DeepAI
Log In Sign Up

C-differential bent functions and perfect nonlinearity

Drawing inspiration from Nyberg's paper <cit.> on perfect nonlinearity and the c-differential notion we defined in <cit.>, in this paper we introduce the concept of c-differential bent functions in two different ways (thus extending Kumar et al. <cit.> classical definition). We further extend the notion of perfect c-nonlinear introduced in <cit.>, also in two different ways, and show that, in both cases, the concepts of c-differential bent and perfect c-nonlinear are equivalent (under some natural restriction of the parameters). Some constructions of functions with these properties are also provided; one such construction provides a large class of PcN functions with respect to all c in some subfield of the field under consideration. We also show that both our classes of 0-differential bents are supersets of permutation polynomials, and that Maiorana-McFarland bent functions are not differential bent (of the first kind).

READ FULL TEXT VIEW PDF

page 1

page 2

page 3

page 4

04/24/2020

Investigations on c-Boomerang Uniformity and Perfect Nonlinearity

We defined in <cit.> a new multiplicative c-differential, and the corres...
04/27/2021

Several classes of PcN power functions over finite fields

Recently, a new concept called multiplicative differential cryptanalysis...
10/19/2020

Investigations on c-(almost) perfect nonlinear functions

In a prior paper <cit.>, two of us, along with P. Ellingsen, P. Felke an...
03/31/2020

Some c-(almost) perfect nonlinear functions

In a prior paper, along with P. Ellingsen, P. Felke and A. Tkachenko, we...
08/01/2022

Some new classes of (almost) perfect c-nonlinear permutations

The concept of differential uniformity was recently extended to the c-di...
06/04/2020

Non-lattice covering and quanitization of high dimensional sets

The main problem considered in this paper is construction and theoretica...
05/30/2020

The c-differential behavior of the inverse function under the EA-equivalence

While the classical differential uniformity (c=1) is invariant under the...

1 Introduction and basic definitions

We will introduce here only some basic notations and definitions on Boolean and -ary functions (where

is an odd prime); the reader can consult 

[2, 3, 4, 7, 18, 26] for more on these objects.

For a positive integer and a prime number, we denote by the

-dimensional vector space over

, and by the finite field with elements, while will denote the multiplicative group. For , we often write to mean the inverse of in the multiplicative group of the finite field under discussion. We use to denote the cardinality of a set and , for the complex conjugate. We call a function from (or ) to a -ary function on variables. For positive integers and , any map (or, ) is called a vectorial -ary function, or -function. When is fixed, we write for the vector space , or under consideration, and , for the -ary functions defined on with values in . If we write and , and if , we will drop the superscript, altogether. When , can be uniquely represented as a univariate polynomial over (using some identification, via a basis, of the finite field with the vector space) of the form whose algebraic degree is then the largest Hamming weight of the exponents with . To (somewhat) distinguish between the vectorial and single-component output, we shall use upper/lower case to denote the functions. For a -ary function , the Walsh-Hadamard transform is defined as the complex-valued function

where , for any , and is the absolute trace function, given by (we will denote it by , if the dimension is clear from the context). For , the map

is the Fourier transform of 

. The (vectorial) Walsh transform of an -function at is the Walsh-Hadamard transform of its component function at , that is,

NB: If one wishes to work with vector spaces, then one can replace the by any scalar product on that environment, for example, if , the vector space of the -tuples over we use the conventional dot product for .

In this paper, we will use both the absolute trace and the relative trace , defined as .

Given a -ary function , the derivative of with respect to  is the -ary function

The sum

is the crosscorrelation of at . The autocorrelation of at is above, which we denote by .

For an -function , and , we let . We call the quantity the differential uniformity of . If , then we say that is differentially -uniform. If and , then is called a perfect nonlinear (PN) function, or planar function. If and , then is called an almost perfect nonlinear (APN) function. It is well known that PN functions do not exist if . While most of the literature deals with -functions when it comes to differential uniformity, we see no reason why the concept (beyond its uses in -boxes, of course) cannot be considered for all -functions.

In [8] we defined a multiplier differential and the corresponding difference distribution table (in any characteristic). For an -function , and , and , the (multiplicative) -derivative of with respect to  is the function

We let the entries of the -Difference Distribution Table (-DDT) be defined by . We call the quantity

the -differential uniformity of  (while we previously worked with -functions, there is no reason why we should not consider general -functions in this definition). We extend here for general and the concepts that, in [8], were defined for :

If , then we say that is differentially -uniform (or that has -uniformity , or for short, has -uniform -DDT). If , then is called a perfect -nonlinear (PcN) function (certainly, for , they only exist for odd characteristic ; however, as proven in [8], there exist PcN functions for , for all ). If , then is called an almost perfect -nonlinear (APcN) function. When we need to specify the constant for which the function is PcN or APcN, then we may use the notation -PN, or -APN. It is easy to see that if is an -function, that is, , then is -PN if and only if is a permutation polynomial.

The rest of the paper is organized as follows. Section 2 and 3 introduce our two types of crosscorrelations/autocorrelations and define (naturally) the concepts of perfect -nonlinear and -differential bent functions in the context of -functions, and show that -differential bent functions correspond to perfect -nonlinear functions (we use indices to specify which type of bentness or perfect nonlinearity we refer to). Characterizations and some constructions of both concepts are provided. Section 4 concludes the paper.

2 The first crosscorrelation: -differential bent and perfect -nonlinear functions

In this section we extend the PcN notion to allow arbitrary -ary -functions. We shall recover some results shown in [8, 23] as particular cases.

As for the regular differentials, for and fixed , we define the -crosscorrelation at by

and the corresponding -autocorrelation at , . Surely, and ( can only be when ). We want to emphasize the -differentials, which is going to be relevant later as it relates to the perfect -nonlinear concept. (We do not want to complicate more the notation by using indices here, since it will be obvious which concept we refer to, because this autocorrelation has two input variables, while the second concept has only one input variable.)

Nyberg [21] extended the notion of perfect nonlinearity and called a function perfect nonlinear if its derivatives are balanced (i.e. they take every value the same number of times). Thus, the function’s (non-trivial) autocorrelation must be zero. Likewise, we now extend the definition of PcN, in the following way.

Definition 2.1.

For arbitrary positive integers , and an -function and fixed, we say that is perfect -nonlinear () if its -autocorrelation , for all , . A strictly perfect -nonlinear is a function for which all , for all , (obviously, strictly perfect -nonlinear functions do not exist for ).

NB: We removed from the domain, since in that case the autocorrelation of any function is constant, .

Surely, if the -derivatives are balanced, that is, if , at every fixed , assumes the same value for exactly values of , then is perfect -nonlinear (similarly, at every fixed for strictly perfect -nonlinear functions). Later we show that a function is perfect -nonlinear if and only if the traces of the -differentials are balanced. It is clear that PcN functions (for ) are strictly perfect -nonlinear functions, and of course, one wonders about the converse (again, for ). If all the traces of multiples of -differentials are balanced and so, for all , the sum

for all , where and is the canonical additive character of , then, by [13, Theorem 7.7], must be a permutation, hence is PcN.

A known result for classical Boolean functions, was extended in [24] for generalized Boolean functions (that is, functions defined from into , where ), and a corresponding result connecting our definition of -crosscorrelation to the Walsh transforms of general -ary functions, holds, as well.

Lemma 2.2.

Let be a prime number and be nonzero positive integers. If and , then for all , we have

(1)

In particular, if , then

Proof.

We start with

For the second identity, we reverse the argument, and obtain

The claimed consequences are immediate. ∎

We know that the bent notion exists from any group to another group  [22], defined via character theory. There are many generalizations of the bent concept and we mention here [9, 10, 11, 14, 15, 16, 17, 19, 20, 24, 25, 28, 29]. For example, a -ary function is bent if the complex absolute value of the Walsh transforms is constant, namely, , for all . In that spirit, for , we define a new bent concept below that takes into account the differential type used.

Definition 2.3.

We say that a function is -differential bent if , for all .

Below, we will show that a function is -differential bent if the traces of all of its -differentials, with , are balanced, thereby extending Nyberg’s result [21] on perfect nonlinearity being equivalent to bentness for functions defined from into . We can also regard it as an extension of the PcN property we defined (for ) in [8].

Theorem 2.4.

Let be integers, prime, and , . Then is perfect -nonlinear if and only if is -differential bent. Moreover, is strictly perfect -nonlinear if and only if , for all .

Proof.

We first assume that is perfect -nonlinear, and so, , for all and . From Lemma 2.2, for an arbitrary , we compute

where we used the assumption that the -autocorrelations are zero, except, possibly, at .

For the reciprocal, we assume that is -differential bent, that is, , . Then, for any and ,

where we used the same property that the exponential sum of a balanced function (in this case , for ) is zero. This proves the first claim. The second claim follows easily using the equations above. ∎

We now discuss some of the differential properties of a perfect -nonlinear function.

Theorem 2.5.

Let be positive integers, a prime integer, , and fixed. Then is a perfect -nonlinear function (-differential bent) if and only if, for all fixed, is balanced.

Proof.

With constant, for every , , we let . We will use below that the order of the cyclotomic polynomial of index is .

First, recall that the -cyclotomic polynomial is . In particular, we deduce that . If , and is perfect -nonlinear, then

The extension has degree and the elements in following set are linearly independent in over , therefore the coefficients in the displayed expression are zero, that is, that for all , . Summarizing, for any , the cardinality of the set is independent of , and so, for all fixed, the function is balanced.

If is balanced, by reversing the argument, we find that is perfect -nonlinear. ∎

As a consequence, we can easily characterize the -differential bent functions.

Corollary 2.6.

Let . The following statements are equivalent:

  • is a -differential bent (perfect -nonlinear) function;

  • , for all ;

  • (Under ) is a permutation polynomial.

Proof.

When , for fixed, the map is balanced if and only if is balanced (since is a bijection on the input set ). Under , using [13, Theorem 7.7], this is equivalent to being a permutation polynomial. ∎

Thus, if and is a permutation of , then is 0-differential bent (since in this case, is PcN for  [8]). We give below another example of -differential bent functions on , for all . , a linearized monomial on , we compute

which is balanced, if . Thus, any linearized monomial is a (strictly) perfect -nonlinear function, for all . In fact, given any linearized polynomial , for which is balanced, then is a (strictly) perfect -nonlinear function, for all . Thus, this class of perfect -nonlinear functions is a superclass of linearized polynomials whose trace is balanced, and, furthermore, when , is a superclass of permutation polynomials.

Surely, the question is whether there are other examples. We ran a SageMath code and found some (strictly) perfect -nonlinear (-differential bent) functions on small dimensions that are not linearized polynomials. For instance, is perfect -nonlinear on ; is (strictly) perfect -nonlinear on and (strictly) perfect -nonlinear on ; is perfect -nonlinear for all in ; is (strictly) perfect -nonlinear on . From our first two examples (and several more of that type), we see that the Gold function is not always -differential bent for small values of , and so, we wondered what happens, in general. The answer is provided by [8, 23] for the Gold function. However, we can show a more general result, which, as a consequence, implies also the behavior of the Gold function. We could not adapt the methods from [8] to show the theorem, so we provide here an alternative method that proves quite useful to show several results at once.

Theorem 2.7.

Let be a prime number, a positive integer and , a monomial function. If , then is -differential bent. If , then is not -differential bent.

Proof.

If , then,

using the fact that is a permutation if , so if covers , then does the same, therefore showing the first claim.

To show the second claim, by Corollary 2.6, if were -differential bent, then . Assuming , then we have the identity between the following Gaussian sums

(we use here the fact that under , then , which can be seen by making the change of variable ). By [13, Theorem 5.33], we know that if , , then the Gaussian sum

where is the quadratic character of and is a nontrivial additive character of . In our case , and so, our previous displayed sum is equal to (using further [13, Theorem 5.15])

From this last identity, we see that we cannot have , if , and so, cannot be -differential bent. ∎

The following are some important corollaries (we use [8, Lemma 9]: if , then and, if , then , when odd; also, when is even, is odd, , then ). Note that Corollary 2.8 is also a consequence of [8, Theorem 10 ] and [23].

Corollary 2.8.

Let positive integers with odd and be defined on , an odd prime. Then is not -differential bent. If , then is -differential bent.

The Gold function is not the only function for which we have this type of result. The Coulter-Matthews [6] PN function is yet another example of a function that is not -differential bent (hence not perfect -nonlinear), under some conditions, and it is -differential bent, under some other conditions (see [8, 23] for a general result on the function and its differential uniformity).

Corollary 2.9.

Let , odd, (so, ). Then is not -differential bent. If are such that , then is -differential bent.

We can generate classes of -functions that are -differential bent in the following way. We take to be a PcN function on with respect to , a proper subfield of (that is, , ). We then define . First, observe that since , then . Now, if is a permutation (using our assumption), then is balanced, and so is , for . We now use the fact that multiplication by simply shuffles the output. What we mean is that with notations, , and , where ( is a primitive element of ), then, writing , the partition corresponding to is now . Using this and the transitivity of the traces, then is also balanced. We record this in the next proposition.

Proposition 2.10.

Let , , and prime. If is PcN on with respect to , then is -differential bent.

It is obvious that not all -differential bent functions from come from traces of permutations on (we can see that by taking a trace function of a PcN , as above, and then interchanging output points with the same trace output value). More precisely, we take ( is a primitive element of ) and random , , as above. We now define , unless , when , if and , if .

Classical (binary) bent functions do not transfer easily in this generalized bent context. To argue that claim, we next show that Maiorana-McFarland bents cannot be -differential bent for .

Proposition 2.11.

Let . Let be a (bent) Maiorana-McFarland -function defined by