## 1 Introduction

Block ciphers use substitution boxes(S-boxes) whose aim is to create confusion into the cryptosystems.
Functions used as S-boxes are required to have low differential uniformity [4], high nonlinearity [28]
and high algebraic degree [22]. It is well known that the lowest differential uniformity of a function defined on with odd prime can achieve
is and such functions are called *perfect nonlinear*(PN) functions.
It is interesting to observe that PN functions have also been studied under the name of planar
functions, which are functions such that is a permutation polynomials for all nonzero .
Planar functions were introduced in [15] to describe projective planes with certain properties. It was shown in [19, 34]

that a PN function yields either a skew Hadamard difference set or a Paley type partial difference set depending on

. In [11, 12], PN functions were used to describe new finite commutative semifields of odd order. Furthermore, PN functions is one of the most important cryptographic functions and has extensive applications in cryptography and communication[33, 39].It is an interesting research problem to find new PN functions, which is CCZ-inequivalent to the known ones.

Before this paper, there are several constructions of PN functions or in its equivalent form of commutative semifields. In [2], Bierbrauer introduced a general projection method to construct commutative semifields and generalized the known PN functions. In [31, 32], Pott and Zhou presented a switching construction of PN function and introduced a character theoretic approach to prove the planarity of a function. In [37] Zhou and Pott also presented new commutative semifields with two parameters and then get new PN functions. [23] constructed some new PN functions by the products of two linearized polynomials. Even through some new methods were used to construct new PN functions, but it is still difficult to find more new PN functions[3, 7, 25, 36, 38]. In this paper, we construct a new family of perfect nonlinear Dembowski-Ostrom polynomials over for odd prime . Furthermore, we claim that these functions are CCZ-inequivalent to all the previously known PN functions in general.

The remainder of this paper is organized as follows. In Sec. , we introduce some preliminary knowledge and lemmas. A new family of PN functions will be constructed in Sec. . In Sec. , we shall analyze the CCZ-equivalence of the new PN functions.

## 2 Preliminaries

For a prime number and a positive integer , let be the finite field with elements and its multiplicative group. One denotes by the largest power of dividing , i.e., with odd. The trace function from to its subfield is defined by

Any function from the finite field to itelf can be represented as a polynomial of degree less than . The graph of the function is defined as the set

A polynomial is called a linearized polynomial or -polynomial if can be written as

A polynomial from to itself is affine, if it is defined by the sum of a linearized and a constant polynomial over . A polynomial is a Dembowski-strom polynomial (DO-polynomial) if it can be expressed as

###### Definition 1.

Two functions : are called :

extended affine equivalent (EA-equivalent) if

for some affine permutations , and affine function .

Carlet-Charpin-Zinoview equivalent (CCZ-equivalent) if there exists some affine permutation

such that .

Note that CCZ-equivalent functions have equal differential uniformity and EA-equivalent is a particular case of CCZ-equivalence[9]. However, CCZ-equivalence coincides with EA-equivalence for PN functions[24].

In the following, we list all the known families of PN functions and corresponding commutative semifields.
For any odd prime , there are:

over ,
which corresponds to the finite field ;

over , and ,
which corresponds to the Albert’s commutative twisted fields [14, 15];

over , where , , and , is a primitive element of ,
which corresponds to Zha-Kyureghyan-Wang (ZKW) semifields [3, 36];

over , where , , is a primitive element of ,
which corresponds to Bierbrauer semifields [3];

over , where

and .
It corresponds to Budaghyan-Helleeth-Bierbrauer (BHB) semifields [2, 8];

over , where is a power of odd prime , and with

It corresponds to Lunardon-Marino-Polverino-Trombetti-Bierbrauer (LMPTB) semifields [2, 27];

(1) |

over , where is a power of odd prime and is a nonsquare element in .
The semifields corresponds to
Dickson semifields [16];

over , where , , is a nonsquare element in and . The semifields corresponds to Zhou-Pott (ZP) semifields [37].

For , there are :

The Cohen-Ganley semifields with odd [10];

The Ganley’s semifields with odd [31];

Up till now, all the known PN functions are DO polynomials, except for the family

over , is odd and . It corresponds to Coulter-Matthews (CM) planes [14, 21].

The purpose of this paper is to construct new PN functions, which are CCZ-inequivalent to all the known PN functions in general. Note that two DO PN functions are CCZ-inequivalent if and only if the corresponding presemifeilds are not strongly isotopic [6]. In what follows, we propose the notation of isotopism and strongly isotopism.

A ring with left and right distributive laws and cancelation laws is called a presemifield. It can be shown that a planar DO polynomials is equivalent to a commutative presemifield in odd characteristic, see [11] for details. Indeed, if is the multiplication in the presemifield, then the corresponding DO-planar function is . Conversely, the planar DO polynomial is given, then the corresponding presemifield can be defined as

A presemifield with a multiplicative identity is called a semifield. Any finite presemifield can be represented by , where is the additive group of , but may have different multiplication in , see [11] for more details.

###### Definition 2.

Let and be two presemifields. If there exist three -linear permutations over such that

for any , then and are called isotopic. The triple is called the isotopism between and . If , then and are called strongly isotopic.

In the following, we shall define the dual and transpose of a presemifield, which yields the definition of symplectic presemifield.

For a given presemifield , the presemifield is called the dual of , where

Particularly, for , we define

Then the sets

and

are the spread set associated with and , respectively.

For any with , the conjugate of is defined by

The presemifield , where with , is the transpose of . The presemifield is called the symplectic presemifield of , where with . Moreover, the set and are the spread set associated with and , respectively.

The following lemma characterizes a consistency of isotopism between two presemifields and their symplectic presemifields.

###### Lemma 1.

([29]) Let and be two presemifields. Then is an isotopism between and if and only if is an isotopism between and .

Next, some criteria commonly used to prove the CCZ-inequivalence among the new PN functions and the functions and is recalled from [29] in the following.

###### Lemma 2.

([29]) Let be an odd prime power, and be odd and even integers, respectively, such that and . Then the corresponding symplectic presemifield of the functions is

whose multiplication is given by

where is a nonsquare in and with , is a nonsquare in and .

###### Lemma 3.

([29]) Let be an odd prime power, and be odd and even integers, respectively, such that and . Then the corresponding symplectic presemifield of the functions is

whose multiplication is given by

where with and , .

###### Lemma 4.

([29]) Let be an odd prime power, and be odd and even integers, respectively, such that and . Then is isotopic to a presemifield , whose multiplication is given by

(2) |

where with , with and is an element of such that and . Furthermore, the commutative presemifields and are strong isotopic if and not strong isotopic if .

## 3 New Class of PN Functions

A new class of PN functions over with is proposed as follows.

###### Theorem 1.

Let be an odd prime, , and be positive integers such that

If and , then the function

is PN over .

###### Proof.

Since is a DO polynomial, to prove that is PN, it is sufficient to show that for any , the equation

has exactly one solution . It can be verified that

By taking and , this equation is equivalent to

If is a solution of , then

(3) |

Raising both sides of (3) to the power , one obtains

(4) |

since .

It follows from (3) and (4) that

The fact implies

(5) |

which indicates

(6) |

Combining (3) and (5), one has

(7) |

that is,

(8) |

Substituting (6) into (8), one yields

which is equivalent to

(9) |

If , then for any ,

(10) |

We claim that for any . Otherwise, there exists such that

That is to say,

Denoting by with be a primitive element of , then one has

(11) |

Dividing on both sides of (11), one obtains

(12) |

This shows that

which is impossible. In fact, due to , it follows that

is odd, a contradiction. Hence

for any .

Similarly, (10) derives the equation

which has no solution in . Indeed, suppose that there exists some positive integer such that

then one has

This indicates

which is contradicts to .

Consequently, has exactly one solution . It follows that is a PN funtion. ∎

## 4 CCZ-inequivalence of New PN Functions

In the following, we will analyze the CCZ-inequivalence among the new PN functions in Theorem 1 and all the known PN functions mentioned in Section in general. Note that the new PN functions are DO polynomials and exist for general odd prime , it suffices to consider the equivalence of the functions -.

The main result in this section is given by the following theorem.

###### Theorem 2.

Let be an odd prime. The new PN functions in Theorem 1 are CCZ-inequivalent to any of the known PN functions - listed in Section .

###### Proof.

Note that the functions - cannot cover all the new PN functions, it follows that the new PN functions are CCZ-inequivalent to the functions -. The detailed proof for the CCZ-inequivalence of the functions - and - is available in Subsection 4.1 and 4.2, see Proposition 1 and Proposition 2, respectively.

When is odd, without loss of generality, there exists such that . It allows us to choose as an -basis of . Then for any , it can be uniquely represented as with . Similarly, for any with , it can be uniquely expressed as with . It can be verified that

Recall that , then the new PN functions in Theorem 1 can be transformed into

which is equivalent to

(13) |

In the sequel, the equation (1) mentioned in Section implies that the PN function is equivalent to

It follows that for any in Theorem 1, the new PN functions in Theorem 1 are CCZ-inequivalent to the PN functions . In fact, the parameter in Theorem 1 is a positive integer, which induces that there exists no in equation (13).

On the other hand, the proof of Theorem in [37] shows that:

i) if is non-trivial, then the PN function is equivalent to

(14) |

ii) if is trivial, then the PN function is equivalent to

(15) |

or

(16) |

Similarly, it can be verified that for any in Theorem 1

, there exists no linear transformation by which the equation (

13) can be transformed to the equations (14) and (15) as in Theorem 1. More specifically, if , then the equation (13) cannot be equivalent to the equation (16). Therefore, it follows that for any , the new PN functions in Theorem 1 are CCZ-inequivalent to the PN functions . This proves the desired conclusion. ∎### 4.1 CCZ-inequivalent of Functions -

The equivalence between the new PN functions and the functions - is described as follows.

###### Proposition 1.

Let be an odd prime, , , , be positive integers such that

If and , then the function

is CCZ-inequivalent to

Furthermore, for , is also CCZ-inequivalent to over .

###### Proof.

Since CCZ-equivalence coincides with EA-equivalence for PN functions, it is sufficient to show that and is EA-inequivalent. Suppose that is EA-equivalent to . Precisely, there exist linear permutations

and

such that

(17) |

In the following, all the subscripts of and are regarded as module . For instance,

If , then (17) can be simplified as

(18) |

Comparing the coefficients of and with on both sides of (18), respectively, we have

(19) |

and

(20) |

For any , comparing the coefficient of with , one obtains

(21) |

Assume that there exists some with such that . Then (21) indicates that if . Since , one has

Combining (19) and (20), we can deduce

a contradiction. It follows that holds for any , which yields

This is impossible since cannot be a permutation.

When , we distinguish now the cases and .

Case I : If , then (17) can be written as

(22) |

Comparing the coefficients of , , , and with on both sides of (22), respectively, we have

(23) |

(24) |

(25) |

(26) |

and

(27) |

For any , comparing the coefficient of with , we obtain

(28) |

For any , assume that there exists some such that . Then, according to (28),

(29) |

which implies

Combining (25) and (26), we deduce , a contradiction. Thus, for any , one has

Now we claim that for any . Indeed, if , it follows that

Then (28) implies . By taking or , one has

Due to , it follows from (26) and (27) that for any ,

If all , then , a contradiction.

If not all , then we denote

Comments

There are no comments yet.