Search

Boolean functions with high algebraic immunity are important cryptographic primitives in some stream ciphers. In this paper, two methodologies for constructing minimal binary codes from sets, Boolean functions and vectorial Boolean functions with high algebraic immunity, are proposed. More precisely, a general construction of new minimal codes using minimal codes contained in Reed-Muller codes and sets without nonzero low degree annihilators is presented. The other construction allows us to yield minimal codes from certain subcodes of Reed-Muller codes and vectorial Boolean functions with high algebraic immunity. Via these general constructions, infinite families of minimal binary linear codes of dimension $m$ and length less than or equal to $m(m+1)/2$ are obtained. Besides, a lower bound on the minimum distance of the proposed minimal linear codes is established. Conjectures and open problems are also presented. The results of this paper show that Boolean functions with high algebraic immunity have nice applications in several fields additionally to symmetric cryptography, such as coding theory and secret sharing schemes. [ABSTRACT FROM AUTHOR]

Two general constructions of linear codes with functions over finite fields have been extensively studied in the literature. The first one is given by C(ƒ) = {Tr(aƒ(x) + bx)x∈Fqm*: a, b ∈ Fqm}, where q is a prime power, Fqm* = Fqm \ {0}, Tr is the trace function from Fqm to Fq, and ƒ(x) is a function from Fqm to Fqm with ƒ(0) = 0. Almost bent functions, quadratic functions and some monomials on F2m were used in the first construction, and many families of binary linear codes with few weights were obtained in the literature. This paper studies some punctured codes of these binary codes. Several families of binary linear codes with few weights and new parameters are obtained in this paper. Several families of distance-optimal binary linear codes with new parameters are also produced in this paper. [ABSTRACT FROM AUTHOR]

In this paper, we introduce the concept of biprojectivity in studying the cryptographically important almost perfect nonlinear (APN) functions. Although several known families of biprojective APN functions exist in the literature, the concept itself has not been explicitly observed and studied in detail. We give a survey of known APN families and functions that fall into the biprojective setting, then provide a method for finding such families and functions. We finally give two new infinite families of biprojective APN functions ${\mathsf {CCZ}}$ -inequivalent to any known APN function and study their properties. [ABSTRACT FROM AUTHOR]

The researches of Golay complementary sequences (GCSs) over 16 and 64 quadrature amplitude modulation (QAM) from 2001 to 2008 were generalized to $4^{q} $ -QAM GCSs of length $2^{m}$ by Li (the generalized cases I-III for $q\ge 2$) in 2010 and Liu et al. (the generalized cases IV-V for $q\ge 3$) in 2013. Those sequences are presented by the combination of the quaternary standard GCSs and compatible offsets. By providing new compatible offsets based on the factorization of the integer $q$ , we propose two new constructions of $4^{q} $ -QAM GCSs, which have the generalized cases I-V as special cases. The numbers of the proposed GCSs are equal to the product of the number of the quaternary standard GCSs and the number of the compatible offsets. Denote the number of prime factors of $q$ counted with multiplicity by $\Omega (q)$. The number of new offsets in our first construction is lower bounded by a polynomial of $m$ with degree $\Omega (q)$ , while the numbers of offsets in the generalized cases I-III and IV-V are a linear polynomial and a quadratic polynomial of $m$ , respectively. If $q$ has a prime factor larger than 2, the number of new offsets in our second construction is lower bounded by a polynomial of $m$ with degree $\Omega (q)+1$. As an example, the new offsets in our two constructions for $q=6$ , whose number is bounded by a cubic polynomial, is also given. The proof in this paper implies that all the mentioned GCSs over QAM can be regarded as projections of Golay complementary arrays of size $2\times 2\times \cdots \times 2$. [ABSTRACT FROM AUTHOR]

The goal of this paper is to investigate linear approximations of random functions and permutations. Our motivation is twofold. First, before the distinguishability of a practical cipher from an ideal one can be analysed, the cryptanalyst must have an accurate understanding of the statistical behaviour of the ideal cipher. Secondly, this issue has been neglected both in old and in more recent studies, particularly when multiple linear approximations are being used simultaneously. Traditional models have been based on the average behaviour and simplified using other assumptions such as independence of the linear approximations. Multidimensional cryptanalysis was introduced to avoid making artificial assumptions about statistical independence of linear approximations. On the other hand, it has the drawback of including many trivial approximations that do not contribute to the attack but just cause a waste of time and memory. We show for the first time in this paper that the trivial approximations reduce the degree of freedom of the related $\chi ^{2}$ distribution. Previously, the affine linear cryptanalysis was proposed to allow removing trivial approximations and, at the same time, admitting a solid statistical model. In this paper, we identify another type of multidimensional linear approximation, called Davies-Meyer approximation, which has similar advantages, and present full statistical models for both the affine and the Davies-Meyer type of multidimensional linear approximations. The new models given in this paper are realistic, accurate and easy to use. They are backed up by standard statistical tools such as Pearson’s $\chi ^{2}$ test and finite population correction and demonstrated to work accurately using practical examples. [ABSTRACT FROM AUTHOR]

The notion of correlation immune functions has been introduced by Siegenthaler (1984) in symmetric cryptography in the framework of stream ciphers. At the conference CRYPTO’91 by Camion et al., it has been pointed out that this notion existed in statistics and combinatorics. It has recently been highlighted that such functions also play an important role in a new framework related to side-channel attack counter-measures. Since then, the interest in correlation immune Boolean functions has been renewed, and new challenges regarding these functions have appeared. Specifically, low Hamming weight correlation immune functions have been selected as useful for counter-measures to side-channel attacks. Despite their importance, the literature is not abundant in this research direction. Two very interesting articles in which such correlation immune functions were nicely explored, given this novel use of them. Carlet initiated the first one in 2013, and the second one is due to Carlet and Chen (2018). This paper deals with correlation immune Boolean functions aiming to produce more candidates of those processing low Hamming weights. We shall focus on correlation immune Boolean functions with Hamming weights power of 2 (which offer a flexibility to control the correlation immunity aspects) and present several methods of designing them. Some design methods are efficient and could be employed to derive such functions. Consequently, given two positive integers $n$ and $m$ , we derive new effective constructions of correlation immune Boolean functions with Hamming weight power of 2. Furthermore, an upper bound on the correlation immunity of the newly constructed $n$ -variable Boolean functions with Hamming weight $2^{m}$ was determined for $n-m\ge 0$. Besides, exact values and lower bounds on the maximum correlation immunity of those functions are explored and discussed, mainly when the values of $n$ and $m$ are very close. This paper also exhibits explicit examples of those correlation immune functions that illustrate our methods. [ABSTRACT FROM AUTHOR]

We study an important specialization of the general problem of broadcasting on directed acyclic graphs, namely, that of broadcasting on two-dimensional (2D) regular grids. Consider an infinite directed acyclic graph with the form of a 2D regular grid, which has a single source vertex $X$ at layer 0, and $k + 1$ vertices at layer $k \geq 1$ , which are at a distance of $k$ from $X$. Every vertex of the 2D regular grid has outdegree 2, the vertices at the boundary have indegree 1, and all other non-source vertices have indegree 2. At time 0, $X$ is given a uniform random bit. At time $k \geq 1$ , each vertex in layer $k$ receives transmitted bits from its parents in layer $k-1$ , where the bits pass through independent binary symmetric channels with common crossover probability $\delta \in \left({0,\frac {1}{2}}\right)$ during the process of transmission. Then, each vertex at layer $k$ with indegree 2 combines its two input bits using a common deterministic Boolean processing function to produce a single output bit at the vertex. The objective is to recover $X$ with probability of error better than $\frac {1}{2}$ from all vertices at layer $k$ as $k \rightarrow \infty $. Besides their natural interpretation in the context of communication networks, such broadcasting processes can be construed as one-dimensional (1D) probabilistic cellular automata, or discrete-time statistical mechanical spin-flip systems on 1D lattices, with boundary conditions that limit the number of sites at each time $k$ to $k+1$. Inspired by the literature surrounding the “positive rates conjecture” for 1D probabilistic cellular automata, we conjecture that it is impossible to propagate information in a 2D regular grid regardless of the noise level $\delta $ and the choice of common Boolean processing function. In this paper, we make considerable progress towards establishing this conjecture, and prove using ideas from percolation and coding theory that recovery of $X$ is impossible for any $\delta \in \left({0,\frac {1}{2}}\right)$ provided that all vertices with indegree 2 use either AND or XOR for their processing functions. Furthermore, we propose a detailed and general martingale-based approach that establishes the impossibility of recovering $X$ for any $\delta \in \left({0,\frac {1}{2}}\right)$ when all NAND processing functions are used if certain structured supermartingales can be rigorously constructed. We also provide strong numerical evidence for the existence of these supermartingales by computing several explicit examples for different values of $\delta $ via linear programming. [ABSTRACT FROM AUTHOR]

Extended Affine (EA) equivalence is the equivalence relation between two vectorial Boolean functions $F$ and $G$ such that there exist two affine permutations $A$ , $B$ , and an affine function $C$ satisfying $G = A \circ F \circ B + C$. While the problem has a simple formulation, it is very difficult in practice to test whether two functions are EA-equivalent. This problem has two variants: EA-partitioning deals with partitioning a set of functions into disjoint EA-equivalence classes, and EA-recovery is about recovering the tuple $(A,B,C)$ if it exists. In this paper, we present a new algorithm that efficiently solves the EA-recovery problem for quadratic functions. Although its worst-case complexity occurs when dealing with APN functions, it supersedes, in terms of performance, all previously known algorithms for solving this problem for all quadratic functions and in any dimension, even in the case of APN functions. This approach is based on the Jacobian matrix of the functions, a tool whose study in this context can be of independent interest. The best approach for EA-partitioning in practice mainly relies on class invariants. We provide an overview of the known invariants along with a new one based on the ortho-derivative. This new invariant is applicable to quadratic APN functions, a specific type of functions that is of great interest, and of which tens of thousands need to be sorted into distinct EA-classes. Our ortho-derivative-based invariant is very fast to compute, and it practically always distinguishes between EA-inequivalent quadratic APN functions. [ABSTRACT FROM AUTHOR]

In this paper, we make a comprehensive study of two classes of Boolean functions whose interest originally comes from hybrid symmetric-FHE encryption (with stream ciphers like FiLIP), but which also present much interest for general stream ciphers. The functions in these two classes are cheap and easy to implement, and they allow the resistance to all classical attacks and to their guess and determine variants as well. We determine exactly all the main cryptographic parameters (algebraic degree, resiliency order, nonlinearity, algebraic immunity) for all functions in these two classes, and we give close bounds for the others (fast algebraic immunity, the dimension of the space of annihilators of minimal degree). This is the first time that this is done for all functions in large classes of cryptographic interest. [ABSTRACT FROM AUTHOR]

Reed-Muller codes are error-correcting codes used in many areas related to coding theory, such as electrical engineering and computer science. The binary $r^{th}$ -order Reed-Muller code $RM(r,n)$ can be viewed as the set of all $n$ -variable Boolean functions of algebraic degree at most $r$. Despite the intense work on these codes, many problems are known to be hard (notably, determining their covering radius) and remain open to this day. Fourteen years ago, Carlet and Mesnager improved in [IEEE Transactions on Information Theory, “Improving the Upper Bounds on the Covering Radii of Binary Reed-Muller Codes”, 53(1), 2007] the upper bound on the covering radius of the Reed-Muller code of order 2, and they deduced improved upper bounds on the covering radii of the Reed-Muller codes of higher orders. Until 2021, these upper bounds remained the best ones in the literature. The Reed-Muller code $RM(n-3,n)$ , which corresponds to the dual of the Reed-Muller code $RM(2,n)$ , has attracted much attention. One of the main reasons is that it is precisely the code that has been considered to get the upper bounds derived by Carlet and Mesnager. Those upper bounds have been obtained thanks to the characterization of the codewords of the Reed-Muller code, whose Hamming weights are strictly less than 2.5 times the minimum distance $2^{n-r}$ due to Kasami, Tokura, and Azumi. Despite their impressive work in the seventieth, a more refined study and profound description of those codewords of ${RM}({n-3},{n})$ whose Hamming weight equals 16, and especially 18, seem necessary, as it could help us significantly in improving the covering radius of Reed-Muller codes. In this paper, we push further the known results on the Reed-Muller codes by focusing on the Reed-Muller code ${RM}({n-3},{n})$. We provide a classification of the codewords of weights 16 and 18 of the Reed-Muller code $RM(n-3,n)$. Our algebraic descriptions allow us to count the number of such codewords and to enumerate all of them explicitly. [ABSTRACT FROM AUTHOR]

Designing Boolean functions whose output can be computed with light means at high speed, and satisfying all the criteria necessary to resist all major attacks on the stream ciphers using them as nonlinear components, has been an open problem since the beginning of this century, when algebraic attacks were invented. Functions allowing a good resistance are known since 2008, but their output is a little too complex to compute. Functions with fast and easy to compute output are known which have good algebraic immunity, such as majority functions and the so-called hidden weight bit (HWB) functions, but they all have the same cryptographic weakness: their too small nonlinearity. In the present paper, we introduce a generalization of the HWB functions into a construction of $n$ -variable balanced functions $f$ from $(n-1)$ -variable Boolean functions $g$ having some property held by a large number of functions. Function $f$ is defined by its support, equal to the image set of a vectorial function depending on $g$. This makes the function complex enough for allowing good cryptographic parameters, while its output is light to compute. The HWB function is what we obtain with $f$ when the initial function $g$ equals constant 1. Other well chosen functions $g$ provide functions $f$ having good cryptographic parameters. We analyze the constructed functions $f$ , we provide a fast way to compute their output, we determine their algebraic normal forms and we show that, most often, their algebraic degree is optimal. We study their Walsh transform and their nonlinearity and algebraic immunity. We observe with computer investigations that this generalization of the HWB function allows to keep its quality of being fast to compute and having good enough algebraic immunity, while significantly improving its nonlinearity. The functions already obtained in the investigations provide a quite good (and never reached before) trade-off between speed and security. Further (probably difficult) work should allow obtaining, among such generalized HWB functions whose number is huge, still better filter functions to be used in stream ciphers. [ABSTRACT FROM AUTHOR]

In a recent work, Beierle, Brinkmann and Leander presented a recursive tree search for finding APN permutations with linear self-equivalences in small dimensions. In this paper, we describe how this search can be adapted to find many new instances of quadratic APN functions. In particular, we found 12,921 new quadratic APN functions in dimension eight, 35 new quadratic APN functions in dimension nine and five new quadratic APN functions in dimension ten up to CCZ-equivalence. Remarkably, two of the 35 new APN functions in dimension nine are APN permutations. Among the 8-bit APN functions, there are three extended Walsh spectra that do not correspond to any of the previously-known quadratic 8-bit APN functions and, surprisingly, there exist at least four CCZ-inequivalent 8-bit APN functions with linearity 27, i.e., the highest possible non-trivial linearity for quadratic functions in dimension eight. [ABSTRACT FROM AUTHOR]

In a prior paper (Ellingsen et al., 2020), two of us, along with P. Ellingsen, P. Felke, and A. Tkachenko, defined a new (output) multiplicative differential and the corresponding $c$ -differential uniformity, which has the potential of extending differential cryptanalysis. Here, we continue the work by looking at some APN functions through the mentioned concept and showing that their $c$ -differential uniformity increases significantly in some cases. [ABSTRACT FROM AUTHOR]

Let $n=2m$. In 2020, Budaghyan, Helleseth and Kaleyski [IEEE TIT 66(11): 7081-7087, 2020] considered a family of quadrinomials over $\mathbb {F}_{2^{n}}$ of the form $x^{3}+a(x^{2^{s}+1})^{2^{k}}+bx^{3\cdot 2^{m}}+c(x^{2^{s+m}+2^{m}})^{2^{k}}$. They showed that two infinite classes of almost perfect nonlinear (APN) functions belong to this family when $\gcd (6,m)=1$. We observe that these two infinite classes of APN quadrinomials and the infinite class of APN polynomials from the Budaghyan-Carlet family belong to a more general family of polynomials over $\mathbb {F}_{2^{n}} $ with the form $f(x)=a{\mathrm{ Tr}}^{n}_{m}(F(x))+a^{2^{m}}{\mathrm{ Tr}}^{n}_{m}(G(x))$ , where $a \in \mathbb {F}_{2^{n}}\backslash \mathbb {F}_{2^{m}} $ , and both $F$ and $G$ are quadratic functions over $\mathbb {F}_{2^{n}}$. We characterize when $f(x) $ is APN. With the help of our characterization, letting $F(x)=bx^{2^{i}+1} $ and $G(x)=cx^{2^{s}+1}$ with $b, c\in \mathbb {F}_{2^{n}} $ , we obtain an infinite family of APN functions of the form $f(x) $ when ${\mathrm{ gcd}}(2,m)=1 $ and verify that for $n=10 $ two APN instances from this infinite family are CCZ-inequivalent to each other, and to any APN function over $\mathbb {F}_{2^{10}} $ from the previously known infinite families. [ABSTRACT FROM AUTHOR]

A function $F: \mathbb {F}_{2}^{n}\rightarrow \mathbb {F} _{2}^{n}$ , $n=2m$ , can have at most $2^{n}-2^{m}$ bent component functions. Trivial examples are vectorial bent functions from $\mathbb {F}_{2}^{n}$ to $\mathbb {F}_{2}^{m}$ , seen as functions on $\mathbb {F}_{2}^{n}$. The first nontrivial example is given in univariate form as $x^{2^{r}} {\rm Tr^{n}_{m}}(x), 1\le r < m$ (Pott et al. 2018), a few more examples of similar shape are given by Mesnager et al. 2019, and finally it has been shown that the quadratic function $F(x) = x^{2^{r}} {\rm Tr^{n}_{m}}(\Lambda (x))$ , has $2^{n}-2^{m}$ bent components if and only if $\Lambda $ is a linearized permutation polynomial of $\mathbb {F}_{2^{m}}[x]$ (Anbar et al. 2021). In the first part of this article, an upper bound for the nonlinearity of plateaued functions with $2^{n}-2^{m}$ bent components is shown, which is attained by the example $x^{2^{r}} {\rm Tr^{n}_{m}}(x)$. We then analyse in detail nonlinearity and differential spectrum of the class of functions $F(x) = x^{2^{r}} {\rm Tr^{n}_{m}}(\Lambda (x))$ , which, as will be seen, requires the study of the functions $x^{2^{r}}\Lambda (x)$. In the last part we demonstrate that this class belongs to a larger class of functions with $2^{n}-2^{m}$ Maiorana-McFarland bent components, which also contains nonquadratic and non-plateaued functions. [ABSTRACT FROM AUTHOR]

The six infinite families of power APN functions are among the oldest known instances of APN functions, and it has been conjectured in 2000 that they exhaust all possible power APN functions. Another long-standing open problem is that of the Walsh spectrum of the Dobbertin power family, which is still unknown. Those of Kasami, Niho and Welch functions are known, but not the precise values of their Walsh transform, with rare exceptions. One promising approach that could lead to the resolution of these problems is to consider alternative representations of the functions in questions. We derive alternative representations for the infinite APN monomial families. We show how the Niho, Welch, and Dobbertin functions can be represented as the composition $x^{i} \circ x^{1/j}$ of two power functions, and prove that our representations are optimal, i.e. no two power functions of lesser algebraic degree can be used to represent the functions in this way. We investigate compositions $x^{i} \circ L \circ x^{1/j}$ for a linear polynomial $L$ , show how the Kasami functions in odd dimension can be expressed in this way with $i=j$ being a Gold exponent and compute all APN functions of this form for $n \le 9$ and for $L$ with binary coefficients, thereby showing that our theoretical constructions exhaust all possible cases. We present observations and data on power functions with exponent $\sum _{i = 1}^{k-1} 2^{2ni} - 1$ which generalize the inverse and Dobbertin families. We present data on the Walsh spectrum of the Dobbertin function for $n \le 35$ , and conjecture its exact form. As an application of our results, we determine the exact values of the Walsh transform of the Kasami function at all points of a special form. Computations performed for $n\leq 21$ show that these points cover about 2/3 of the field. [ABSTRACT FROM AUTHOR]

We present methods for computing the distance from a Boolean polynomial on $m$ variables of degree $m-3$ (i.e., a member of the Reed–Muller code $RM(m-3, m)$) to the space of lower-degree polynomials ($RM(m-4, m)$). The methods give verifiable certificates for both the lower and upper bounds on this distance. By applying these methods to representative lists of polynomials, we show that the covering radius of $RM(4,8)$ in $RM(5,8)$ is 26 and the covering radius of $RM(5,9)$ in $RM(6,9)$ is between 28 and 32 inclusive, and we get improved lower bounds for higher $m$. We also apply our methods to various polynomials in the literature, thereby improving the known bounds on the distance from 2-resilient polynomials to $RM(m-4, m)$. [ABSTRACT FROM AUTHOR]

A new method is used to resolve a long-standing conjecture of Niho concerning the crosscorrelation spectrum of a pair of maximum length linear recursive sequences of length $2^{2m}-1$ with relative decimation $d=2^{m+2}-3$ , where $m$ is even. The result indicates that there are at most five distinct crosscorrelation values. Equivalently, the result indicates that there are at most five distinct values in the Walsh spectrum of the power permutation $f(x)=x^{d}$ over a finite field of order $2^{2m}$ and at most five distinct nonzero weights in the cyclic code of length $2^{2m}-1$ with two primitive nonzeros $\alpha $ and $\alpha ^{d}$. The method used to obtain this result proves constraints on the number of roots that certain seventh degree polynomials can have on the unit circle of a finite field. The method also works when $m$ is odd, in which case the associated crosscorrelation and Walsh spectra have at most six distinct values. [ABSTRACT FROM AUTHOR]

We initiate a study, when $F$ is a general APN function, of the Boolean function $\gamma _{F}$ related to the differential spectrum of $F$ (and which is known to be bent if and only if $F$ is almost bent). We first list many open questions about it. We study its algebraic normal form and its bivariate representation. We characterize its linear structures and specify nonexistence cases; we show, for $n$ even, their relation with the bent components of $F$. We pose three related open problems. We characterize further in terms of $\gamma _{F}$ the fact that a component function of $F$ is bent and study if the number of bent components can be optimal. We consider in particular two classes, one of which is that of APN power functions. We study more deeply the relation between the Walsh transform of $\gamma _{F}$ and the Walsh transform of $F$. By applying the Titsworth relation to the Walsh transform $W_{\gamma _{F}}$ , we deduce a new relation satisfied by $W_{F}^{2}$ , which is as simple as Chabaud-Vaudenay’s characterization by the fourth moment of the Walsh transform (which is in fact a particular case of the new relation), and provides more information. From this new relation, we deduce, for a sub-class of APN functions, a lower bound on the nonlinearity, which is significantly stronger than $nl(F)>0$ (the only general known bound). This sub-class of APN functions includes all known APN functions. The question (which is another open problem that we state) arises whether this sub-class equals that of all APN functions, but our bound provides at least a beginning of explanation why all known APN functions have non-weak nonlinearity. We finally show how the nonlinearities of $\gamma _{F}$ and $F$ are related by a simple formula; this leads to a last open problem. [ABSTRACT FROM AUTHOR]

Let Rq(r,n) be the rth order q-ary Reed-Muller code of length qn, which is the set of functions from Fqn to Fq represented by polynomials of degree ≤ r in Fq[X1, . . . , Xn]. The affine linear group AGL(n,Fq) acts naturally on Rq(r,n). We derive two formulas concerning the number of orbits of this action: (i) an explicit formula for the number of AGL orbits of Rq(n(q−1),n), and (ii) an asymptotic formula for the number of AGL orbits of R2(n,n)/R2(1,n). The number of AGL orbits of R2(n,n) has been numerically computed by several authors for n ≤ 31; the binary case of result (i) is a theoretic solution to the question. Result (ii) answers a question by MacWilliams and Sloane. [ABSTRACT FROM AUTHOR]