), where \(A\) is a linear permutation (nonsingular binary matrix) and \(b\) is an \(n\)-bit vector, the RPSs of \(F\) and \(G\) are permutations of each other. However, this is not true in general when \(F\) and \(G\) are affine or extended affine equivalent, i.e., \(G(x) = B(F(Ax \oplus b)) \oplus L(x) \oplus c\), where \(B\) is a linear permutation, \(L\) is a linear mapping, and \(c\) is an \(n\)-bit vector. In such a case, the RPSs of \(F\) and \(G\) may not be related by permutation and may contain completely different vectors. We provide the effect of this in terms of DPA both in noise-free and noisy scenarios. Our results guide the designer to choose one S-box among all those in the same (extended) affine equivalence class when DPA in the Hamming weight model is considered. This is an instance where cryptographic advantage is attained by applying (extended) affine equivalence. For example, we provide a family of S-boxes that should replace the \((4, 4)\) S-boxes proposed in relation to the PRINCE block cipher.

Based on a criterion of permutation polynomials of the form $x^rf(x^{\frac{q-1}{m}})$ by Wan and Lidl (1991) and some very elementary techniques we show existence of permutation binomials of the following forms 1 $x(x^{\frac{2^n-1}{3}}+a) \in \mathbb{F}_{2^n}[x]$, for n>4 2 $x^{\frac{2^{2n}-1}{2^{n}-1} + 1}+ax = x^{2^n+2} + ax \in \mathbb{F}_{2^{2n}}[x]$, for n≥3. In (i), we extend a result of Carlitz (1962) for even characteristic. Moreover we present the count of such permutation binomials when a is in a certain subfield of $\mathbb{F}_{2^n}$. In (ii), we reprove, using much simpler technique, a recent result of Charpin and Kyureghyan (2008) and give the number of permutation binomials of this form. Finally, we discuss some cryptographic relevance of these results.

We consider negabent Boolean functions that have Trace representation. To the best of our knowledge, this is the first ever work on negabent functions with such representation. We completely characterize negabent quadratic monomial functions. We also present necessary and sufficient condition for a Maiorana-McFarland bent function to be a negabent function. As a consequence of that result we present a nice characterization of a bent-negabent Maiorana-McFarland function which is based on the permutation $x \mapsto x^{2^i}$.

We consider a class of 3-error-correcting cyclic codes of length 2m −1 over the two-element field $\mathbb{F}_2$ . The generator polynomial of a code of this class has zeroes $\alpha, \alpha^{2^i+1}$ and $\alpha^{2^j+1}$ , where α is a primitive element of the field ${\mathbb{F}_{2^m}}$ . In short, {1, 2i +1, 2j +1} refers to the zero set of these codes. Kasami in 1971 and Bracken and Helleseth in 2009, showed that cyclic codes with zeroes {1, 2l+1, 23l+1} and {1, 2l+1, 22l+1} respectively are 3-error correcting, where $\gcd(\ell,m) = 1$ . We present a sufficient condition so that the zero set {1, 2l+1, 2p l+1}, $\gcd(\ell,m)=1$ gives a 3-error-correcting cyclic code. The question for p >3 is open. In addition, we determine all the 3-error-correcting cyclic codes in the class {1, 2i +1, 2j +1} for m ${\mathbb{F}_{2^m}}$ . We apply the improved Schaub algorithm in order to find a lower bound of the spectral immunity of a Boolean function related to the zero set {1, 2i +1, 2j +1}.

We study permutations over the finite fields that have linear structures. Our main result is to show the relation between a Maiorana-McFarland function with an affine derivative and a polynomial with a linear structure.

We study the negabent Boolean functions which are symmetric. The Boolean function which has equal absolute spectral values under the nega-Hadamard transform is called a negabent function. For a bent function, the absolute spectral values are the same under the Hadamard-Walsh transform. Unlike bent functions, negabent functions can exist on odd number of variables. Moreover, all the affine functions are negabent. We prove that a symmetric Boolean function is negabent if and only if it is affine.

In this paper we present a theoretical construction of Rotation Symmetric Boolean Functions (RSBFs) on odd number of variables with maximum possible algebraic immunity (AI) and further these functions are not symmetric. Our RSBFs are of better nonlinearity than the existing theoretical constructions with maximum possible AI. To get very good nonlinearity, which is important for practical cryptographic design, we generalize our construction to a construction cum search technique in the RSBF class. We find 7, 9, 11 variable RSBFs with maximum possible AI having nonlinearities 56, 240, 984 respectively with very small amount of search after our basic construction.

The existence of 9-variable Boolean functions having nonlinearity strictly greater than 240 has been shown very recently (May 2006) by Kavut, Maitra and Yucel; a few functions with nonlinearity 241 have been identified by a heuristic search in the class of Rotation Symmetric Boolean Functions (RSBFs). In this paper, using combinatorial results related to the Walsh spectra of RSBFs, we efficiently perform the exhaustive search to enumerate the 9-variable RSBFs having nonlinearity > 240 and found that there are 8 ×189 many functions with nonlinearity 241 and there is no RSBF having nonlinearity > 241. We further prove that among these functions, there are only two which are different up to the affine equivalence. This is found by utilizing the binary nonsingular circulant matrices and their variants. Finally we explain the coding theoretic significance of these functions. This is the first time orphan cosets of R(1, n) having minimum weight 241 are demonstrated for n = 9. Further they provide odd weight orphans for n = 9; earlier these were known for certain n ≥11.