In this paper we propose the (keyed) permutation Arion and the hash function ArionHash over Fp for odd and particularly large primes. The design of Arion is based on the newly introduced Generalized Triangular Dynamical System (GTDS), which provides a new algebraic framework for constructing (keyed) permutation using polynomials over a finite field. At round level Arion is the first design which is instantiated using the new GTDS. We provide extensive security analysis of our construction including algebraic cryptanalysis (e.g. interpolation and Gröbner basis attacks) that are particularly decisive in assessing the security of permutations and hash functions over Fp. From a application perspective, ArionHash is aimed for efficient implementation in zkSNARK protocols and Zero-Knowledge proof systems. For this purpose, we exploit that CCZ-equivalence of graphs can lead to a more efficient implementation of Arithmetization-Oriented primitives. We compare the efficiency of ArionHash in R1CS and Plonk settings with other hash functions such as Poseidon, Anemoi and Griffin. For demonstrating the practical efficiency of ArionHash we implemented it with the zkSNARK libraries libsnark and Dusk Network Plonk. Our result shows that ArionHash is significantly faster than Poseidon -a hash function designed for zero-knowledge proof systems. We also found that an aggressive version of ArionHash is considerably faster than Anemoi and Griffin in a practical zkSNARK setting.

In algebraic geometry there is a well-known categorical equivalence between the category of normal proper integral curves over a field k and the category of finitely generated field extensions of k of transcendence degree 1. In this paper we generalize this equivalence to the category of normal quasi-compact universally closed separated integral k-schemes of dimension 1 and the category of field extensions of k of transcendence degree 1. Our key technique are morphisms of finite expansion which can be considered as relaxation of morphisms of finite type. Since the schemes in the generalized category have many properties similar to normal proper integral curves, we call them normal integral universally closed curves over k.

The multiplicative complexity of an S-box over a finite field is the minimum number of multiplications needed to implement the S-box as an arithmetic circuit. In this paper we fully characterize bijective S-boxes with multiplicative complexity 1 up to affine equivalence over any finite field. We show that under affine equivalence in odd characteristic there are two classes of bijective functions and in even characteristic there are three classes of bijective functions with multiplicative complexity 1. Moreover, in (Jeon et al., Cryptogr. Commun., 14(4), 849-874 (2022)) A-boxes where introduced to lower bound the differential uniformity of an S-box over $$\mathbb {F}_{2}^{n}$$ F 2 n via its multiplicative complexity. We generalize this concept to arbitrary finite fields. In particular, we show that the differential uniformity of a (n, m)-S-box over $$\mathbb {F}_{q}$$ F q is at least $$q^{n - l}$$ q n - l , where $$\lfloor \frac{n - 1}{2} \rfloor + l$$ ⌊ n - 1 2 ⌋ + l is the multiplicative complexity of the S-box.