On CCZ-Equivalence, Extended-Affine Equivalence and Function - PowerPoint PPT Presentation

On CCZ-Equivalence, Extended-Affine Equivalence and Function Twisting Anne Canteaut, L´ eo Perrin June 3, 2019 Fq14, Vancouver

Setting up the background Cryptographic properties → Equivalence classes → CCZ-equivalence

Cryptographic Properties F : F n 2 → F m 2 and G : F n 2 → F m 2 are functions (e.g. S-Boxes). Definition (DDT/LAT) The D(ifference) D(istribution) T(able) of F : F n 2 → F m 2 is 𝒠 F ( α, β ) = # { x , F ( x ⊕ α ) ⊕ F ( x ) = β } The L(inear) A(pproximation) T(able) of F : F n 2 → F m 2 is ( − 1) α · x + β · F ( x ) . ∑︂ 𝒳 F ( α, β ) = x ∈ F n 2

Cryptographic Properties F : F n 2 → F m 2 and G : F n 2 → F m 2 are functions (e.g. S-Boxes). Definition (DDT/LAT) The D(ifference) D(istribution) T(able) of F : F n 2 → F m 2 is 𝒠 F ( α, β ) = # { x , F ( x ⊕ α ) ⊕ F ( x ) = β } The L(inear) A(pproximation) T(able) of F : F n 2 → F m 2 is ( − 1) α · x + β · F ( x ) . ∑︂ 𝒳 F ( α, β ) = x ∈ F n 2 Big APN Problem Is there an APN permutation on 2 t bits such that max(DDT) = 2?

Equivalence Relations that ≈ Preserve DDT/LAT (1/2) Definition (Affine-Equivalence) F and G are affine equivalent if G ( x ) = ( B ∘ F ∘ A )( x ), where A , B are affine permutations.

Equivalence Relations that ≈ Preserve DDT/LAT (1/2) Definition (Affine-Equivalence) F and G are affine equivalent if G ( x ) = ( B ∘ F ∘ A )( x ), where A , B are affine permutations. Definition (EA-Equivalence; EA-mapping) F and G are E(xtented) A(ffine) equivalent if G ( x ) = ( B ∘ F ∘ A )( x ) + C ( x ), where A , B , C are affine and A , B are permutations; so that [︃ A − 1 ]︃ (︁{︁ 0 {︁ ( x , G ( x )) , ∀ x ∈ F n }︁ ( x , F ( x )) , ∀ x ∈ F n }︁)︁ = . 2 CA − 1 2 B

Equivalence Relations that ≈ Preserve DDT/LAT (1/2) Definition (Affine-Equivalence) F and G are affine equivalent if G ( x ) = ( B ∘ F ∘ A )( x ), where A , B are affine permutations. Definition (EA-Equivalence; EA-mapping) F and G are E(xtented) A(ffine) equivalent if G ( x ) = ( B ∘ F ∘ A )( x ) + C ( x ), where A , B , C are affine and A , B are permutations; so that [︃ A − 1 ]︃ (︁{︁ 0 {︁ ( x , G ( x )) , ∀ x ∈ F n }︁ ( x , F ( x )) , ∀ x ∈ F n }︁)︁ = . 2 CA − 1 2 B Affine permutations with such linear part are EA-mappings ; their transposes are TEA-mappings

Equivalence Relations that ≈ Preserve DDT/LAT (2/2) Definition (CCZ-Equivalence) F : F n 2 → F m 2 and G : F n 2 → F m 2 are C(arlet)-C(harpin)-Z(inoviev) equivalent if {︁ ( x , G ( x )) , ∀ x ∈ F n }︁ (︁{︁ ( x , F ( x )) , ∀ x ∈ F n }︁)︁ Γ G = = L = L (Γ F ) , 2 2 where L : F n + m → F n + m is an affine permutation. 2 2

Equivalence Relations that ≈ Preserve DDT/LAT (2/2) Definition (CCZ-Equivalence) F : F n 2 → F m 2 and G : F n 2 → F m 2 are C(arlet)-C(harpin)-Z(inoviev) equivalent if {︁ ( x , G ( x )) , ∀ x ∈ F n }︁ (︁{︁ ( x , F ( x )) , ∀ x ∈ F n }︁)︁ Γ G = = L = L (Γ F ) , 2 2 where L : F n + m → F n + m is an affine permutation. 2 2 CCZ-equivalence plays a crucial role in the investigation of the big APN problem.

Equivalence Relations that ≈ Preserve DDT/LAT (2/2) Definition (CCZ-Equivalence) F : F n 2 → F m 2 and G : F n 2 → F m 2 are C(arlet)-C(harpin)-Z(inoviev) equivalent if {︁ ( x , G ( x )) , ∀ x ∈ F n }︁ (︁{︁ ( x , F ( x )) , ∀ x ∈ F n }︁)︁ Γ G = = L = L (Γ F ) , 2 2 where L : F n + m → F n + m is an affine permutation. 2 2 CCZ-equivalence plays a crucial role in the investigation of the big APN problem. What is the relation between functions that are CCZ- but not EA-equivalent?

The Problem with CCZ-Equivalence Admissible Mapping For F : F n 2 → F m 2 , the affine permutation L is admissible for F if { ( x , F ( x )) , ∀ x ∈ F n = { ( x , G ( x )) , ∀ x ∈ F n (︁ )︁ L 2 } 2 } for a well defined function G : F n 2 → F m 2 .

The Problem with CCZ-Equivalence Admissible Mapping For F : F n 2 → F m 2 , the affine permutation L is admissible for F if { ( x , F ( x )) , ∀ x ∈ F n = { ( x , G ( x )) , ∀ x ∈ F n (︁ )︁ L 2 } 2 } for a well defined function G : F n 2 → F m 2 . How can we list all admissible mappings for F?

Structure of this talk 1 CCZ-Equivalence and Vector Spaces of 0 2 Function Twisting 3 Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation 4 Conclusion

CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion Outline 1 CCZ-Equivalence and Vector Spaces of 0 2 Function Twisting 3 Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation 4 Conclusion 6 / 25

CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion Plan of this Section 1 CCZ-Equivalence and Vector Spaces of 0 Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes 2 Function Twisting 3 Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation 4 Conclusion 6 / 25

CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion Walsh Zeroes For all F : F n 2 → F m 2 , we have ( − 1) α · x +0 · F ( x ) = 0 . ∑︂ 𝒳 F ( α, 0) = x ∈ F n 2 7 / 25

CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion Walsh Zeroes For all F : F n 2 → F m 2 , we have ( − 1) α · x +0 · F ( x ) = 0 . ∑︂ 𝒳 F ( α, 0) = x ∈ F n 2 Definition (Walsh Zeroes) The Walsh zeroes of F : F n 2 → F m 2 is the set 𝒶 F = { u ∈ F n 2 × F m 2 , 𝒳 F ( u ) = 0 } ∪ { 0 } . 2 } ⊂ F n + m With 𝒲 = { ( x , 0) , ∀ x ∈ F n , we have 𝒲 ⊂ 𝒶 F . 2 7 / 25

CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion Walsh Zeroes For all F : F n 2 → F m 2 , we have ( − 1) α · x +0 · F ( x ) = 0 . ∑︂ 𝒳 F ( α, 0) = x ∈ F n 2 Definition (Walsh Zeroes) The Walsh zeroes of F : F n 2 → F m 2 is the set 𝒶 F = { u ∈ F n 2 × F m 2 , 𝒳 F ( u ) = 0 } ∪ { 0 } . 2 } ⊂ F n + m With 𝒲 = { ( x , 0) , ∀ x ∈ F n , we have 𝒲 ⊂ 𝒶 F . 2 Note that if Γ G = L (Γ F ), then 𝒶 G = ( L T ) − 1 ( 𝒶 F ). 7 / 25

CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion Admissibility for F Lemma Let L : F n + m → F n + m be a linear permutation. It is admissible for 2 2 F : F n 2 → F m 2 if and only if L T ( 𝒲 ) ⊆ 𝒶 F 8 / 25

CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion Admissibility of EA-mappings EA-mappings are admissible for all F : F n 2 → F m 2 : [︃ A [︃ A T ]︃ (︃{︃[︃ x ]︃ T C T 0 ]︃ }︃)︃ , ∀ x ∈ F n ( 𝒲 ) = = 𝒲 . B T 2 C B 0 0 9 / 25

CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion Permutations We define 𝒲 ⊥ = { (0 , y ) , ∀ y ∈ F m 2 } ⊂ F n + m . 2 Lemma F : F n 2 → F m 2 is a permutation if and only if 𝒲 ⊥ ⊂ 𝒶 F . 10 / 25

CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion EA-classes imply vector spaces Lemma let F, G and G ′ be such that Γ G = L (Γ F ) and Γ G ′ = L ′ (Γ F ) . If L T ( 𝒲 ) = L ′ T ( 𝒲 ) , then G and G ′ are EA-equivalent. 11 / 25

CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion EA-classes imply vector spaces Lemma let F, G and G ′ be such that Γ G = L (Γ F ) and Γ G ′ = L ′ (Γ F ) . If L T ( 𝒲 ) = L ′ T ( 𝒲 ) , then G and G ′ are EA-equivalent. Can we use this knowledge to partition a CCZ-class into its EA-classes? 11 / 25

CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion EA-classes imply vector spaces Lemma let F, G and G ′ be such that Γ G = L (Γ F ) and Γ G ′ = L ′ (Γ F ) . If L T ( 𝒲 ) = L ′ T ( 𝒲 ) , then G and G ′ are EA-equivalent. Can we use this knowledge to partition a CCZ-class into its EA-classes? The Lemma gives us hope! 1 EA-class = ⇒ 1 vector space of zeroes of dimension n in 𝒶 n 11 / 25