 # On construction and (non)existence of c-(almost) perfect nonlinear functions

Functions with low differential uniformity have relevant applications in cryptography. Recently, functions with low c-differential uniformity attracted lots of attention. In particular, so-called APcN and PcN functions (generalization of APN and PN functions) have been investigated. Here, we provide a characterization of such functions via quadratic polynomials as well as non-existence results.

## Authors

##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1 Introduction

Perfect nonlinear (PN) and almost perfect nonlinear (APN) functions and in general functions with low differential uniformity over finite fields have been widely investigated due to their applications in cryptography. Indeed, differential cryptanalysis BihamShamir ; BihamShamir2 is an important cryptanalytic approach targeting symmetric-key primitives. In order to be resistant against such types of attacks, cryptographic functions used in the substitution box (S-box) in the cipher are required to have a differential uniformity as low as possible (see Carlet1 for a survey on differential uniformity of vectorial Boolean functions). In Borisov , the authors introduce a different type of differential, useful for ciphers that utilize modular multiplication as a primitive operation. Consequently, a new concept called multiplicative differential (and the corresponding -differential uniformity) has been introduced EFRST2020 .

###### Definition 1.1.

(EFRST2020, , Definition 1) Given a -ary -function , and , the (multiplicative) -derivative of with respect to is the function

 cDaf(x)=f(x+a)−cf(x), ∀x∈Fpn.

For an -function , and ,

 cΔf(a,b):=#{x∈Fpn : f(x+a)−cf(x)=b},

and

 cΔf:=max{cΔf(a,b) : a,b∈Fpn,(a,c)≠(0,1)}.

The quantity is called -differential uniformity of . Note that for , the above definitions coincide with the usual derivative of and its differential uniformity.

If , we say that is differentially -uniform. In the special cases and , such functions are also called PcN and APcN functions. It is worth noting that PcN functions (namely

-planar functions) have been investigated and partially classified in

BT2019 .

Clearly, the case (APN and PN functions) has been widely investigated in the literature; see BCCCV20 ; BCL08 ; Dobbertin ; Dobbertin2 ; Dobbertin3 ; Gold ; Janwa ; Kasami ; Nyberg and CM1997 ; DO1968 ; DY2006 ; Dobbertin4 ; Helleseth1 ; Helleseth2 ; L2012 ; ZW2011 for known APN and PN functions. PN functions are also called planar. APN and PN functions are of central interest in design theory, coding theory, and cryptography.

Very recently, power functions with low c-differential uniformity have been studied in YSZ2020 . Also in HPRS20 , the authors focus on monomial functions and study their -differential uniformity for . In RS20 , the

-differential uniformity of some known APN functions in odd characteristic is investigated.

In this paper, we further investigate the construction and existence of some APcN and PcN functions. First, in Section 2, we collect some preliminary results and definitions that we will use in the rest of the paper. In Section 3, we first give a characterization of APcN and PcN quadratic functions, which, in particular, gives us a correspondence between planar DO polynomials and APcN maps. Then, we show that, using the AGW criterion AGW and its generalization Mesn , it is possible to construct several classes of APcN and PcN functions. In the last section, we give some non existence results for some exceptional monomial APcN and PcN functions using connections with algebraic curves and a combination of Galois Theory tools introduced by Micheli in micheli2019constructions ; micheli2019selection .

## 2 Preliminaries

Let be a fixed prime power. We denote by and the field with elements and its algebraic closure. In the following we will focus on functions defined from to itself, i.e. -ary -functions. Any function can be represented uniquely by an element of the polynomial ring of degree less than .

For :

• is linear if (also known as linearised polynomials).

• is affine if it differs from a linear polynomial by a constant.

• is a Dembowski-Ostrom (DO) polynomial if , with if .

• is quadratic if it differs from a DO polynomial by an affine polynomial.

A polynomial is a permutation polynomial (PP) over , if is a bijection from to itself, and it is a complete permutation polynomial (CPP) over , if both and are PPs.

The AGW criterion, introduced in AGW , is a useful method in the construction of PPs and CPPs; see for instance LWWZ2014 ; XFZ2019 ; YD2011 ; YD2014 . The AGW criterion, in the additive case, is given by the following proposition.

###### Proposition 2.1 (Proposition 5.4 Agw ).

Let be a prime and for some integer . Let and be two -linear polynomials over seen as endomorphisms of , and let and such that .Then

 f(x)=h∘ψ(x)ϕ(x)+g∘ψ(x)

is a permutation polynomial of if and only if the following two conditions hold:

• ;

• permutes .

As immediate consequence, in Theorem 5.10 in AGW the authors provided the following general framework of PPs.

###### Theorem 2.2 (Agw ).

Let be a prime and for some integer . Let a -linear polynomials over seen as endomorphisms of , and let and such that .Then

 f1(x)=h(xq−x)ϕ(x)+Trqnq(g(xq−x))

and

 f2(x)=h(xq−x)ϕ(x)+g(xq−x)(qn−1)/(q−1)

are permutation polynomial of if and only if and permutes .

In Mesn , Mesnager and Qu extend the AGW criterion for constructing -to- map. If is even, a 2-to-1 map over is a function such that any has either 2 or 0 preimages. If is odd, for all but one , it has either 2 or 0 preimages, and the exception element has exactly one preimage.

For , using a 2-to-1 map over and that permutes it is possible to construct -to- maps of same type as in Theorem 2.2. More specifically, we have the following result.

###### Theorem 2.3 (Theorem 15 Mesn ).

Let , be a linear -linear polynomial seen as an endomorphism of . Let be such that for any . Assume

 f1(x)=h(xq+x)ϕ(x)+Trqnq(g(xq+x))

and

 f2(x)=h(xq+x)ϕ(x)+g(xq+x)(qn−1)/(q−1).

If is 2-to-1 over and permutes , then both and are 2-to-1 over .

In the second part of this work, Section 4, we deal with exceptional power APcN and PcN maps.

###### Definition 2.4.

Let be fixed. Let be a APcN (PcN) function over for infinitely many . Then, is said exceptional APcN (PcN).

Results on exceptional APN e PN functions can be found in Survey ; State and the references therein.

We use Galois theory tools to provide non-existence results for APcN and PcN monomials. We recall here the Galois theoretical part of our approach which deals with totally split places. This method was successfully used also in BM2020 ; ferraguti2018full ; micheli2019constructions ; micheli2019selection .

We will make use of the following results.

###### Theorem 2.5.

(Helmut, , Theorem 3.9) Let be a prime and be a primitive group of degree with . If contains an element of degree and order (i.e. an -cycle), then is either alternating or symmetric.

The proof of the following result can be found in guralnick2007exceptional .

###### Lemma 2.6.

Let be a finite separable extension of function fields, let be its Galois closure and be its Galois group. Let be a place of and be the set of places of lying above . Let be a place of lying above . Then we have the following:

1. There is a natural bijection between and the set of orbits of under the action of the decomposition group .

2. Let and let be the orbit of corresponding to . Then where and are ramification index and relative degree, respectively.

3. The orbit partitions further under the action of the inertia group into orbits of size .

The following can also be deduced by kosters2014short ; its proof can be found in BM2020 .

###### Theorem 2.7.

Let be a prime number, a positive integer, and . Let be a separable extension of global function fields over of degree , be the Galois closure of , and suppose that the field of constants of is . There exists an explicit constant depending only on the genus of and the degree of such that if then has a totally split place.

## 3 A characterization of APcN and PcN functions

It is well-known that a DO polynomial is planar if and only if it is 2-to-1 (see (CM2011, , Theorem 3)), the following result gives a characterization of APcN and PcN quadratic polynomials for .

###### Theorem 3.1.

Let be a prime. Let be a quadratic polynomial over for some integer . Then, for any we have the following.

• If is 2-to-1, then is APcN. Moreover, if is a DO polynomial, then is APcN if and only if is planar.

• is a PP if and only if is PcN.

###### Proof.

(i) Let be a quadratic polynomial, that is . We can note that for any we have

 f(x+γ)=f(x)+f(γ)+∑i,jai,j(xpiγpj+xpjγpi).

Let , then

 f(x+γ)−cf(x)= (1−c)(f(x)+∑i,jai,j[xpi(γ1−c)pj+xpj(γ1−c)pi] (1) +f(γ1−c)−f(γ1−c))+f(γ) = (1−c)f(x+γ1−c)+f(γ)−(1−c)f(γ1−c).

Thus, since is 2-to-1 so is , which implies that is APcN.

Vice versa, let be an APcN DO polynomial. From (1) we have . Moreover, since is a DO polynomial we have , therefore and is 2-to-1. Therefore, is a planar function.

(ii) This follows directly from (1). ∎

###### Remark 3.2.

Let . If the quadratic function is of type

 f(x)=∑i,jai,jxqi+qj,

then the results above can be extended to any .

Up to now, all known planar functions are DO polynomials, but the case of defined over with odd and . From Theorem 3.1, we have that these known planar functions are also APcN. Moreover, in YSZ2020 it has been proved that the planar function is APcN for .

The result (i) of Theorem 3.1 cannot be extend to a general planar quadratic function. Indeed, the planarity of a function is invariant by adding a linear (affine) polynomial to , while the -differential uniformity is not. So, if we consider a planar DO polynomial, adding a linear function we could obtain a functions which is no more 2-to-1 and thus which is no APcN.

###### Example 3.3.

The function is planar over but it is not APcN for any .

###### Remark 3.4.

In SGGRT2020 , the authors introduce and study c-differential bent functions. In their work, they also relax the definition of perfect -nonlinearity excluding the case of the derivative in the zero direction. In particular, they define PcN function any such that is a permutation for any , and strictly PcN if in addition is a permutation.

For , even if we exclude the derivative in the zero direction, a PcN function has to be a PP. Indeed, let be PcN and suppose that there exist and such that . Since is PcN,

 f(x+γ)+cf(x)=(c+1)f(x)+f(x+γ)+f(x)

is a PP. But

 f(x1+γ)+cf(x1)=(c+1)f(x1)=(c+1)f(x2)=f(x2+γ)+cf(x2),

It would be interesting to understand if this is the case also for .

### 3.1 Some PcN and APcN polynomials from the AGW criterion

In the following we will show that from the AGW criterion and its generalization Mesn (for the case ) we can obtain PcN and APcN functions.

Theorem 2.2 gives us the possibility of constructing PPs of the form

 f1(x)=h(xq−x)ϕ(x)+Trqnq(g(xq−x))

and

 f2(x)=h(xq−x)ϕ(x)+g(xq−x)(qn−1)/(q−1),

where can be any polynomial over . This is implied by the fact that annihilates both and for any . We can immediately construct some PcN polynomials.

###### Theorem 3.5.

Let and PPs be as in Theorem 2.2 with . Then and are PcN for any .

###### Proof.

Let . Consider for instance the permutation . Then is PcN if and only if

 f1(x+γ)−cf1(x)=b(1−c)ϕ(x)+Trqnq(g(xq−x+γq−γ))−cTrqnq(g(xq−x)+bϕ(γ)

is a PP for any . Denoting by , from the AGW criterion (Proposition 2.1) we have that this is a PP if and only if

 b(1−c)ϕ(x)+ψ(Trqnq(g(x))−cTrqnq(g(x))

permutes . Now, and thus permutes since is a PP. The same holds for . ∎

Another type of PPs, which are also PcN, can be constructed in the following way.

###### Theorem 3.6.

Let be a prime and for some integer . Let be any polynomial such that where and be an -linear polynomial over . Let . Then, for any

 f(x)=bϕ(x)+(g(xq−x))s

is a PP if and only if induces a permutation over .

###### Proof.

From the AGW criterion (Proposition 2.1) we have that is a PP if and only if

 (g(x))qs−(g(x))s+bϕ(x)

permutes .

Note that for any we have and thus . Since has -weight , for any we have . Indeed,

 ysq=(−y)s=(−y)ph(−y)pk=ys.

Then, since we have that

 (g(x))qs−(g(x))s=0,

for any . Thus, is a PP if and only if permutes . ∎

###### Example 3.7.

An easy example of function such that is given by with .

Theorem 3.6 can be generalized (with a similar proof) to functions of type

 f(x)=bϕ(x)+∑i(gi(xq−x))si,

where ’s have -weight 2, that is for some , and ’s are such that .

###### Corollary 3.8.

Let be a prime and for some integer . Let be a positive integer. Let be such that for all , where , and a -linear polynomials over . Let . Then, for any

 f(x)=bϕ(x)+∑i(gi(xq−x))si,

is a PP if and only if induces a permutation over .

###### Remark 3.9.

Note that the polynomials in Theorem 2.2 and 3.6, considering , are also CPPs when .

As for the case of the functions and of Theorem 2.2, also the functions satisfying Theorem 3.6 are PcN when .

###### Theorem 3.10.

Let be a prime and for some integer . Let be a PP as in Theorem 3.6. Then is PcN for any .

###### Proof.

We have that where . Note that since is an

-vector space,

. Now as in Theorem 3.6, this is a permutation if and only if permutes . This condition is satisfied since is a PP. ∎

###### Remark 3.11.

In even characteristic, PN functions (i.e. PcN function with ) do not exist. As pointed out in EFRST2020 , PcN functions, for , exist also for the case . Indeed, trivially, any PP is PcN for and any linear permutation is PcN for any . Theorems 3.5 and 3.10 provide non-trivial PcN functions for .

A similar argument can be done for the case of APcN maps using the results of Mesn . As for the PcN case we can obtain APcN maps for any using functions as in Theorem 2.3. In particular, for odd, we can obtain the following APcN maps.

###### Theorem 3.12.

Let and be two positive integers with odd. Let and be an -linear polynomial which is 2-to-1 over and that permutes . Let and . Then,

 f1(x)=bϕ(x)+Trqnq(g(xq+x)) and f2(x)=bϕ(x)+g(xq+x)(qn−1)/(q−1)

are APcN functions for any .

###### Proof.

Let us consider . For any we have

 f1(x+γ)+cf1(x)= bϕ(x)+bϕ(γ)+Trqnq(g(xq+x+γq+γ)) +cbϕ(x)+Trqnq(cg(xq+x)) = b(c+1)ϕ(x)+Trqnq(g′(xq+x)),

where . Then, is 2-to-1 from Theorem 2.3.

For the claim follows in a similar way. ∎

###### Example 3.13.

For constructing APcN functions as in Theorem 3.12, we can consider, for example, the 2-to-1 function over defined by with .

Indeed, since we have that , implying that is 2-to-1 over . Moreover permutes . Suppose that there exist such that then . Since is a vector subspace, we have , recall that is odd and .

###### Remark 3.14.

Note that, when is even, it is not possible to construct that is a 2-to-1 map over and permutes since . Indeed is a subfield of and, denoting by , we have .

So, for even, it is not possible to construct APcN functions as in Theorem 3.12.

## 4 Non-existence results for APcN and PcN monomials

In this section we provide non-existence results for exceptional APcN (and PcN) monomials. In what follows, we will consider exponents such that , and we denote by , for some integer , and by the smallest positive integer such that .

Let us consider defined over . The monomial is APcN, , if and only if

 ∀a,b∈Fq⟹(x+a)d−cxd=b has at % most two solutions. (2)

For , the condition above implies that is at most a 2-to-1 function. That is .

When , Condition (2) can be simplified to

 ∀b∈Fq⟹(x+1)d−cxd=b has at % most two solutions. (3)

A standard tool, when dealing with APN or PN functions is to consider the curve of affine equation

 Cf,c : (X+1)d−(Y+1)d−c(Xd−Yd)X−Y=0. (4)

We refer to BT2019 for and the references therein for an introduction to basic concepts about curves over finite fields.

It is readily seen that Condition (3) implies the existence of at most one absolutely irreducible component of defined over , provided that is large enough with respect to .

First, we will provide sufficient conditions on and for which is absolutely irreducible. In particular, we provide upper bounds on the number of singular points of . To this end we will consider, for simplicity, the curve . Singular points of are a subset of the singular points of .

###### Theorem 4.1.

Suppose that . Then contains no singular points off .

###### Proof.

Since , does not possess singular points at infinity. Note that there are no singular points lying on or . Affine singular points , , satisfy

 ⎧⎪ ⎪ ⎪ ⎪⎨⎪ ⎪ ⎪ ⎪⎩(x0+1x0)d−1=c(y0+1y0)d−1=c(x0y0)d−1=1. (5)

Let be a primitive root of unity and denote by . Therefore, , , , for some and . Each triple provides a pair satisfying (5). Thus,

 c0ξk−1=ξi(c0ξj−1). (6)

By our hypothesis . Equation (6) yields

 c0(ξk−ξi+j)=1−ξi⟺cps0(ξk−ξi+j)=1−ξi.

Since , , a contradiction to . So, no pairs satisfy (5) and there are no singular points. ∎

Note that, under the hypothesis of Theorem 4.1 the number of singular points of is at most . A deeper analysis shows that

and therefore points are double points of and then simple points of . So, possesses no singular points and hence it is absolutely irreducible.

###### Theorem 4.2.

Suppose that . Then is absolutely irreducible.

We want to prove that if is large enough there exists such that the equation has more than two solutions, i.e. is not exceptional PcN nor APcN. To this end we will investigate the geometric and the algebraic Galois groups of the polynomial .

More in details, consider and . They are both subgroups of , the symmetric group over elements. Our aim is to prove that . This would force that , since and therefore by Chebotarev density Theorem kosters2014short , one obtains the existence of a specialization for which splits into pairwise distinct linear factors defined over and therefore cannot be a permutation or 2-to-1 and is not PcN nor APcN.

###### Lemma 4.3.

Suppose that . The geometric Galois group coincides with .

###### Proof.

First we prove that the geometric Galois group of is primitive (i.e. it does not act on a non–trivial partition of the underlying set). Let be the splitting field of and be the Galois group of over . Let be a root of and consider the extension . Clearly, by definition. As a consequence of Lüroth’s Theorem, is indecomposable (i.e. it cannot be written as a composition of two non-linear polynomials) if and only if is a primitive group; see (Fried, , Proposition 3.4).

To this end, suppose that , for some , with degree . Then

 (h2(X)−h2(Y))∣(fc,d(X)−fc,d(Y))=(h1(h2(X))−h1(h2(Y))).

By Theorem 4.2, is absolutely irreducible and then , which contradicts . Therefore is primitive.

Now we prove that there exists such that has exactly -roots in . Elements for which has a repeated root are such that

 (x0+1)d−1−cxd−10=0,t0=cxd−10.

Suppose that there exists another repeated root of . Then

 ⎧⎪ ⎪⎨⎪ ⎪⎩(x0+1)d−1−cxd−10=0xd−10=yd−10(y0+1)d−1−cyd−10=0.

which is equivalent to (5). So each has at most one repeated root. Note that a repeated root is at most a double root of since otherwise and a contradiction easily arises from . Therefore each root of (they are pairwise distinct) provides a such that the equation has exactly -roots in .

Let be such that the element obtained above belongs to . This means that has exactly one factor of multiplicity and all the others of multiplicity . Let now be the splitting field of over . Let be a place of lying above . Now, using Lemma 2.6 we obtain that the decomposition group has a cycle of order exactly and fixes all the other elements of ( can be simply thought as the set of roots of in . Now pick any element that acts non-trivially on . This element has to be a transposition, which in turn forces to contain a transposition for any and therefore in particular that contains a transposition.

We already know that is primitive. Now using Theorem 2.5 with we conclude that both