On CCZ-Equivalence, Extended-Affine Equivalence and Function - PowerPoint PPT Presentation

On CCZ-Equivalence, Extended-Affine Equivalence and Function Twisting Anne Canteaut, Léo Perrin June 18, 2018 BFA’2018

Definition (EA-Equivalence; EA-mapping) F and G are E(xtented) A(ffine) equivalent if G x B F A x C x , where A B C are affine and A B are permutations; so that 1 A 0 n n x G x x x F x x 2 1 2 CA B Affine permutations with such linear part are EA-mappings ; their transposes are TEA-mappings What is the relation between functions that are CCZ- but not EA-equivalent? Definition (CCZ-Equivalence) F : F n 2 → F m 2 and G : F n 2 → F m 2 are C(arlet)-C(harpin)-Z(inoviev) equivalent if { } ({ }) ( x , G ( x )) , ∀ x ∈ F n ( x , F ( x )) , ∀ x ∈ F n Γ G = = L = L (Γ F ) , 2 2 where L : F n + m → F n + m is an affine permutation. 2 2

Affine permutations with such linear part are EA-mappings ; their transposes are TEA-mappings What is the relation between functions that are CCZ- but not EA-equivalent? Definition (CCZ-Equivalence) F : F n 2 → F m 2 and G : F n 2 → F m 2 are C(arlet)-C(harpin)-Z(inoviev) equivalent if { } ({ }) ( x , G ( x )) , ∀ x ∈ F n ( x , F ( x )) , ∀ x ∈ F n Γ G = = L = L (Γ F ) , 2 2 where L : F n + m → F n + m is an affine permutation. 2 2 Definition (EA-Equivalence; EA-mapping) F and G are E(xtented) A(ffine) equivalent if G ( x ) = ( B ◦ F ◦ A )( x ) + C ( x ) , where A , B , C are affine and A , B are permutations; so that [ ] ({ A − 1 { } 0 }) ( x , G ( x )) , ∀ x ∈ F n = ( x , F ( x )) , ∀ x ∈ F n . CA − 1 2 2 B

What is the relation between functions that are CCZ- but not EA-equivalent? Definition (CCZ-Equivalence) F : F n 2 → F m 2 and G : F n 2 → F m 2 are C(arlet)-C(harpin)-Z(inoviev) equivalent if { } ({ }) ( x , G ( x )) , ∀ x ∈ F n ( x , F ( x )) , ∀ x ∈ F n Γ G = = L = L (Γ F ) , 2 2 where L : F n + m → F n + m is an affine permutation. 2 2 Definition (EA-Equivalence; EA-mapping) F and G are E(xtented) A(ffine) equivalent if G ( x ) = ( B ◦ F ◦ A )( x ) + C ( x ) , where A , B , C are affine and A , B are permutations; so that [ ] ({ A − 1 { } 0 }) ( x , G ( x )) , ∀ x ∈ F n = ( x , F ( x )) , ∀ x ∈ F n . CA − 1 2 2 B Affine permutations with such linear part are EA-mappings ; their transposes are TEA-mappings

Definition (CCZ-Equivalence) F : F n 2 → F m 2 and G : F n 2 → F m 2 are C(arlet)-C(harpin)-Z(inoviev) equivalent if { } ({ }) ( x , G ( x )) , ∀ x ∈ F n ( x , F ( x )) , ∀ x ∈ F n Γ G = = L = L (Γ F ) , 2 2 where L : F n + m → F n + m is an affine permutation. 2 2 Definition (EA-Equivalence; EA-mapping) F and G are E(xtented) A(ffine) equivalent if G ( x ) = ( B ◦ F ◦ A )( x ) + C ( x ) , where A , B , C are affine and A , B are permutations; so that [ ] ({ A − 1 { } 0 }) ( x , G ( x )) , ∀ x ∈ F n = ( x , F ( x )) , ∀ x ∈ F n . CA − 1 2 2 B Affine permutations with such linear part are EA-mappings ; their transposes are TEA-mappings What is the relation between functions that are CCZ- but not EA-equivalent?

Definition (LAT/Walsh Spectrum) n m The L(inear) A(pproximation) T(able) of F 2 is 2 x F x 1 F n x 2 Admissible Mapping For F : F n 2 → F m 2 , the affine permutation L is admissible for F if ( ) { ( x , F ( x )) , ∀ x ∈ F n = { ( x , G ( x )) , ∀ x ∈ F n 2 } 2 } L for a well defined function G : F n 2 → F m 2 .

Admissible Mapping For F : F n 2 → F m 2 , the affine permutation L is admissible for F if ( ) { ( x , F ( x )) , ∀ x ∈ F n = { ( x , G ( x )) , ∀ x ∈ F n 2 } 2 } L for a well defined function G : F n 2 → F m 2 . Definition (LAT/Walsh Spectrum) The L(inear) A(pproximation) T(able) of F : F n 2 → F m 2 is ∑ ( − 1 ) α · x + β · F ( x ) . W F ( α, β ) = x ∈ F n 2

1.1 - Vector spaces of zeroes in LAT 2.1 - t -twist 4.1 - CCZ-Equivalence 1.2 - Partition CCZ-class to a permutation into EA-classes 3.3 - Revisiting 4.2 - Application known results to APN functions Structure of this talk 0 - CCZ-Equivalence ; Bijectivity

2.1 - t -twist 4.1 - CCZ-Equivalence 1.2 - Partition CCZ-class to a permutation into EA-classes 3.3 - Revisiting 4.2 - Application known results to APN functions Structure of this talk 0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT

2.1 - t -twist 4.1 - CCZ-Equivalence to a permutation 3.3 - Revisiting 4.2 - Application known results to APN functions Structure of this talk 0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT 1.2 - Partition CCZ-class into EA-classes

4.1 - CCZ-Equivalence to a permutation 3.3 - Revisiting 4.2 - Application known results to APN functions Structure of this talk 0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT 2.1 - t -twist 1.2 - Partition CCZ-class into EA-classes

4.1 - CCZ-Equivalence to a permutation 3.3 - Revisiting 4.2 - Application known results to APN functions Structure of this talk 0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT 2.1 - t -twist ⊞ 1.2 - Partition CCZ-class into EA-classes

4.1 - CCZ-Equivalence to a permutation 3.3 - Revisiting 4.2 - Application known results to APN functions Structure of this talk 0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT 2.1 - t -twist ⊞ 3.2 - 1.2 - Partition CCZ-class CCZ = EA + twist into EA-classes

4.1 - CCZ-Equivalence to a permutation 4.2 - Application to APN functions Structure of this talk 0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT 2.1 - t -twist ⊞ 3.2 - 1.2 - Partition CCZ-class CCZ = EA + twist into EA-classes 3.3 - Revisiting known results

4.2 - Application to APN functions Structure of this talk 0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT 2.1 - t -twist ⊞ 3.2 - 4.1 - CCZ-Equivalence 1.2 - Partition CCZ-class CCZ = EA + twist to a permutation into EA-classes 3.3 - Revisiting known results

Structure of this talk 0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT 2.1 - t -twist ⊞ 3.2 - 4.1 - CCZ-Equivalence 1.2 - Partition CCZ-class CCZ = EA + twist to a permutation into EA-classes 3.3 - Revisiting 4.2 - Application known results to APN functions

CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion Outline CCZ-Equivalence and Vector Spaces of 0 1 Function Twisting 2 3 Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation 4 Conclusion 3 / 32

CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion Plan of this Section CCZ-Equivalence and Vector Spaces of 0 1 Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes Function Twisting 2 Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation 3 Conclusion 4 3 / 32

Definition (Walsh Zeroes) n m The Walsh zeroes of F 2 is the set 2 n m u F u 0 0 F 2 2 n n m With x 0 x , we have F . 2 2 L T 1 Note that if L F , then F . G G CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion Walsh Zeroes For all F : F n 2 → F m 2 , we have ∑ ( − 1 ) α · x + 0 · F ( x ) = 0 . W F ( α, 0 ) = x ∈ F n 2 4 / 32

L T 1 Note that if L F , then F . G G CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion Walsh Zeroes For all F : F n 2 → F m 2 , we have ∑ ( − 1 ) α · x + 0 · F ( x ) = 0 . W F ( α, 0 ) = x ∈ F n 2 Definition (Walsh Zeroes) The Walsh zeroes of F : F n 2 → F m 2 is the set Z F = { u ∈ F n 2 × F m 2 , W F ( u ) = 0 } ∪ { 0 } . 2 } ⊂ F n + m With V = { ( x , 0 ) , ∀ x ∈ F n , we have V ⊂ Z F . 2 4 / 32

CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion Walsh Zeroes For all F : F n 2 → F m 2 , we have ∑ ( − 1 ) α · x + 0 · F ( x ) = 0 . W F ( α, 0 ) = x ∈ F n 2 Definition (Walsh Zeroes) The Walsh zeroes of F : F n 2 → F m 2 is the set Z F = { u ∈ F n 2 × F m 2 , W F ( u ) = 0 } ∪ { 0 } . 2 } ⊂ F n + m With V = { ( x , 0 ) , ∀ x ∈ F n , we have V ⊂ Z F . 2 Note that if Γ G = L (Γ F ) , then Z G = ( L T ) − 1 ( Z F ) . 4 / 32

CCZ-Equivalence and Vector Spaces of 0 Function Twisting Vector Spaces of Zeroes Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Partitioning a CCZ-Class into EA-Classes Conclusion Admissibility for F Lemma Let L : F n + m → F n + m be a linear permutation. It is admissible for F : F n 2 → F m 2 2 2 if and only if L T ( V ) ⊆ Z F 5 / 32