Invertible Quadratic Non-linear Functions over ${\mathbb{F}}_p^n$ via Multiple Local Maps

The construction of invertible non-linear layers over ${\mathbb{F}}_p^n$ that minimize the multiplicative cost is crucial for the design of symmetric primitives targeting Multi Party Computation (MPC), Zero-Knowledge proofs (ZK), and Fully Homomorphic Encryption (FHE). At the current state of the art, only few non-linear functions are known to be invertible over ${\mathbb{F}}_p$, as the power maps $x\mapsto x^d$ for $gcd(d,p-1)=1$. When working over ${\mathbb{F}}_p^n$ for $n\ge 2$, a possible way to construct invertible non-linear layers $\mathcal{S}$ over ${\mathbb{F}}_p^n$ is by making use of a local map $F:{\mathbb{F}}_p^m\to {\mathbb{F}}_p$ for $m\le n$, that is, ${\mathcal{S}}_F(x_0,x_1,\dots ,x_{n-1})=y_0\Vert y_1\Vert \dots \Vert y_{n-1}$ where $y_i=F(x_i,x_{i+1},\dots ,x_{i+m-1})$. This possibility has been recently studied by Grassi, Onofri, Pedicini and Sozzi at FSE/ToSC 2022. Given a quadratic local map $F:{\mathbb{F}}_p^m\to {\mathbb{F}}_p$ for $m\in \{1,2,3\}$, they proved that the shift-invariant non-linear function ${\mathcal{S}}_F$ over ${\mathbb{F}}_p^n$ defined as before is never invertible for any $n\ge 2·m-1$.

In this paper, we face the problem by generalizing such construction. Instead of a single local map, we admit multiple local maps, and we study the creation of nonlinear layers that can be efficiently verified and implemented by a similar shift-invariant lifting. After formally defining the construction, we focus our analysis on the case ${\mathcal{S}}_{F_0,F_1}(x_0,x_1,\dots ,x_{n-1})=y_0\Vert y_1\Vert \dots \Vert y_{n-1}$ for $F_0,F_1:{\mathbb{F}}_p^2\to {\mathbb{F}}_p$ of degree at most 2. This is a generalization of the previous construction using two alternating functions $F_0,F_1$ instead of a single F. As main result, we prove that (i) if $n\ge 3$, then ${\mathcal{S}}_{F_0,F_1}$ is never invertible if both $F_0$ and $F_1$ are quadratic, and that (ii) if $n\ge 4$, then ${\mathcal{S}}_{F_0,F_1}$ is invertible if and only if it is a Type-II Feistel scheme.