On the Influence of the Algebraic Degree of $F^{-1}$ on the Algebraic Degree of $G \circ F$

Abstract

We present a study on the algebraic degree of iterated permutations seen as multivariate polynomials. The main result shows that this degree depends on the algebraic degree of the inverse of the permutation which is iterated. This result is also extended to noninjective balanced vectorial functions where the relevant quantity is the minimal degree of the inverse of a permutation expanding the function. This property has consequences in symmetric cryptography since several attacks or distinguishers exploit a low algebraic degree, like higher order differential attacks, cube attacks, and cube testers, or algebraic attacks. Here, we present some applications of this improved bound to a higher degree variant of the block cipher , to the block cipher Rijndael-256 and to the inner permutations of the hash functions ECHO and JH.Index Terms-Algebraic degree, block ciphers, hash functions, higher order differential attacks.

Threshold Implementations of All 3 ×3 and 4 ×4 S-Boxes

“…The degree of such a permutation F is the algebraic degree of the (n, n) vectorial Boolean function [5] or also called n-bit S-box. Any such function F (x) can be considered as an n-tuple of Boolean functions (f 1 (x), .…”

CBEAM: Efficient Authenticated Encryption from Feebly One-Way ϕ Functions

“…Research by Boura and Canteaut on the algebraic degree of iterated permutations seen as multivariate polynomials shows that the degree depends on the algebraic degree of the inverse of the permutation which is iterated [5]. This indicates exceptional algebraic security for our proposal.…”

“…This is a desirable quality in a Sponge-based cryptoprimitive as computation of inverse is not required in normal operation. Boura and Canteaut have showed that complex inverse makes the resulting iteration strong even if it is not explicitly computed [5]. We have discovered new functions of φ type which exhibit much more radical asymmetry than the χ function of KECCAK.…”

“…However, one should examine the reference 16-bit, 64-bit, and 256-bit implementations for architecture-specific optimizations. [2] rw [3] rw [4] rw [5] rw [6] rw [7] rw [8] rw [15] rw [14] rw [13] rw [12] rw [11] rw [10] rw [9] 16 × 16 = 256 -bit state r Step 1: Vertical linear transform λ. This step is easiest to implement by viewing the state as 64-bit words ("quadwords")…”

“…This indicates high algebraic resistance for our construct [5] and shows that φ functions are in some ways superior to conventional designs based on S-Box lookups.…”