Search

Multivariate Cryptography is one of the main candidates for Post-quantum Cryptography. Multivariate schemes are usually constructed by applying two secret affine invertible transformations $\mathcal S,\mathcal T$ to a set of multivariate polynomials $\mathcal{F}$ (often quadratic). The secret polynomials $\mathcal{F}$ posses a trapdoor that allows the legitimate user to find a solution of the corresponding system, while the public polynomials $\mathcal G=\mathcal S\circ\mathcal F\circ\mathcal T$ look like random polynomials. The polynomials $\mathcal G$ and $\mathcal F$ are said to be affine equivalent. In this article, we present a more general way of constructing a multivariate scheme by considering the CCZ equivalence, which has been introduced and studied in the context of vectorial Boolean functions.

Civino et al. have characterised diffusion layers that expose an SPN to vulnerability from differential cryptanalysis when employing alternative operations coming from groups isomorphic to the translation group on the message space. In this study, we present a classification of diffusion layers that exhibit linearity in parallel alternative operations for ciphers with 4-bit s-boxes, enabling the possibility of an alternative differential attack simultaneously targeting all the s-boxes within the block. Furthermore, we investigate the differential behaviour with respect to alternative operations for all classes of optimal 4-bit s-boxes, as defined by Leander and Poschmann (2007). Our examination reveals that certain classes contain weak permutations w.r.t. alternative differential attacks, and we leverage these vulnerabilities to execute a series of experiments.

The use of alternative operations in differential cryptanalysis, or alternative notions of differentials, are lately receiving increasing attention. Recently, Civino et al. managed to design a block cipher which is secure w.r.t. classical differential cryptanalysis performed using XOR-differentials, but weaker with respect to the attack based on an alternative difference operation acting on the first s-box of the block. We extend this result to parallel alternative operations, i.e. acting on each s-box of the block. First, we recall the mathematical framework needed to define and use such operations. After that, we perform some differential experiments against a toy cipher and compare the effectiveness of the attack w.r.t. the one that uses XOR-differentials.

Dillon observed that an APN function $F$ over $\mathbb{F}_2^{n}$ with $n$ greater than $2$ must satisfy the condition $\{F(x) + F(y) + F(z) + F(x + y + z) \,:\, x,y,z \in\mathbb{F}_2^n\}= \mathbb{F}_2^n$. Recently, Taniguchi (2023) generalized this condition to functions defined from $\mathbb{F}_2^n$ to $\mathbb{F}_2^m$, with $m>n$, calling it the D-property. Taniguchi gave some characterizations of APN functions satisfying the D-property and provided some families of APN functions from $\mathbb{F}_2^n$ to $\mathbb{F}_2^{n+1}$ satisfying this property. In this work, we further study the D-property for $(n,m)$-functions with $m\ge n$. We give some combinatorial bounds on the dimension $m$ for the existence of such functions. Then, we characterize the D-property in terms of the Walsh transform and for quadratic functions we give a characterization of this property in terms of the ANF. We also give a simplification on checking the D-property for quadratic functions, which permits to extend some of the APN families provided by Taniguchi. We further focus on the class of the plateaued functions, providing conditions for the D-property.

In this work, we present two new families of quadratic APN functions. The first one (F1) is constructed via biprojective polynomials. This family includes one of the two APN families introduced by G\"olo\v{g}lu in 2022. Then, following a similar approach as in Li \emph{et al.} (2022), we give another family (F2) obtained by adding certain terms to F1. As a byproduct, this second family includes one of the two families introduced by Li \emph{et al.} (2022). Moreover, we show that for $n=12$, from our constructions, we can obtain APN functions that are CCZ-inequivalent to any other known APN function over $\mathbb{F}_{2^{12}}$.

In this paper, we construct some piecewise defined functions, and study their $c$-differential uniformity. As a by-product, we improve upon several prior results. Further, we look at concatenations of functions with low differential uniformity and show several results. For example, we prove that given $\beta_i$ (a basis of $\mathbb{F}_{q^n}$ over $\mathbb{F}_q$), some functions $f_i$ of $c$-differential uniformities $\delta_i$, and $L_i$ (specific linearized polynomials defined in terms of $\beta_i$), $1\leq i\leq n$, then $F(x)=\sum_{i=1}^n\beta_i f_i(L_i(x))$ has $c$-differential uniformity equal to $\prod_{i=1}^n \delta_i$.

EFRST20, the notion of $c$-differentials was introduced as a potential expansion of differential cryptanalysis against block ciphers utilizing substitution boxes. Drawing inspiration from the technique of higher order differential cryptanalysis, in this paper we propose the notion of higher order $c$-derivatives and differentials and investigate their properties. Additionally, we consider how several classes of functions, namely the multiplicative inverse function and the Gold function, perform under higher order $c$-differential uniformity., Comment: 14 pages, to appear in International Conference on Security and Privacy, November 2021

APN functions play a fundamental role in cryptography against attacks on block ciphers. Several families of quadratic APN functions have been proposed in the recent years, whose construction relies on the existence of specific families of polynomials. A key question connected with such constructions is to determine whether such APN functions exist for infinitely many dimensions or not. In this paper we consider a family of functions recently introduced by Li et al. in 2021 showing that for any dimension $m\geq 3$ there exists an APN function belonging to such a family. Our main result is proved by a combination of different techniques arising from both algebraic varieties over finite fields connected with linearized permutation rational functions and {partial vector space partitions}, together with investigations on the kernels of linearized polynomials.

Functions with low differential uniformity have relevant applications in cryptography. Recently, functions with low $c$-differential uniformity attracted lots of attention. In particular, so-called APcN and PcN functions (generalization of APN and PN functions) have been investigated. Here, we provide a characterization of such functions via quadratic polynomials as well as non-existence results.

The study of the trapdoors that can be hidden in a block cipher is and has always been a high-interest topic in symmetric cryptography. In this paper we focus on Feistel-network-like ciphers in a classical long-key scenario and we investigate some conditions which make such a construction immune to the partition-based attack introduced recently by Bannier et al., Comment: Accepted for publication in Advances in Mathematics of Communications

Functions with low differential uniformity can be used in a block cipher as S-boxes since they have good resistance to differential attacks. In this paper we consider piecewise constructions for permutations with low differential uniformity. In particular, we give two constructions of differentially 6-uniform functions, modifying the Gold function and the Bracken-Leander function on a subfield.

The algebraic structure of the group generated by the encryption functions of a block cipher depends on the key schedule algorithm used for generating the round keys. For such a reason, in general, studying this group does not appear to be an easy task. Previous works, focusing on the algebraic properties of groups associated to a cipher, have studied the group generated by the round functions of the cipher considering independent round keys. In this paper, we want to study the more realistic group generated by the encryption functions, where the key schedule satisfies certain requirements. In this contest, we are able to identify sufficient conditions that permit to guarantee the primitivity of this group and the security of the cipher with respect to the partition-based trapdoor. This type of trapdoor has been recently introduced by Bannier et al. (2016) and it is a generalization of that introduced by Paterson in 1999., Comment: to appear on Journal of Algebra and its Applications

Round functions used as building blocks for iterated block ciphers, both in the case of Substitution-Permutation Networks and Feistel Networks, are often obtained as the composition of different layers which provide confusion and diffusion, and key additions. The bijectivity of any encryption function, crucial in order to make the decryption possible, is guaranteed by the use of invertible layers or by the Feistel structure. In this work a new family of ciphers, called wave ciphers, is introduced. In wave ciphers, round functions feature wave functions, which are vectorial Boolean functions obtained as the composition of non-invertible layers, where the confusion layer enlarges the message which returns to its original size after the diffusion layer is applied. This is motivated by the fact that relaxing the requirement that all the layers are invertible allows to consider more functions which are optimal with regard to non-linearity. In particular it allows to consider injective APN S-boxes. In order to guarantee efficient decryption we propose to use wave functions in Feistel Networks. With regard to security, the immunity from some group-theoretical attacks is investigated. In particular, it is shown how to avoid that the group generated by the round functions acts imprimitively, which represent a serious flaw for the cipher.

We provide sufficient conditions to guarantee that a translation based cipher is not vulnerable with respect to the partition-based trapdoor. This trapdoor has been introduced, recently, by Bannier et al. (2016) and it generalizes that introduced by Paterson in 1999. Moreover, we discuss the fact that studying the group generated by the round functions of a block cipher may not be sufficient to guarantee security against these trapdoors for the cipher., Comment: to be published on Advances in Mathematics of Communications

Sometimes it is possible to embed an algebraic trapdoor into a block cipher. Building on previous research, in this paper we investigate an especially dangerous algebraic structure, which is called a hidden sum and which is related to some regular subgroups of the affine group. Mixing group theory arguments and cryptographic tools, we pass from characterizing our hidden sums to designing an efficient algorithm to perform the necessary preprocessing for the exploitation of the trapdoor., Comment: arXiv admin note: text overlap with arXiv:1702.00581

The affine general linear group acting on a vector space over a prime field is a well-understood mathematical object. Its elementary abelian regular subgroups have recently drawn attention in applied mathematics thanks to their use in cryptography as a way to hide or detect weaknesses inside block ciphers. This paper is focused on building a convenient representation of their elements which suits better the purposes of the cryptanalyst. Several combinatorial counting formulas and a classification of their conjugacy classes are given as well., Comment: to appear in Journal of Algebra

We provide two sufficient conditions to guarantee that the round functions of a translation based cipher generate a primitive group. Furthermore, under the same hypotheses, and assuming that a round of the cipher is strongly proper and consists of m-bit S-Boxes, with m = 3; 4 or 5, we prove that such a group is the alternating group. As an immediate consequence, we deduce that the round functions of some lightweight translation based ciphers, such as the PRESENT cipher, generate the alternating group., Comment: to appear on Journal of Algebra and its Applications

In this work we study both the index coding with side information (ICSI) problem introduced by Birk and Kol in 1998 and the more general problem of index coding with coded side information (ICCSI), described by Shum et al in 2012. We estimate the optimal rate of an instance of the index coding problem. In the ICSI problem case, we characterize those digraphs having min-rank one less than their order and we give an upper bound on the min-rank of a hypergraph whose incidence matrix can be associated with that of a 2-design. Security aspects are discussed in the particular case when the design is a projective plane. For the coded side information case, we extend the graph theoretic upper bounds given by Shanmugam et al in 2014 on the optimal rate of index code.

APN permutations in even dimension are vectorial Boolean functions that play a special role in the design of block ciphers. We study their properties, providing some general results and some applications to the low-dimension cases. In particular, we prove that none of their components can be quadratic. For an APN vectorial Boolean function (in even dimension) with all cubic components we prove the existence of a component having a large number of balanced derivatives. Using these restrictions, we obtain the first theoretical proof of the non-existence of APN permutations in dimension 4. Moreover, we derive some contraints on APN permutations in dimension 6.

Index coding is a source coding problem in which a broadcaster seeks to meet the different demands of several users, each of whom is assumed to have some prior information on the data held by the sender. If the sender knows its clients' requests and their side-information sets, then the number of packet transmissions required to satisfy all users' demands can be greatly reduced if the data is encoded before sending. The collection of side-information indices as well as the indices of the requested data is described as an instance of the index coding with side-information (ICSI) problem. The encoding function is called the index code of the instance, and the number of transmissions employed by the code is referred to as its length. The main ICSI problem is to determine the optimal length of an index code for and instance. As this number is hard to compute, bounds approximating it are sought, as are algorithms to compute efficient index codes. Two interesting generalizations of the problem that have appeared in the literature are the subject of this work. The first of these is the case of index coding with coded side information, in which linear combinations of the source data are both requested by and held as users' side-information. The second is the introduction of error-correction in the problem, in which the broadcast channel is subject to noise. In this paper we characterize the optimal length of a scalar or vector linear index code with coded side information (ICCSI) over a finite field in terms of a generalized min-rank and give bounds on this number based on constructions of random codes for an arbitrary instance. We furthermore consider the length of an optimal error correcting code for an instance of the ICCSI problem and obtain bounds on this number, both for the Hamming metric and for rank-metric errors. We describe decoding algorithms for both categories of errors.

We investigate some differential properties for permutations in the affine group, of a vector space V over the binary field, with respect to a new group operation $\circ$, inducing an alternative vector space structure on $V$ ., Comment: arXiv admin note: text overlap with arXiv:1411.7681

Most modern block ciphers are built using components whose cryptographic strength is evaluated in terms of their resistance to attacks on the whole cipher. In particular, differential properties of vectorial Boolean functions are studied for the S-Boxes to thwart differential cryptanalysis. Little is known on similar properties to avoid trapdoors in the design of the block cipher. In this paper we present a form of trapdoors coming from alternative vector space structures, which we call hidden sums, and give a characterization on the Boolean function S-Box to avoid any such hidden sum. We also study some properties of this new class of vectorial Boolean functions, which we call anti-crooked, and provide a toy cipher with a hidden sum trapdoor.

We extend the construction of GAG codes to the case of evaluation codes. We estimate the minimum distance of these extended evaluation codes and we describe the connection to the one-point GAG codes.