Nonlinear diffusion layers

Abstract

In the practice of block cipher design, there seems to have grown a consensus about the diffusion function that designers choose linear functions with large branch numbers to achieve provable bounds against differential and linear cryptanalysis. In this paper, we propose two types of nonlinear functions as alternative diffusing components. One is based on a nonlinear code with parameters (16,256,6) which is known as a Kerdock code. The other is a general construction of nonlinear functions based on the T-functions, in particular, two automatons with modular addition operations. We show that the nonlinear functions possess good diffusion properties; specifically, the nonlinear function based on a Kerdock code has a better branch number than any linear counterparts, while the automatons achieve the same branch number as a linear near-MDS matrix. The advantage of adopting nonlinear diffusion layers in block ciphers is that, those functions provide extra confusion effect while a comparable performance in the diffusion effect is maintained. As an illustration, we show the application of the nonlinear diffusion functions in two example ciphers, where a 4-round differential characteristic with the optimal number of active Sboxes has a probability significantly lower (2 16 and 2 10 times, respectively) than that of a similar cipher with a linear diffusion layer. As a result, it sheds light upon an alternative strategy of designing lightweight building blocks.

Beyond-Birthday-Bound Security for 4-round Linear Substitution-Permutation Networks

“…The bound becomes more meaningful with such parameters. [LRL18] that the use of non-linear permutation layers may indeed increase security against differential/linear attacks.…”

“…These public permutations are then extended to a keyed permutation on wn-bit inputs for some integer w by iterating the following steps: S-boxes are typically highly non-linear, and, in fact, serve as the only source of nonlinearity in many blockciphers. There is no a priori restriction on the (non-)linearity of the Permutation step, and the use and advantages of non-linear permutations was recently explored [LRL18]. Though, modern blockciphers still tend to use linear or affine mappings for the Permutation step [Bir11], which involves a simple key-mixing step followed by an invertible linear or affine transformation.…”

A classification of S-boxes generated by Orthogonal Cellular Automata

“…Moreover, diffusion layers are usually implemented with linear mappings, such as the MDS matrix in Rijndael [8] or other similar transformations [18]. However, there has been a recent interest also in nonlinear diffusion layers [19], which integrate confusion and diffusion. Thus, superposition S-boxes might be interesting for this specific application.…”

“…Therefore, we can confirm the conclusion of our conference paper [26]: nonlinear OCA cannot be used to design S-boxes in the substitution layer of SPN ciphers. Still, we remark that these S-boxes might be useful in the design of nonlinear diffusion layers [19], since it is not required to reach a nonlinearity close to the theoretical upper bounds in that use case. Indeed, the goal of a nonlinear diffusion layer is to provide extra confusion in addition to that already given by a classic substitution layer.…”

Low-Complexity Nonlinear Self-Inverse Permutation for Creating Physically Clone-Resistant Identities

“…In addition, special matrices were also used as permutation functions in the diffusion layer such as AES cipher [46]. Recently, Yunwen et al [47] proposed two types of nonlinear functions as alternative diffusing components. The first type relies on a nonlinear code, which is known as a Kerdock code and the second type relies on the T-functions.…”