Differentially 4-Uniform Permutations with the Best Known Nonlinearity from Butterflies

Abstract

Many block ciphers use permutations defined over the finite field F22k with low differential uniformity, high nonlinearity, and high algebraic degree to provide confusion. Due to the lack of knowledge about the existence of almost perfect nonlinear (APN) permutations over F22k, which have lowest possible differential uniformity, when k > 3, constructions of differentially 4-uniform permutations are usually considered. However, it is also very difficult to construct such permutations together with high nonlinearity; there are very few known families of such functions, which can have the best known nonlinearity and a high algebraic degree. At Crypto’16, Perrin et al. introduced a structure named butterfly, which leads to permutations over F22k with differential uniformity at most 4 and very high algebraic degree when k is odd. It is posed as an open problem in Perrin et al.’s paper and solved by Canteaut et al. that the nonlinearity is equal to 22k−1−2k. In this paper, we extend Perrin et al.’s work and study the functions constructed from butterflies with exponent e = 2i + 1. It turns out that these functions over F22k with odd k have differential uniformity at most 4 and algebraic degree k +1. Moreover, we prove that for any integer i and odd k such that gcd(i, k) = 1, the nonlinearity equality holds, which also gives another solution to the open problem proposed by Perrin et al. This greatly expands the list of differentially 4-uniform permutations with good nonlinearity and hence provides more candidates for the design of block ciphers.

$4$-uniform BCT permutations from generalized butterfly structure

“…Remark 1. Theorem 1 complements previous work [9,12,18] on butterfly structure and gives rise to the sixth family of 4-uniform BCT permutations in even dimension. It was known from [18] that the closed butterfly V R in Theorem 1 possesses the best known nonlinearity when β = α + 1.…”

“…Let m, k be positive integers such that m is odd and gcd(k, m) = 1. Extending previous work [9,12], Li, Tian, Yu and Wang [18] considered a general bivariate polynomial R(x, y) of the form R(x, y) = (x + αy) 2 k +1 + βy 2 k +1 for any α, β ∈ F 2 m and proved that the corresponding butterflies H R and V R are differentially 4-uniform and have the best known nonlinearity when β = (α + 1) 2 k +1 . Under this condition, however, the closed butterfly V R may not be a permutation.…”

A Further Study of Quadratic APN Permutations in Dimension Nine

“…Unlike Dillon's original permutation, this bivariate structure can easily be defined using larger fields F 2 n as long as n is odd. It was also shown to always be at most differentially 4-uniform in [24], and follow-up works showed that further generalizations had the same property along with the best known nonlinearity [12,19,21]. Being an infinite family containing Dillon's permutation, there was of course hope that it might yield a solution to the big APN problem, but unfortunately it was later proved that it is impossible for a generalized butterfly to be APN unless it operates on 6 bits [14].…”

Построение подстановок пространства $V_{2m}$ с использованием $(2m,m)$-функций

“…Подстановки являются составной частью таких современных криптографических примитивов, как блочные шифры, хэш-функции и некоторые поточные шифры. В последние годы появляются все новые способы построения подстановок с низкой дифференциальной равномерностью, высокой алгебраической степенью нелинейности и высокой нелинейностью [1][2][3][4][5]. Большая часть этих работ посвящена способам построения новых классов подстановок на основе имеющихся, в частности с использованием подстановок меньшей размерности.…”