A connection between the boomerang uniformity and the extended differential in odd characteristic and applications
Abstract.
This paper makes the first bridge between the classical differential/boomerang uniformity and the newly introduced -differential uniformity. We show that the boomerang uniformity of an odd APN function is given by the maximum of the entries (except for the first row/column) of the functionβs -Difference Distribution Table. In fact, the boomerang uniformity of an odd permutation APN function equals its -differential uniformity. We then use this connection to easily compute the boomerang uniformity of several odd APN functions. In the second part we give two classes of differentially low-uniform functions obtained by modifying the inverse function. The first class of permutations (CCZ-inequivalent to the inverse) over a finite field (, an odd prime) is obtained from the composition of the inverse function with an order- cycle permutation, with differential uniformity if and is odd; if and is even; and otherwise. The second class is a family of binomials and we show that their differential uniformity equalsΒ . Finally, we extend to odd characteristic a result of Charpin and Kyureghyan (2010) providing an upper bound for the differential uniformity of the function and its switched version via a trace function.
Key words and phrases:
Finite fields, Differential uniformity, Boomerang uniformity.2020 Mathematics Subject Classification:
12E20, 11T06, 94A601. Introduction
Let be the finite field with elements, where is an odd prime and is a positive integer. The set of nonzero elements of forms a cyclic group with respect to multiplication and we shall denote it by . We shall denote by , the ring of polynomials in the indeterminate and coefficients in . For any , we shall denote by the quadratic character of and so, if , if is a square, if is not a square. It is well-known, due to Lagrangeβs interpolation formula, that any function can be uniquely expressed as a polynomial . A polynomial is called a permutation polynomial (PP) if the induced mapping permutes the elements of . The inverse map from to itself, given by , is an important class of functions due to its applications in coding theory, cryptography, among others. In fact, the inverse function over binary field has been used as a substitution box in the block cipher AES, which is one of the most widely used cryptographic primitive.
For any function and , the -Difference Distribution Table (-DDT) entry at point , denoted by , is defined as The -differential uniformity (-DU) of the function , denoted by , is then defined as the maximum of , where and if . When then is called perfect -nonlinear (PN) function (also known as -planar functionΒ [2]) and when then is called almost perfect -nonlinear (APN) function. If then the notion of the -differential uniformity coincides with the classical notion of differential uniformity. In the particular case when for some positive integer then it is easy to see that , for all and . Therefore, for determining -differential properties of a power map , it is sufficient to consider the -DDT entries with and . Motivated by the notion of differential spectrum introduced by Blondeau et al.Β [3], Wang et. alΒ [24] introduced the notion of the -differential spectrum of power functions. For any power map and , let then the -differential spectrum of , denoted by , is defined as . Again, if then the notion of -differential spectrum coincides with the classical notion of differential spectrum.
To simplify the analysis of the boomerang attackΒ [25], which can be thought of as an extension of the differential attack, Cid et al.Β [13] introduced the notion of boomerang connectivity table (BCT). InΒ [13], the BCT entries were defined for permutation functions in even characteristic, and their computation required the inverse of the permutation. In 2019, Li et al.Β [21] gave an equivalent technique to compute BCT, which does not require the compositional inverse of the permutation polynomial at all. For any , the BCT entry of the function at point , denoted by , is the number of solutions of the following system of equations
To quantify the resistance of a function against the boomerang attack, Boura and CanteautΒ [5] coined the term boomerang uniformity, denoted by , which is the maximum of , where . In the particular case when for some positive integer then for all . Thus, for the power maps it is sufficient to consider the BCT entries with . Analogous to the differential spectrum, the boomerang spectrum of a power map is defined in the following way. For any power map and , let then the boomerang spectrum of , denoted by , is defined as .
Though, so far, only one application of this new concept of the -DU has been found in design theoryΒ [1] (connecting the PN property, when , to some quasigroups), we want to point out that in reality, for monomial functions , the differentials used by Borissov et al.Β [9] in their attack, are the same as the -differentials at , , where . Further, in this paper, we shall establish a relation between BCT entries for odd APN functions and their -DDT entries. We then use this relation to derive two identities for the boomerang spectrum of odd APN functions. As an application of this result, we compute the boomerang spectrum of the inverse map from its -differential spectrum. By using our shown bridge connection between the BCT entries and and the -DDT entries, in addition to the inverse function, we compute the boomerang uniformity of four more classes of odd APN functions. It is worth mentioning here that the differential propertiesΒ [17, 18] and boomerang propertiesΒ [20] of the inverse function over finite fields of odd characteristic are known in the literature. For instance, when then the inverse function being a permutation is PN. In the case of , Helleseth et al.Β [18, Theorem 3] showed that is APN if , differentially -uniform if and differentially -uniform, otherwise. For , the -differential uniformity has been considered inΒ [17, Theorem 13], and the authors showed that if then the -DU of is if or ; and is APN in all the remaining cases. Experimental results suggest that for , is not always APN. For instance, when then is differentially -uniform over and when then is differentially -uniform over . Here, we give a very simple proof correcting some conditions for the -differential uniformity of for all the values of .
The second part of the paper is devoted to the construction of differentially low-uniform functions by modifying the inverse function. We know that the inverse map over finite fields of odd characteristic is an involution with three fixed points, namely , and . We composed the inverse map with a -length cycle and showed that the resulting function , which again is a permutation, has the differential uniformity
In addition to it, we construct a class of differentially -uniform binomials by adding the term to the inverse map . A well-known technique of constructing functions with low differential uniformity from the known ones is Dillonβs switching method (seeΒ [14, 16]). It was extended by Budaghyan, Carlet and LeanderΒ [7] (switching the Gold function to produce the APN function ), as well as Edel and PottΒ [16]. CarranzaΒ [11] further extended the switching method to any differential uniformity, albeit in even characteristic. Here, we show a similar result in odd characteristic, and in particular, we show that if we switch the inverse map with , where , is the absolute trace map and , then the differential uniformity of the resulting function is bounded above by .
2. Differential and boomerang properties of the inverse function
In this section, we shall first establish a (perhaps, surprising, though not difficult to show) link between classical differential uniformity, generalized differential uniformity and boomerang uniformity. More precisely, we shall show that the BCT entries of odd APN functions and their -DDT entries have the following relation.
Theorem 2.1.
Let be an odd APN function over , where an odd prime. Then, for any the BCT and the -DDT entries have the following relation
Proof.
Recall that a function over is said to be odd if and only if for all . Since is an odd function, for any fixed and if is a solution of the equation
so is . Also since is APN, if solutions of the above equation exist then these two are the only solutions. Equivalently, for odd APN functions . Now recall that the boomerang uniformity of the function is given by the maximum number of solutions of the following system of equations
(2.1) |
where and are running over . Since , cannot be a solution of the first equation of the above system. Therefore, the only possibility is and in this case the first equation of the above system becomes
Thus, for all . This completes the proof. β
Remark 2.2.
A consequence of our previous proof is the fact that the boomerang uniformity of an odd function (non necessarily APN) in odd characteristic is influenced by the -differential uniformity. Thus, if one needs a low boomerang uniformity odd function, a necessary condition is that its -differential uniformity must be low.
Remark 2.3.
In TheoremΒ 2.1, if is also a permutation, then , for all . Thus, for odd APN permutations, the boomerang uniformity is equal to its -differential uniformity.
It is well-known that the -differential spectrum entries of a power map satisfy the following identities
(2.2) |
which are useful in the computation of the -differential spectrum. To the best of out knowledge, there are no such identities for the boomerang spectrum entries of a power map. Here, using TheoremΒ 2.1, we give similar identities for the boomerang spectrum of odd APN power functions.
Corollary 2.4.
Let be an odd APN power function with boomerang uniformity and boomerang spectrum . Then the following identities hold:
(2.3) |
Proof.
The proof immediately follows from TheoremΒ 2.1. β
In the remaining of this section, we shall show that TheoremΒ 2.1 is not only useful in the determination of the boomerang uniformity of odd APN functions but it can also be applied, in part, to determine the BCT entries of other differentially low-uniform odd functions. For instance, the inverse function over finite fields is APN if , differentially -uniform if and differentially -uniform, otherwise. We shall use TheoremΒ 2.1 to determine the boomerang spectrum of the inverse map in all these three cases. Before moving forward, we first prove the following theorem which gives a very simple proof correcting some conditions for the -differential uniformity of for all the values of .
Theorem 2.5.
Let be a function from to itself and . Then the -differential uniformity of is
Proof.
Recall that the -differential uniformity of is given by the maximum number of solutions of the following equation
(2.4) |
where is running over . It is easy to see that if then and if then . When , then EquationΒ (2.4) reduces to
(2.5) |
If then we have no solution of EquationΒ (2.5) if and a unique solution, otherwise. In the case when then we have two solutions of EquationΒ (2.5) if and only if
Thus, for all , we have at most two solutions of EquationΒ (2.4). It is easy to see that when then we have two solutions of EquationΒ (2.5) if and only if Similarly, when then we have two solutions of EquationΒ (2.5) if and only if This completes the proof. β
InΒ [20, Theorems 3β6], Jiang et al. determined the boomerang spectrum of the inverse function. In TheoremΒ 2.8, we give a simpler proof for the boomerang spectrum utilizing the connection between BCT entries and -DDT entries. It is easy to see from TheoremΒ 2.5 that for the inverse function . Thus, for the APN inverse function (i.e., when ), the boomerang spectrum is the same as the -differential spectrum with the only change that . The next theorem gives the -differential spectrum of the inverse map.
Theorem 2.6.
Let be a function from to itself. Then the -differential spectrum of is given by the following:
-
(1)
If and is even, then
-
(2)
If and is odd, then
-
(3)
If and , then
-
(4)
If and , then
-
(5)
If and , then
-
(6)
If and , then
-
(7)
If , then
Proof.
We shall consider two cases, namely, and .
Case 1. Let . In this case, from TheoremΒ 2.5, we know that the -differential uniformity of is if is even and if is odd. Now consider the equation
(2.6) |
It is easy to observe that if then is the only solution of the above equation. Also, notice that, if then and if then . When , then EquationΒ (2.6) reduces to
(2.7) |
Now, for , EquationΒ (2.7) has a unique solution if , which is possible if and only if is even. Thus, when is even then and also for both , EquationΒ (2.7) has two solutions and hence . The remaining two entries of the -differential spectrum can be obtained using the identitiesΒ (2.2). Similarly, when is odd then and the remaining two entries of the -differential spectrum can be obtained using the identitiesΒ (2.2).
Case 2. Let . In this case, from TheoremΒ 2.5, we know that the -differential uniformity of is if and , otherwise. Now consider the equation
(2.8) |
Again, if then is the only solution of EquationΒ (2.8). Also, it is easy to see that, if , then , and if , then . When , then EquationΒ (2.8) reduces to
(2.9) |
For , EquationΒ (2.9) has a unique solution if , which is possible if and only if . Now, if , then for , EquationΒ (2.9) has a unique solution and hence we have . The remaining two entries of the -differential spectrum can be obtained using the identitiesΒ (2.2). Similarly, if then and . Likewise, if , then .
When , then if . If , then and . This completes the proof. β
Remark 2.7.
We note that Items and are special cases of Items and , respectively. We prefer to give these cases separately, as they may be of interest.
In the following theorem we consider the boomerang spectrum of the inverse function in the cases when it is not an APN function, i.e., when . This theorem exhibits how TheoremΒ 2.1 can be used to determine the boomerang spectrum of odd functions (not necessarily APN). Below, we use the notations
in the understood finite fields.
Theorem 2.8.
Let be a function from to itself and . Then the boomerang spectrum of is given by:
-
β’
If , then
-
β’
If , then
-
β’
If , and , then
-
(1)
If , then
-
(2)
If , then
-
(1)
-
β’
If , and , then
-
(1)
If , then
-
(2)
If , then
-
(1)
-
β’
Let and , which is equivalent to say that and is even. Then
Proof.
Recall that the boomerang uniformity of is given by the maximum number of solutions of the following equation
(2.10) |
where is running over . We shall now consider two cases, namely, and , respectively.
Case 1. Let . In this case SystemΒ (2.10) reduces to
(2.11) |
When , then after excluding solutions of the form , we have a total of solutions of this equation, namely, . Moreover, if then and if then . When then its solutions will be of the form . Thus, for all , we have and when then . Recall that
Thus, if is odd then , , and . Similarly, when is even then , , , and .
Case 2. Let (which happens if is even or, is odd and ). In this case, if then from TheoremΒ 2.5, the second equation of SystemΒ (2.10) has solutions . When
(2.12) |
then the solutions of this equation and the corresponding value of from the first equation of SystemΒ (2.10), i.e.,
(2.13) |
are given in TableΒ 1.
It is easy to observe, from TableΒ 1, that the solutions corresponding to are of the form . Thus, Β for all , where
the BCT entries are same as the -DDT entries . We shall now consider two subcases, namely, and , respectively.
Subcase 2.1. Let . In this case and hence the set becomes . Now, we shall consider two cases, namely, and which correspond to the cases of odd and even, respectively. If is odd, then for , we have two solutions of EquationΒ (2.10) coming from TableΒ 1 and for , we have three solutions of EquationΒ (2.10) and two among them are coming from TableΒ 1. Thus, when and is odd then , , and . Now, when is even then we have four solutions of EquationΒ (2.10) for and two of these are coming from TableΒ 1 and we have three solutions of EquationΒ (2.10) for and two of these are coming from TableΒ 1. Thus, for and even, we have , , , and .
Subcase 2.2. Let . Again, we shall consider three cases, namely, and . If , we have four solutions corresponding to if and two solutions, otherwise. Similarly, we have four solutions corresponding to if and two solutions, otherwise. Thus, if , then we have , , and . If , then we have , , and . If , then we have , , .
If , then we have four solutions corresponding to if and two solutions, otherwise. Similarly, we have four solutions corresponding to if and two solutions, otherwise. Thus, if , then we have , , and . If , then we have , , and . If , then we have , , .
If , then this together with the condition implies that is even. Now similar to the previous cases, we have four solutions corresponding to if and two solutions, otherwise. Similarly, we have four solutions corresponding to if and two solutions, otherwise. It is easy to observe that either both or none of and , since
Thus, if , then we have , , and . If , then we have , , . This completes the proof. β
In order to exemplify the usefulness of TheoremΒ 2.1, we shall now compute the boomerang uniformity of all the known classes of odd APN power functions over finite fields of odd characteristic. To the best of our knowledge, the following functions are the only known classes of odd APN power maps over , for odd:
It is easy to verify that the boomerang uniformity of is . We know that under the given condition, the compositional inverse of is and since, in general, a permutation function and its compositional inverse share the same boomerang uniformity (seeΒ [5, Proposition 2]), the boomerang uniformity of is also . We already computed the boomerang uniformity of . In the following theorem we shall compute the boomerang uniformity of the functions and .
Theorem 2.9.
Let and be the functions on the finite fields defined as above. Then and .
Proof.
We know, from TheoremΒ 2.1 that the boomerang uniformity of is given by the maximum number of solutions of the following equation
where and is running over . To analyze its solutions we will be using Dobbertinβs multivariate method. Let . The previous equation becomes
If satisfies , then we get the solution . If , then we find from the first equation and replace it into the second equation arriving to
which has at most five solutions. Thus and experimental results for small values of and suggest that this bound is attained.
We now consider the boomerang uniformity of . It was proved inΒ [22, Theorem 6] that the -differential uniformity of the function on is if , otherwise, it is . Since on is APN for , we therefore have that its -differential uniformity is exactly (since also ).
Finally, we shall consider the boomerang uniformity of , where . Note that is a permutation since , and . Thus, the boomerang uniformity of is equal to the boomerang uniformity (and hence -differential uniformity) of . FromΒ [23, PropositionΒ 5], we know that the -differential uniformity of is . This completes the proof. β
3. Differentially low-uniform functions by modifying the inverse function
The differential uniformity of functions over finite fields is preserved under certain transformations. For instance, let and are two functions over such that , for some affine permutations over and some affine function over . Then, and have the same differential uniformity and we say that and are extended affine (EA) equivalent. The most general equivalence relation, known so far, which preserves the differential uniformity is the Carlet-Charpin-Zinoviev (CCZ) equivalenceΒ [10]. Two functions and over are called CCZ-equivalent if there exists an affine permutation which maps the graph to the graph . Let be the linear part of the affine permutation . ThenΒ [6, Lemma 3.1] shows that the affine permutation simply adds constants to input and output of the CCZ-equivalent function obtained by applying . The CCZ-class of a function always contains the EA-class of the function . It is well-knownΒ [8] that if is a permutation then the CCZ-class also contains the EA-class of , the compositional inverse of the function .
We know that the inverse map over finite fields of odd characteristic is an involution with three fixed points, namely and . InΒ [19, Theorem 3.5], the authors swapped the images of the inverse function at and and determined the -differential uniformity of the function for all . One may note that even after swapping the images of and , this map has a fixed point . However, if we compose the inverse map by the -length cycles or , then it still remains a permutation with no fixed point. In the following theorem we shall determine the differential uniformity of the modified inverse function . Our results directly follow for the other modified map as it is the compositional inverse of .
Theorem 3.1.
Let be a prime number, be a positive integer and be a map from to itself. Then
Proof.
We know that the differential uniformity of is given by the maximum number of solutions of the following equation
(3.1) |
where and . Since is a permutation, if , the above equation has no solutions, for all . Now, we shall consider various cases depending upon the values of and . More precisely, we shall consider the cases when , and , respectively.
Case 1. Let . In this case, EquationΒ (3.1) reduces to , and so, .
Case 2. If , then from EquationΒ (3.1), , that is, .
Case 3. Let . In this case, EquationΒ (3.1) reduces to , which is .
Case 4. If , then from EquationΒ (3.1), , and so .
Case 5. Let . In this case, EquationΒ (3.1) reduces to , that is, .
Case 6. If , then from EquationΒ (3.1), , which is .
Case 7. Let . Then EquationΒ (3.1) reduces to
(3.2) |
One may note, from Cases 1β6, that the values of are in terms of some functions in the variable . Now, in order to simplify the solutions and the corresponding values of from Cases 1β6, we consider five cases, namely, , , , and . This discussion is summarized in TableΒ 2.
Case 1 | |||||
---|---|---|---|---|---|
Case 2 | |||||
Case 3 | |||||
Case 4 | |||||
Case 5 | |||||
Case 6 | |||||
Case 7 |
Now, we shall use TableΒ 2 to compute DDT entries for different values of and . It is easy to observe from the column 2-5 of the TableΒ 2 that for all and . When then we can infer following from the TableΒ 2
-
(1)
We cannot have solutions from CaseΒ 1 and CaseΒ 4 simultaneously as in this case , which is not possible as is odd.
-
(2)
We cannot have solutions from CaseΒ 2 and CaseΒ 6 simultaneously, as , a contradiction.
-
(3)
We cannot have solutions from CaseΒ 3 and CaseΒ 5 simultaneously, as , a contradiction.
-
(4)
We cannot have solutions from CaseΒ 1 and CaseΒ 5 simultaneously, as , a contradiction.
-
(5)
We cannot have solutions from CaseΒ 2 and CaseΒ 4 simultaneously, as , a contradiction.
-
(6)
We cannot have solutions from CaseΒ 3 and CaseΒ 6 simultaneously, as , a contradiction.
Thus, we have the following two possible scenarios in which we can get more than two solutions from CasesΒ 1β6:
-
β’
We now assume that we have solutions from CaseΒ 1, CaseΒ 2 and CaseΒ 3. Then . The second and third equalities produce the following system of equations
One can easily verify that the above system of equations is consistent if and only if and . Thus, for and , we have the solutions , and of EquationΒ (3.1) from CaseΒ 1, CaseΒ 2 and CaseΒ 3, respectively. Now, for these parameters, the equation in the CaseΒ 7 becomes , which has two solutions if and no solutions, otherwise. We know that when then if and only if is even. Thus,
-
β’
We now assume that we have solutions from CasesΒ 4β6. Then . The second and third equalities gives the following system of equations
One can easily verity that the above system of equations is consistent if and only if and . Thus, for and , we have solutions , and of EquationΒ (3.1) from CaseΒ 4, CaseΒ 5 and CaseΒ 6, respectively. Now, for these parameters, equation in the CaseΒ 7 becomes , which has two solutions if and no solutions, otherwise. We know that when then if and only if is even. Thus,
This completes the proof. β
Remark 3.2.
Since the function in the above theorem is a permutation, it is CCZ-inequivalent to the inverse function, since for there is no permutation function in the CCZ-class of the inverse function.
Computations revealed that for some values of (like, , or the differential uniformity of the function in our previous theorem is (we could not find examples of uniformity lower thanΒ , though we have not performed extensive computations). We will show in our next result that if , the differential uniformity of our function is indeedΒ , for any oddΒ .
Theorem 3.3.
Let be an integer and be a map from to itself. Then
Proof.
We know that the differential uniformity of is given by the maximum number of solutions of the following equation
(3.3) |
where and . Since is a permutation, if the above equation has no solutions for all . We shall consider various cases depending upon the values of and .
Case 1. Let . In this case, EquationΒ (3.3) reduces to , so .
Case 2. If , then from EquationΒ (3.3) , thus .
Case 3. Let . In this case, EquationΒ (3.3) reduces to , hence .
Case 4. Let . In this case, EquationΒ (3.3) reduces to , thus .
Case 5. If , then from EquationΒ (3.3) , so .
Case 6. Let . In this case, EquationΒ (3.3) reduces to , thus .
Case 7. Let . Then EquationΒ (3.3) reduces to
(3.4) |
One may note, from Cases 1β6, that the values of are in terms of some functions in the variable . Now, in order to simplify the solutions and corresponding values of from Cases 1β6, we consider five cases, namely, , and . This discussion is summarized in TableΒ 3.
Case 1 | |||
---|---|---|---|
Case 2 | |||
Case 3 | |||
Case 4 | |||
Case 5 | |||
Case 6 | |||
Case 7 |
It is easy to observe from TableΒ (3) that the DDT entries
Similarly,
For we consider the following scenarios:
-
(1)
We assume that we have a solution from the CaseΒ 1. Now, we cannot have solutions from CaseΒ 2 as in this case and the second equality would imply that , a contradiction. Also, we cannot have solutions from CaseΒ 3 as the second equality of implies that , a contradiction. Similarly, we cannot have solutions from CaseΒ 4, as then and the second equality would imply that , which again is a contradiction. Likewise, we cannot have solutions from CaseΒ 5, since then and the second equality implies that . Let us assume that we have a solution from CaseΒ 6, and so, , so and , and in this case the equation in CaseΒ 7 becomes . Thus if and , then we have
-
(2)
We now assume that we have a solution from CaseΒ 2. We have already seen that we cannot have solutions from CaseΒ 1. Now, we cannot have solutions from CaseΒ 3, as in this case and the second equality would imply that , a contradiction. Similarly, we cannot have a solution from CaseΒ 4, as in this case and the second equality implies that , a contradiction. Likewise, we cannot have a solution from CaseΒ 6, as the second equality of implies that , which is a contradiction. Now, let us assume that we have a solution from CaseΒ 5 then , so and . Notice that for with , the equation in CaseΒ 7 reduces to , which always has two solutions . Thus if and , then we have
-
(3)
We now assume that we have solutions from CaseΒ 3. We have already seen that we cannot have solutions from CaseΒ 1 and CaseΒ 2. It is easy to verify that if we have a solution from CaseΒ 5, the second equality of implies that , a contradiction. Similarly, if we have a solution from CaseΒ 6, then and the second equality implies that , which again is a contradiction. Now, let us assume that we have a solution from CaseΒ 4 then , so and . It is easy to observe that for and , the equation in CaseΒ 7 reduces to . Thus, if and , then we have
-
(4)
We now assume that we have a solution from CaseΒ 4. We have already seen that in this case we cannot have solution from CaseΒ 1 and CaseΒ 2. We have also discussed the case when we have solutions from CaseΒ 4 and CaseΒ 3, simultaneously. One may note that if we have a solution from CaseΒ 5, then and the second equality implies that , which is a contradiction. Similarly, we have solution from CaseΒ 6 as the second equality of implies that .
-
(5)
We now assume that we have a solution from CaseΒ 5. We have already shown that in this case we have solutions from CasesΒ 1, 3 and 4. Also, we have already discussed the case when we have solutions from CaseΒ 5 and CaseΒ 2, simultaneously. One can easily verify that if we have solutions from CaseΒ 5 and CaseΒ 6 simultaneously, then , so , a contradiction.
This completes the proof. β
Constructing low differential uniform functions from known ones is a common theme in many works. In the same research vein, in the following result, we shall show that if we add a monomial term to the inverse mapping then it still remains differentially -uniform. However by doing so, it is no longer a permutation. Later, we will construct new functions with low differential uniformity, which may remain permutations (and we provide examples of such).
Proposition 3.4.
Let , where , be a function from to itself. Then the differential uniformity of is .
Proof.
We know that the differential uniformity of is given by the maximum number of solutions of the following equation
(3.5) |
where and . It is straightforward to see that if then and if then . When then EquationΒ (3.5) reduces to
(3.6) |
which can have at most solutions in . This completes the proof. β
Charpin-KyureghyanΒ [12, Proposition 3] showed that the differential uniformity of is upper bounded by twice the differential uniformity ofΒ , that is, , in even characteristic. In the following result, we shall show that a similar result holds for odd characteristic, as well, and in the particular case of switching the inverse function we obtain a stronger result.
Proposition 3.5.
Let be defined on , and , where and is the absolute trace function. Then the differential uniformity of , . Further, if , then .
Proof.
We know that the differential uniformity of is given by the maximum number of solutions, for , of the following equation,
(3.7) |
Since , an argument similar as the one ofΒ [12] shows that
from which we can infer that .
If then is APN, if , has differential uniformity when , and in all other cases. Our argument below is only better for the inverse than the general one in the case when is not APN. We write the differential equation slightly differently, namely, , more precisely,
(3.8) |
We shall now consider two cases, namely, and . Notice that if , then EquationΒ (3.8) reduces to When , then EquationΒ (3.8) reduces to
(3.9) |
that is,
Now, let . Then using the properties of the trace function, observe that
We conclude that , for any . Surely, we cannot claim that the number of solutions for EquationΒ (3.9) is precisely , since the above value for , rendering values of may not all satisfy the original differential equationΒ (3.7) for . β
Remark 3.6.
In the above proposition, if is such that the derivative traces , then the bound of the differential uniformity of the switched inverse function becomes .
While this is not a systematic computation, we can surely do a switching of the inverse function to obtain permutation polynomials that preserve the differential uniformity of the inverse. In particular, we can find permutation APN functions for some small dimensions, easily. We took functions of the form ( is a primitive element of the underlying finite field). We tabulate below some computational data for small primes and dimensions (we only list the permutation polynomials, where , which preserve the differential uniformity (DU) of the inverse function, surely, the case of ; we also removed the trivial cases of and ).
DU | ||
Β (APN) | ||
4. Conclusions
In this paper we start by correcting some conditions on the -DU of the inverse function for , and give two identities concerning the boomerang spectrum of a function. We next show that a necessary condition for a low boomerang uniformity of an odd function is for the -differential uniformity to be low, as well. In fact, in the case of odd APN permutations, they are equal. We apply this result to find the boomerang spectrum of the inverse function and the boomerang uniformity of four other odd APN functions. Moreover, we find a new class of differentially -uniform permutations in characteristic (respectively, differentially 5-uniform when ) that is CCZ-inequivalent to the inverse function. Finally, we provide an upper bound for the differential uniformity of a switched function, thus extending a result of Charpin and KyureghyanΒ [12] to odd characteristic.
Acknowledgements
The research of Mohit Pal is supported by the Research Council of Norway under Grant No. 314395. Pantelimon StΔnicΔ thanks the Selmer Center at the University of Bergen for the invitation to visit, and for the excellent working conditions while this paper was started.
Declarations
Conflict of interest The authors declare that they have no conflict of interest regarding the publication of this paper.
References
- [1] N. Anbar, T. Kalayci, W. Meidl, C. Riera, P. StΔnicΔ, PN functions, complete mappings and quasigroup difference sets, J. Combin. Designs 31 (2023), 667β690.
- [2] D. Bartoli, M. Timpanella, On a generalization of planar functions, J. Algebra Comb. 52 (2020), 187β213.
- [3] C. Blondeau, A. Canteaut, P. Charpin, Differential properties of power functions, Int. J. Inf. Coding Theory 1(2) (2010), 149β170.
- [4] C. Blondeau, A. Canteaut, P. Charpin, Differential properties of , IEEE Trans. Inf. Theory 57(12) (2011), 8127β8137.
- [5] C. Boura, A. Canteaut, On the boomerang uniformity of cryptographic Sboxes, IACR Trans. Symmetric Cryptol. 2018(3) (2018), 290β310.
- [6] L. Budaghyan, M. Calderini, I. Villa, On relations between CCZ- and EA-equivalences, Cryptogr. Commun. 12 (2020), 85β100.
- [7] L. Budaghyan, C. Carlet, G. Leander, Constructing new APN functions from known ones, Finite Fields Appl. 15 (2009), 150β159.
- [8] L. Budaghyan, C. Carlet, A. Pott, New classes of almost bent and almost perfect nonlinear polynomials, IEEE Trans. Inf. Theory, 52(3) (2006), 1141β1152.
- [9] N. Borisov, M. Chew, R. Johnson, D. Wagner, Multiplicative differentials, In: J. Daemen, V. Rijmen (eds) Fast Software Encryption. FSE 2002, LNCS 2365, Springer, Berlin, Heidelberg, 2002.
- [10] C. Carlet, P. Charpin, V. Zinoviev, Codes, bent functions and permutations suitable for DES-like cryptosystems, Des. Codes Cryptgr. 15 (1998), 125β156.
- [11] R. C. R. Carranza, Construction of new differentially βuniform families, Ph.D. Dissertation, University of Puerto Rico, Rio Piedras, 2020; available at https://repositorio.upr.edu/bitstream/handle/11721/2378/UPRRP_MATE_ReyesCarranza_2020.pdf?sequence=1&isAllowed=y.
- [12] P. Charpin, G. Kyureghyan, Monomial functions with linear structure and permutation polynomials, In: Finite Fields: Theory and Applications, Contemp. Math. 518, 3, (16) Amer. Math. Soc., 2010, pp. 99β111.
- [13] C. Cid, T. Huang, T. Peyrin, Y. Sasaki, L. Song, Boomerang connectivity table: a new cryptanalysis tool, In: J. Nielsen, V. Rijmen (eds.) Adv. in Crypt.-EUROCRYPT 2018, LNCS 10821, pp. 683β714. Springer, Cham (2018).
- [14] J. F. Dillon, APN polynomials: an update, International Conf. on Finite Fields and Applic. β Fq9, 2009.
- [15] H. Dobbertin, D. Mills, E. N. Muller, A. Pott, W. Willems, APN functions in odd characteristic, Discr. Math. 267 (2003), 95β112.
- [16] Y. Edel, A. Pott, A new almost perfect nonlinear function which is not quadratic, Adv. Math. Commun. 3(1) (2009), 59β81.
- [17] P. Ellingsen, P. Felke, C. Riera, P. StΔnicΔ, A. Tkachenko, -differentials, multiplicative uniformity and (almost) perfect -nonlinearity, IEEE Trans. Inf. Theory 66(9) (2020), 5781β5789.
- [18] T. Helleseth, C. Rong, D. Sandberg, New families of almost perfect nonlinear power functions, IEEE Trans. Inf. Theory 45 (1999), 475β485.
- [19] J. Jeong, N. Koo, S. Kwon, Low -differential uniformity of the swapped inverse function in odd characteristic, Discret. Appl. Math. 336 (2023), 195β209.
- [20] S. Jiang, K. Li, Y. Li, L. Qu, Differential and boomerang spectrums of some power permutations, Cryptogr. Commun. 14 (2022), 371β393.
- [21] K. Li, L. Qu, B. Sun, C. Li, New results about the boomerang uniformity of permutation polynomials, IEEE Trans. Inform. Theory 65(11) (2019), 7542β7553.
- [22] S. Mesnager, C. Riera, P. StΔnicΔ, H. Yan, Z. Zhou, Investigation on c-(almost) perfect nonlinear functions, IEEE Trans. Inf. Theory 67(10) (2021), 6916β6925.
- [23] P. StΔnicΔ, Investigations on c-Boomerang Uniformity and Perfect Nonlinearity, Discrete Applied Mathematics 304 (2021), 297β314.
- [24] X. Wang, D. Zheng, L. Hu, Several classes of PN power functions over finite fields, Discret. Appl. Math. 322 (2022), 171β182.
- [25] D. Wagner, The boomerang attack, In: Knudsen, L.R. (ed.) Fast Software Encryption-FSE 1999. LNCS 1636, Springer, Berlin, Heidelberg, pp. 156β170 (1999).