DeepAI

# Low c-differential uniformity for functions modified on subfields

In this paper, we construct some piecewise defined functions, and study their c-differential uniformity. As a by-product, we improve upon several prior results. Further, we look at concatenations of functions with low differential uniformity and show several results. For example, we prove that given β_i (a basis of 𝔽_q^n over 𝔽_q), some functions f_i of c-differential uniformities δ_i, and L_i (specific linearized polynomials defined in terms of β_i), 1≤ i≤ n, then F(x)=∑_i=1^nβ_i f_i(L_i(x)) has c-differential uniformity equal to ∏_i=1^n δ_i.

• 20 publications
• 6 publications
• 16 publications
• 24 publications
03/31/2020

### Some c-(almost) perfect nonlinear functions

In a prior paper, along with P. Ellingsen, P. Felke and A. Tkachenko, we...
04/03/2019

### Tropical Differential Groebner Basis

In this paper, the tropical differential Gröbner basis is studied, which...
03/14/2022

### Low c-Differential Uniformity of the Swapped Inverse Function in Odd Characteristic

The study of Boolean functions with low c-differential uniformity has be...
08/10/2020

### On construction and (non)existence of c-(almost) perfect nonlinear functions

Functions with low differential uniformity have relevant applications in...
02/04/2022

### Investigations of c-Differential Uniformity of Permutations with Carlitz Rank 3

The c-differential uniformity is recently proposed to reflect resistance...
05/06/2020

### Algorithmic Averaging for Studying Periodic Orbits of Planar Differential Systems

One of the main open problems in the qualitative theory of real planar d...
12/03/2019

### Improving upon NBA point-differential rankings

For some time, point-differential has been thought to be a better predic...

## 1 Introduction and basic definitions

Let be a prime number and be a positive integer. We let be the finite field with elements, and be its multiplicative group.

We call a function from (or ) to a -ary function on variables. For positive integers and , any map (or ) is called a vectorial -ary function, or an -function. When , can be uniquely represented as a univariate polynomial over of the form , whose algebraic degree is then the largest weight in the -ary expansion of (that is, the sum of the digits of the exponents ) with .

Motivated by [4], who extended the differential attack on some ciphers by using a new type of differential, in [10], the authors introduced a new differential and Difference Distribution Table, in any characteristic, along with the corresponding perfect/almost perfect -nonlinear functions and other notions (this was also developed independently in [2] where the authors introduce the concept of quasi planarity). In [1, 10, 11, 15], various characterizations of the -differential uniformity were found, and some of the known perfect and almost perfect nonlinear functions have been investigated.

For a -ary -function , and , the (multiplicative) -derivative of with respect to  is the function

 cDaF(x)=F(x+a)−cF(x), for all x∈Fpn.

For an -function , and , we let the entries of the -Difference Distribution Table (-DDT) be defined by . We call the quantity

 δF,c=max{cΔF(a,b):a,b∈Fpn, and a≠0 if c=1},

the -differential uniformity of . If , then we say that is differentially -uniform (or that has -uniformity ). If , then is called a perfect -nonlinear (PcN) function (certainly, for

, they only exist for odd characteristic

; however, as proven in [10], there exist PcN functions for , for all ). If , then is called an almost perfect -nonlinear (APcN) function. It is easy to see that if is an -function, that is, , then is PcN if and only if is a permutation polynomial.

For , we recover the classical derivative, PN, APN, differential uniformity and DDT.

In the last years, several constructions of low differentially uniform permutations have been introduced by modifying some functions on a subfield (see for instance [6, 14, 21, 22]). In this work we will extend some of the results given in [6] to the case of the -differential uniformity. From this generalization, we are also able to improve the upper bound obtained in [18] for the case of a Gold APN function in even characteristics.

## 2 An upper bound on the differential uniformity of a piecewise defined function

Here, we shall give a general result concerning an upper bound for the -differential uniformity of a piecewise defined function, thus generalizing a result of [6].

Before considering the case of the -differential uniformity, we will give a property for some functions having when . Indeed, recently in [8], Carlet noticed that for an APN function defined on an extension , with odd, we have that the equation does not admit solutions , whenever and . This result can be extended to the case of differentially -uniform functions.

###### Proposition 2.1.

Let , with odd, and let be a differentially -uniform function over . Then, does not admit solutions , whenever .

###### Proof.

Let us consider . Let us denote by , , , and the four solutions of .

Suppose that one of this solutions is not in . Let us assume .

Note that the polynomial has all coefficients in , so if is a zero of the polynomial, so is . That means that is equal to , , , or .

Suppose . Then, , reaching a contradiction.

Suppose . Then, we have , implying that (since is odd), which gives us a contradiction.

Consider, now, the case ( is similar). Then, we can have 4 different cases.

Case . : This would imply , which is not possible.

Case . : We would have and thus , not possible.

Case . : From this, we obtain and thus , which is not possible.

Case . : In this case, we get that , so we have , implying which gives us a contradiction. ∎

In the same way, we can prove the following generalization:

###### Proposition 2.2.

Let , where and are integers, and let be a differentially -uniform function over , with . If is not divisible by any integer , then does not admit solutions , whenever .

###### Remark 2.3.

We restrict to for ease of notation with the constrain , but the result is true for if is odd, as proven in [8].

###### Proof.

Let us consider . Without loss of generality, we can suppose that the equation admits solutions, that can be denoted by . Suppose and consider the set . This last equality holds since the polynomial has all coefficients in , if is a solution, then also is a solution.

Now, if , then there exists such that , implying , which gives us a contradiction.

If , consider . We have , and there must exists for which there exist such that . Indeed, consider the sequence

 x1,x2s1,…

and suppose that for all the pairs in this sequence we cannot have , for . Then, up to relabeling the solutions, we would have that the first elements of the sequence are

 x1,x2(=x2s1),…,xk.

Now, for the next element we need to have one among . So, we would obtain a pair for which there exists such that . Therefore, for some and so , implying , contradiction. ∎

From Proposition 2.2, we can simplify Theorem 4.1. from [6] for some dimensions.

###### Theorem 2.4.

Let , where and are integers. Let and be two polynomials with coefficients in , that is, , and permuting . Suppose that is a -uniform function over and is a -uniform function over , and is not divisible by any integer , where . Then, the function

 F(x)=f(x)+(f(x)+g(x))(x2s+x)2n−1={f(x), if x∈F2s,g(x), if x∉F2s,

is such that

 1ΔF(a,b)≤{max{δf,1,δg,1},%if$a∈F2s$,δg,1+2, if a∉F2s.

From Theorem 2.4, we have that all the results given in [6] for the differentially -uniform Gold and Bracken-Leander functions can be extended to other functions, such as the differentially -uniform Kasami function. Indeed, the assumption on the solutions of the derivatives of the modified function is needed for applying Theorem 4.1 in [6]. In particular, we have the following.

###### Theorem 2.5.

Let , with even such that and are odd. Let be such that and , where and are affine permutations over . Then

 F(x)=f(x)+(f(x)+x22k−2k+1)(x2s+x)2n−1={f(x), if x∈F2s,x22k−2k+1, if x∉F2s,

is a differentially -uniform permutation over . Moreover, if then the algebraic degree of is . Moreover, the nonlinearity of is at least .

###### Proof.

The proof follows in a similar way as in [6, Theorem 4.2, Proposition 4.1]. ∎

Theorem 4.1 in [6] can be extended to the case of -ary functions and . In the following result, we do not request any condition on the solutions of the derivatives of our functions. Furthermore, we shall consider piecing more than two functions, but we prefer to state the result for two functions separately since it is the usual subfield modification, and the general case will be more evident.

###### Theorem 2.6.

Let is a prime, be an integer, be a divisor of , fixed, and be a -ary -function defined by

 F(x)={f(x), if x∈Fps,g(x), if x∉Fps,

where is an -function of -differential uniformity (for all ) and is an -function of -differential uniformity (for all ). Then, the -differential uniformity of is

 δF,c≤{δf,0+δg,0, if c=0,max{δf,c1+δg,c,δg,c+2psδg,0}, if c≠0,

where , with and is a basis of the extension over .

More generally, let , , , , be a sequence of integer divisors, and , , be some -functions of -differential uniformity (for all ). Further, let be fixed, and be a -ary -function defined by

 Ft(x)=⎧⎪ ⎪ ⎪ ⎪⎨⎪ ⎪ ⎪ ⎪⎩f1(x), if x∈Fpk1,f2(x), if x∈Fpk2∖Fpk1,⋯⋯⋯⋯ft(x), if x∈Fpkt∖Fpkt−1.

Then, the -differential uniformity of is

 δFt,c≤δfn,c+t−1∑i=1max{δfi,c(i),2pkit−i−1∑j=1δfj,0},

where are the projections of onto , via some bases of over .

NB: Note that, if , we have , and .

###### Proof.

We first observe that the polynomial representation of is (here, we consider the embedding of as an -function, by taking for ). We consider the -differential equation, , of at ,

 f(x+a)+(g(x+a)−f(x+a))(xps−x+aps−a)pn−1−cf(x)−c(g(x)−f(x))(xps−x)pn−1=b. (1)

If , the equation is either , or , depending upon being in or not. The first claim follows.

If , we consider several cases.

Case . Let . If , Equation (1) becomes

 f(x+a)−cf(x)=b.

Since is an extension of degree over , we can write and , where and is a basis of the extension. Then, the equation above becomes

 f(x+a)−(m∑i=1cigi)f(x)=m∑i=1bigi,

which implies

 f(x+a)−c1f(x)=b1 and cif(x)=bi ∀i=2,…,m.

This gives a (probably loose, though the

, and therefore the , go through all values) bound for the number of solutions given by .

NB: Note that, if , we have , and this bound becomes .

If , Equation (1) transforms into

 g(x+a)−cg(x)=b,

which has at most solutions. Therefore, in this case we get at most solutions for (1).

Case . Let . If , then Equation (1) becomes

 f(x+a)−cg(x)=b. (2)

We raise Equation (2) to the power and get (using the fact that , since and is an -function), , which combined with (2) renders

 g(x)−cps−1g(x)ps=bps−bc. (3)

The polynomial is a linearized polynomial whose kernel is of dimension . Thus, there are at most (since for any root of , there are at most values of such that ) solutions to Equation (3).

Next, if , then (1) becomes , and an argument similar to the one above gives

 g(x+a)ps−cps−1g(x+a)=bps−cps−1b,

with at most solutions.

It remains to consider . In this case, Equation (1) transforms into , which has at most solutions. Putting these counts together, we obtain the first claim of the theorem.

For the general case, we use induction on . The case of was treated in the first part of the proof, and the general case follows similarly.

If , the same argument as before will show that . Using the notation

 Ft−i+1(x)=⎧⎪ ⎪ ⎪ ⎪⎨⎪ ⎪ ⎪ ⎪⎩fi(x), if x∈Fpki,fi+1(x), if x∈Fpki+1∖Fpki,⋯⋯⋯⋯ft(x), if x∈Fpkt∖Ft−1,

and applying the induction assumption, we find that

 δFt,c≤δFt−1,c+max{δf1,c(1),2pk1δFt−1,0},

if . By the first part of the proof, . Moreover, , and by iteration we see that

 δFt,c≤δfn,c+t−1∑i=1max{δfi,c(i),2pkit−i−1∑j=1δfj,0}.

The proof is done. ∎

###### Remark 2.7.

In the proof above, if , when we can get: for the case at most solutions; and for the case , we get at most solutions. Indeed, from Equation (2) we would have (recalling that )

 g(x)ps−1cps−1g(x)=g(x+a−aps)−1cps−1g(x)=b−bpscps.

The number of solutions such that is upper bounded by . The same for the case and . So, we have that for , .

Surely, there are other ways of piecing a function together, and we look at such a way below.

###### Theorem 2.8.

Let is a prime, be an integer, , and . Let fixed, and be a -ary -function defined by

 F(x)=⎧⎪⎨⎪⎩f(x), if x∈Fpt,g(x), if x∈Fps∖Fpt,h(x), if x∉(Fps∪Fpt),

where is a -function of -differential uniformity (for all ), is an -function of -differential uniformity (for all ), and is an -function of -differential uniformity (for all ). Then, the -differential uniformity of is

 δF,c≤⎧⎪ ⎪ ⎪ ⎪⎨⎪ ⎪ ⎪ ⎪⎩δf,0+δg,0+δg,0, if% c=0,max{δf,c1+δg,c′1+δh,c,δf,c1+2psδh,0+δh,c,1+ptδh,0+min{ptδg,0,psδf,0}+δg,c′1+δh,c,(2pt+2ps)δh,0+δh,c}, if c≠0,

where , with , and , are bases of the extension over , respectively, over .

###### Proof.

We need to investigate the number of solutions of

 F(x+a)−cF(x)=b.

If , for any , the equation is either , or . The first claim follows.

Let now and . In this case, , and we distinguish three cases:

Case . : In this case, the equation is

 (1−c)f(x)=b.

As in the proof of Theorem 2.4, this implies that the number of solutions is upper bounded by , where , where and is a basis of the extension of over .

Case . : In this case, the equation is

 (1−c)g(x)=b.

Similarly as in case 1), the number of solutions is upper bounded by , where , where and is a basis of the extension of over .

Case . : In this case, the equation is

 (1−c)h(x)=b.

The upper bound is here .

Let now and . We can distinguish four cases:

Case . , : In this case the equation is

 f(x+a)−cf(x)=b.

As in the proof of Theorem 2.4, this implies that the number of solutions is upper bounded by , where , where and is a basis of the extension of over .

Case . , : In this case, the equation is

 h(x+a)−cg(x)=b.

Raising to the power and subtracting, we obtain the equation

 (h(x+a))ps−cps−1h(x)=bps−cps−1b,

which has as a solution set (note that, if , , and, if , , so this covers all cases (with nonzero )). The number of solutions is thus upper-bounded by .

Case . , : In this case, the equation is

 g(x+a)−ch(x)=b.

By similar arguments as the previous case, we obtain the bound .

Case . : In this case, the equation is

 h(x+a)−ch(x)=b,

so we have at most .

Let now . We have now five cases:

Case . , . In this case, the equation is

 g(a)−cf(0)=b,

which will be true for some .

Case . , : In this case, the equation is

 h(x+a)−cf(x)=b,

so we have at most solutions.

Case . , : this case is only possible if . Here the equation is

 f(x+a)−cg(x)=b.

If we raise to , we see that the number of solutions is upper-bounded by . However, raising to , we obtain an upper bound of . From this case, then, we get min.

Case . : Here the equation is

 g(x+a)−cg(x)=b,

which gives an upper bound of for the number of solutions, where , with and is a basis of the extension of