 # Constructions of involutions over finite fields

An involution over finite fields is a permutation polynomial whose inverse is itself. Owing to this property, involutions over finite fields have been widely used in applications such as cryptography and coding theory. As far as we know, there are not many involutions, and there isn't a general way to construct involutions over finite fields. This paper gives a necessary and sufficient condition for the polynomials of the form x^rh(x^s)∈_q[x] to be involutions over the finite field _q, where r≥ 1 and s | (q-1). By using this criterion we propose a general method to construct involutions of the form x^rh(x^s) over _q from given involutions over the corresponding subgroup of _q^*. Then, many classes of explicit involutions of the form x^rh(x^s) over _q are obtained.

## Authors

##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1 Introduction

Let be a power of a prime. Let be a finite field with elements and denote its multiplicative group. A polynomial is called a permutation polynomial if its associated polynomial mapping from to itself is a bijection. Moreover, is called an involution if the compositional inverse of is itself. Permutation polynomials over finite fields have been extensively studied due to their wide applications in cryptography, coding theory and combinatorial design theory. So, finding new classes of permutations with desired properties is of great interest in both theoretical and applied aspects, and also a challenging task. In many situations, both the permutation polynomials and their compositional inverses are required. For example, in many block ciphers, a permutation has been used as an S-box for providing confusion during the encryption process. While decrypting the cipher, the compositional inverse of the S-box comes into the picture. Thus, it is advantageous for the designer if both the permutation and its compositional inverse have efficient implementations. This motivates the use of involutions in the S-box of block ciphers. One practical advantage of involutions is that the implementation of the inverse does not require additional resources, which is particularly useful (as part of a block cipher) in devices with limited resources.

Involutions have been used widely in block cipher designs, such as in AES , Khazad, Anubis  and PRINCE . For instance, the inverse function over used in the S-box of AES is an involution. In PRINCE, a linear involution (denoted by  ) was used to ensure -reflection property. More typically, in Midori  and iSCREAM , non-linear involutions were used to provide both encryption and decryption functionalities with minimal tweaks in the circuit. Recently, Canteaut and Roué have shown that involutions were the best candidates against several cryptanalytic attacks by analysing the behaviors of the permutations of an affine equivalent class with respect to these attacks . Involutions have been also used to construct Bent functions over finite fields  and to design codes. For instance, Gallager used an involution (called Gallager’s involution transform) to update check nodes to obtain low-complexity hardware implementation of the sum product algorithm which was used for decoding .

To the best of our knowledge, there are not many known involutions over finite fields. Recently, Charpin, Mesnager and Sarkar  firstly discussed Dickson involutions over finite fields of even characteristic. Then, they  investigated monomial involutions and linear involutions, and proposed an approach to constructing involutions from known involutions over the finite field . Rubio et. al.  further discussed monomial involutions and their fixed points. Very recently, Fu and Feng  investigated involutory behavior of all known differentially 4-uniform permutations over finite fields of even characteristic, and most of them were not involutions. To date, primary constructions of involutions over finite fields seems far from enough.

It is known that every polynomial over can be written as for some , , and [3, 27]. Due to the importance of the polynomials of the form , Wan and Lidl  first gave a criterion for permutation polynomials of this type. Then, Park and Lee, Wang and Zieve proposed a more concise criterion for permutation behavior of polynomials of the form  [22, 26, 31], respectively. By using this criterion, many classes of permutation polynomials of the form have been constructed [2, 11, 15, 16, 17, 18, 19, 20, 21, 24, 26, 29, 31, 32]. But the previous woks were not involved involutory behavior of the polynomials of this type. This paper proposes a criterion for involutions of polynomials of the form  by the piecewise representation of functions, and a general method to construct involutions of this form over from given involutions over the corresponding subgroup of . Then, many classes of involutions over are obtained.

The remainder of this paper is organized as follows. In Section 2, we give a necessary and sufficient condition for being an involution over and propose a general method to construct involutions of the form over from a given involution over the corresponding subgroup of . Section 3 presents explicit involutions of the form over from the inverse involution over the subgroup of . In Section 4 we construct involutions of the form over from some special over . Section 5 discusses the constructions of involutions over finite fields from those on their subfields. Finally, we conclude this paper in Section 6.

## 2 A general construction of involutions over finite fields

Throughout this paper let be a power of a prime, and be divisors of such that . Let be a finite field with elements and denote the set of th roots of unity in , i.e.,

 μd={x∈F∗q|xd=1},

which is also the unique cyclic subgroup of of order . This subgroup can also be represented as . It is easy to verify that

 F∗q=d⋃i=1Sαi,Sαi={x∈F∗q|xs=αi},

where for . The following well-known lemma gives a necessary and sufficient condition for being a permutation over .

###### Lemma 2.1

 Let be positive integers with . Let . Then permutes if and only if both

1. gcd and

2. permutes .

Next we give a criterion for involutions of the form for , and . From above discussions we can express in the form of piecewise functions as

 (1)

where , . From the piecewise functional representation we obtain a necessary and sufficient condition for being an involution over .

###### Theorem 2.2

Let be positive integers with . Let for some polynomial . The polynomial is an involution over if and only if

1.    and

2. for all .

Proof. Following notation introduced above, we know that , where . If , i.e., , then

 (h(αi)xr)s=h(αi)sxsr=h(αi)sαri=g(αi).

So, . From (1) we obtain that

 f∘f(x)=⎧⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪⎨⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪⎩0,x=0,h(g(α1))h(α1)rxr2,x∈Sα1,⋮h(g(αi))h(αi)rxr2,x∈Sαi,⋮h(g(αd))h(αd)rxr2,x∈Sαd. (2)

If and for all , then from (2) we have for ,

 f∘f(x)=h(g(αi))h(αi)rxr2=h(g(αi))h(αi)rxsr2−1sx=h(g(αi))h(αi)rαr2−1six=x.

This shows that is an involution over .

Conversely, if is an involution over , then for each and any , from (2) we have

 h(g(αi))h(αi)rxr2=x. (3)

Let be another element of , then

 h(g(αi))h(αi)rβr2=β. (4)

From (3) and (4), we get . When runs over , then runs over . So, . With this condition, from (3) we have for any ,

 1=h(g(αi))h(αi)rxr2−1=h(g(αi))h(αi)rxsr2−1s=h(g(αi))h(αi)rαr2−1si=φ(αi).

###### Corollary 2.3

Let and for some positive integer and . If is an involution over , then is an involution over the subgroup .

Proof. It is easy to verify that for any . If is an involution over , then for any , one has

 xs=xs∘(f(x)∘f(x))=(xs∘f(x))∘f(x)=g(x)∘xs∘f(x)=g(x)∘g(x)∘xs.

This shows that is an identity over , i.e., is an involution on this subgroup of order .

###### Remark 2.4

In general, being an involution over can not imply being an involution over . But in some special cases, Theorem 5.1 in Section 5 presents the similar result on involutory behavior of as that in Lemma 2.1.

To obtain involutions of the form over , it is crucial to find a suitable . From Corollary 2.3, is necessary to be an involution on the subgroup of for being an involution on . Next, we give a general method to determine the coefficients of from a given involution over .

Let be a primitive element of and be a generator of the subgroup . Let be an involution over , which is represented by

 σ=(1ω⋯ωi⋯ωd−1ωℓ0ωℓ1⋯ωℓi⋯ωℓd−1)=(ωℓ0ωℓ1⋯ωℓi⋯ωℓd−11ω⋯ωi⋯ωd−1),

where is a rearrangement of . Assume that the polynomial as a mapping on is the same as on it, i.e, for ,

 {g(ωi)=ωirh(ωi)s=ωℓi,g(ωℓi)=ωℓirh(ωℓi)s=ωi. (5)

Since , from (5) there are some and with such that

 {h(ωi)=αdni+ℓi−ir,h(ωℓi)=αdnℓi+i−ℓir, (6)

where . By Theorem 2.2 and equalities (5) and (6), the polynomial is an involution over if and only if the following equalities hold:

 ⎧⎪ ⎪ ⎪⎨⎪ ⎪ ⎪⎩r2≡1mods,φ(ωi)=ωir2−1sh(ωℓi)h(ωi)r=αd(nℓi+rni)=1,φ(ωℓi)=ωℓir2−1sh(ωi)h(ωℓi)r=αd(ni+rnℓi)=1,

where . This is equivalent to

 {r2≡1mods,nℓi+rni≡0mods, (7)

since is equivalent to due to . It is verified that there exist integers satisfying (7) for . Let be a reduced polynomial modulo . Denote by

Since is a Vandermonde matrix, from (6) the coefficients of can be uniquely derived from the following linear equations

 AH=Λ. (8)

In summary, we have the following theorem.

###### Theorem 2.5

Let be a rearrangement of . Let be numbers with for . Let  be a primitive element of and be a generator of the subgroup of . Let , whose coefficients are determined by (8). Then is an involution over if and only if (7) holds.

## 3 Involutions from the inverse over the subgroup of F∗q

In this section we will give an explicit construction of involutions over from the inverse involution over the subgroup of . To this end, we first discuss a special case that having at most two elements. In this case, and is viewed as the inverse of modulo if is even. Then, in (1) is rewritten as

 f(x)=xrh(xs)=⎧⎨⎩0,x=0,axr,x∈S1,bxr,x∈S−1, (9)

where , and .

If , then is a monomial over . Theorem 2.2 implies that is an involution over if and only if

1. ,

2. .

This is exactly Proposition 3.1 in  if is even. When , in (9) can be rewritten as the following form,

 f(x)=a−b2xq−12+r+a+b2xr. (10)

By Theorem 2.2, we have the following proposition.

###### Proposition 3.1

Let

be a power of an odd prime. Let

be a finite field and with . The polynomial in (10) is an involution over if and only if

1. ,

2. and .

###### Example 3.2

In Proposition 3.1, let and and for some non-square element in . It is easy to check that conditions (1) and (2) hold. Then the polynomial is an involution over .

Next, we discuss the case that the subgroup of has at least elements. It is clear that the inverse over is an involution, which can be represented as

 σ=(1ω⋯ωi⋯ωd−11ωd−1⋯ωd−i⋯ω).

Assume that the polynomial as a mapping over is the same as on it. Then the equalities in (5) are as follows,

 g(ωi)=ωirh(ωi)s=ωd−i,i=0,1,…,d−1. (11)

From (11) we obtain that

 h(1)=αdn0andh(ωi)=αdni+d−i−ir,i=1,2,…,d−1. (12)

where . Similarly to that in Theorem 2.5, the polynomial is an involution over if and only if the following equalities hold:

 ⎧⎪ ⎪⎨⎪ ⎪⎩r2≡1mods,φ(1)=h(1)r+1=αdn0(r+1)=1,φ(ωi)=ωir2−1sh(ωd−i)h(ωi)r=αd(nir+nd−i)=1,i=1,2,…,d−1.

This is equivalent to

 ⎧⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪⎨⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪⎩r2≡1mods,n0(r+1)≡0mods,n1r+nd−1≡0mods,⋯⋯n⌊d2⌋r+n⌈d2⌉≡0mods, (13)

where . Let be a reduced polynomial modulo . The linear system (8) becomes

 ⎛⎜ ⎜ ⎜ ⎜ ⎜ ⎜⎝11⋯11ω⋯ωd−11ω2⋯ω2(d−1)⋯⋯1ωd−1⋯ω(d−1)(d−1)⎞⎟ ⎟ ⎟ ⎟ ⎟ ⎟⎠⎛⎜ ⎜ ⎜ ⎜ ⎜ ⎜ ⎜⎝[]ch0h1h2⋮hd−1⎞⎟ ⎟ ⎟ ⎟ ⎟ ⎟ ⎟⎠=⎛⎜ ⎜ ⎜ ⎜ ⎜ ⎜ ⎜⎝αdn0αdn1+d−1−rαdn2+d−2−2r⋮αdnd−1+1−(d−1)r⎞⎟ ⎟ ⎟ ⎟ ⎟ ⎟ ⎟⎠. (14)

In summary, we have the following theorem.

###### Theorem 3.3

Let be a power of a prime, and be divisors of such that . Let  be a primitive element of and be a generator of the subgroup  of . Let , whose coefficients are determined by the linear system (14). Then is an involution over if and only if (13) holds.

Assume that and the subgroup of has exact elements, i.e, . Then the condition (13) is reduced to

 ⎧⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪⎨⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪⎩r2≡1modq−13,n0(r+1)≡0modq−13,n1r+n2≡0modq−13. (15)

By solving the corresponding linear system (14) we get

 ⎧⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪⎨⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪⎩h2=(2+ω2)α3n0−(1+2ω2)α3n1+2−r−(1−ω2)α3n2+1−2r3(1−ω),h1=(2+ω)α3n0−(1+2ω)α3n1+2−r−(1−ω)α3n2+1−2r3(1−ω2),h0=α3n0+α3n1+2−r+α3n2+1−2r3. (16)
###### Proposition 3.4

Let be a power of a prime with , be a primitive element of and be a primitive cubic root of unity. Let , where and are given in (16). Then is an involution over if and only if (15) holds.

Let for a positive integer and be a primitive element of . Let be the cubic root of unity in . Set . From (15) we get that

 n0=0andn1+n2≡0modq−13.

Let for . Substituting these into (16) we get

 h2=1+ωβ+ω2β−1,h1=1+ω2β+ωβ−1,h0=1+β+β−1.

From Proposition 3.4 we have

###### Corollary 3.5

With notation introduced above, is an involution on .

###### Example 3.6

Let , be a primitive element of and be the cubic root of unity in . Set , where and

 h2=1+ωβ+ω2β−1,h1=1+ω2β+ωβ−1,h0=1+β+β−1.

Magma verifies that is an involution on for any . This experimental result coincides with that of Corollary 3.5.

Let and be a primitive element of . Let and . It is easy to verify that integers with and satisfy (15). Substituting these into (16) we get

 h2=α3n0,h1=h0=α3n0+α3(n1+1),

where . From Proposition 3.4 we obtain

###### Corollary 3.7

With notation introduced above, is an involution on .

###### Example 3.8

Let and be a primitive element of . Set

 h2=α3u,h0=α3u+α3(v+1)andfu,v(x)=h2xq−2+h0(x2q−53+xq−43),

where . Magma verifies that is an involution over for any . This experimental result coincides with that of Corollary 3.7.

## 4 Involutions from monomial mappings over the subgroup of F∗q

In this section, we will construct more explicit involutions over from some special , which as a mapping over the subgroup of is the same as a monomial mapping on it.

###### Theorem 4.1

Let be a power of a prime and be an integer with . Let satisfy that for any ,

 βr2−1q−1h(βr)=h(β)∈Fq. (17)

If for any , then is an involution over .

Proof. It is clear that . By Theorem 2.2, we only need to show that for any . Note that and . From (17) we have

 φ(β) =βr2−1q−1h(g(β))h(β)r =βr2−1q−1h(βr)h(β)r+1h(β)−1 =βr2−1q−1h(βr)h(β)−1 =1.

This completes the proof.

###### Remark 4.2

With notation introduced in Theorem 4.1, moreover we assume that . The polynomial satisfies the condition (17), where

 Ω={0≤i≤q|(r+1q−1+i)(r−1)≡0modq+1}.
###### Corollary 4.3

Let be a power of an odd prime, and , where . Then

 f(x)=xrh(xs)=xq2−q−1h(xq−1)=bxq2+(i−1)q−1−i+bqx(1+i)q2−(1+i)q−1

is an involution on if one of the following condition hold:

• and is an square element in ;

• and is a non-square element in .

Lemma 2.1 shows that permutes if and only if and permutes the subgroup of , where . So, it is interesting to find the collections of polynomials which permute for certain values of . Zieve [31, 32] proposed a method to construct permutations of the form over . Thus, several classes of permutations of the form over were obtained. Following this technique proposed by Zieve in [31, 32] we obtain many classes of involutions of the form over by careful choices of .

###### Theorem 4.4

Let be a prime power. Let and be integers with . Let and be an integer with , and with . Let be a polynomial with

 (18)

If has no root in , then is an involution over