Investigations on $c$-Boomerang Uniformity and Perfect Nonlinearity

In this paper we extend the notion of boomerang uniformity using a previously defined [21] multiplier differential (in any characteristic). We characterize some of the known perfect nonlinear functions and the inverse function through this new concept. We also characterize this concept via the Walsh transforms as Lie et al. [24] did for the classical boomerang uniformity.

The objects of this study are Boolean and $p$-ary functions (where $p$ is an odd prime) and some of their differential properties. We will introduce here only some needed notation, and the reader can consult [9, 12, 13, 19, 27, 30] for more on Boolean and $p$-ary functions.

For a positive integer $n$ and $p$ a prime number, we let ${\mathbb{F}}_{p^{n}}$ be the finite field with $p^{n}$ elements, and ${\mathbb{F}}_{p^{n}}^{*}={\mathbb{F}}_{p^{n}}\setminus\{0\}$ be the multiplicative group (for $a\neq 0$, we often write $\frac{1}{a}$ to mean the inverse of $a$ in the multiplicative group). We let ${\mathbb{F}}_{p}^{n}$ be the $n$-dimensional vector space over ${\mathbb{F}}_{p}$. We use $\#S$ to denote the cardinality of a set $S$ and $\bar{z}$, for the complex conjugate. We call a function from ${\mathbb{F}}_{p^{n}}$ (or ${\mathbb{F}}_{p}^{n}$) to ${\mathbb{F}}_{p}$ a $p$-ary function on $n$ variables. For positive integers $n$ and $m$, any map $F:{\mathbb{F}}_{p^{n}}\to{\mathbb{F}}_{p^{m}}$ (or, ${\mathbb{F}}_{p}^{n}\to{\mathbb{F}}_{p}^{m}$) is called a vectorial $p$-ary function, or $(n,m)$-function. When $m=n$, $F$ can be uniquely represented as a univariate polynomial over ${\mathbb{F}}_{p^{n}}$ (using some identification, via a basis, of the finite field with the vector space) of the form $F(x)=\sum_{i=0}^{p^{n}-1}a_{i}x^{i},\ a_{i}\in{\mathbb{F}}_{p^{n}},$ whose algebraic degree is then the largest Hamming weight of the exponents $i$ with $a_{i}\neq 0$. For $f:{\mathbb{F}}_{p^{n}}\to{\mathbb{F}}_{p}$ we define the Walsh-Hadamard transform to be the integer-valued function $\displaystyle\mathcal{W}_{f}(u)=\sum_{x\in{\mathbb{F}}_{p^{n}}}\zeta_{p}^{f(x)-{\rm Tr}_{n}(ux)},\ u\in\mathbb{F}_{p^{n}},$ where $\zeta_{p}=e^{\frac{2\pi i}{p}}$ and ${\rm Tr}_{n}:{\mathbb{F}}_{p^{n}}\to{\mathbb{F}}_{p}$ is the absolute trace function, given by $\displaystyle{\rm Tr}_{n}(x)=\sum_{i=0}^{n-1}x^{p^{i}}$ (we will denote it by ${\rm Tr}$, if the dimension is clear from the context). The Walsh transform $\mathcal{W}_{F}(a,b)$ of an $(n,m)$-function $F$ at $a\in{\mathbb{F}}_{p^{n}},b\in{\mathbb{F}}_{p^{m}}$ is the Walsh-Hadamard transform of its component function ${\rm Tr}_{m}(bF(x))$ at $a$, that is,

(If one wishes to work with vector spaces, then one can replace the ${\rm Tr}$ by any scalar product on that environment.)

Given a $p$-ary function $f$, the derivative of $f$ with respect to $a\in{\mathbb{F}}_{p^{n}}$ is the $p$-ary function $D_{a}f(x)=f(x+a)-f(x),\mbox{ for all }x\in{\mathbb{F}}_{p^{n}},$ which can be naturally extended to vectorial $p$-ary functions.

For an $(n,n)$-function $F$, and $a,b\in{\mathbb{F}}_{p^{n}}$, we let $\Delta_{F}(a,b)=\#\{x\in{\mathbb{F}}_{p^{n}}:F(x+a)-F(x)=b\}$. We call the quantity $\delta_{F}=\max\{\Delta_{F}(a,b)\,:\,a,b\in{\mathbb{F}}_{p^{n}},a\neq 0\}$ the differential uniformity of $F$. If $\delta_{F}=\delta$, then we say that $F$ is differentially $\delta$-uniform. If $\delta=1$, then $F$ is called a perfect nonlinear (PN) function, or planar function. If $\delta=2$, then $F$ is called an almost perfect nonlinear (APN) function. It is well known that PN functions do not exist if $p=2$.

The paper is organized as follows. Section 2 contains some background on differential and boomerang uniformity and our extension to $c$-boomerang uniformity. Section 3 contains some characterizations of this concept and connections with prior $c$-differential uniformity, and Section 4 gives its description via Walsh transforms. Section 5 puts together two lemmas needed in the remaining of the paper, and Section 6 deals with perfect nonlinearity and $c$-boomerang uniformity. Section 7 characterizes this uniformity for the inverse function in any characteristic and Section 8 concludes the paper. An appendix with some computational data follows the references.

Wagner [32] introduced the boomerang attack against block ciphers using $S$-boxes. The concept was picked up and used in [3, 22] on some real ciphers (see also [2, 23]). Ten years later, however, a theoretical new cryptanalysis tool based upon this attack was introduced at EUROCRYPT 2018 by Cid et al. [16] namely, the Boomerang Connectivity Table (BCT) and Boomerang Uniformity. In [16], the authors analyzed some of the properties of BCT, like its relationship with the Differential Distribution Table (DDT). They proved that perfect nonlinear (APN) S-boxes (that is, with 2-uniform DDT) always have 2-uniform BCT and for any choice of the parameters, and also showed that the BCT uniformity is greater than or equal to the DDT uniformity (we will display below precisely the relationship between these).

The initial concept of boomerang uniformity was defined for permutations (of course, proper $S$-boxes) in the following way.

Recently, BCT and the boomerang uniformity were further studied by Boura and Canteaut [6]. They showed that the boomerang uniformity is only an affine equivalence invariant but not necessarily, extended affine nor CCZ-equivalence invariant. Further, they also obtained the boomerang uniformity of the inverse function $F(x)=x^{2^{n}-2}$ over ${\mathbb{F}}_{2^{n}}$, for $n$ even, namely, $\beta_{F}=4,6$, when $n\equiv 2\pmod{4}$, respectively, $n\equiv 0\pmod{4}$. Also, for the Gold function $G(x)=x^{2^{t}+1}$ over ${\mathbb{F}}_{2^{n}}$, where $n\equiv 2\pmod{4}$, $t$ even with $\gcd(t,n)=2$, then $\delta_{G}=\beta_{G}=4$.

Mesnager et al. [28] continued the work and showed that the differential uniformity for quadratic functions on ${\mathbb{F}}_{q^{n}}$ ($q$ is a $2$-power) is always $\geq q$, and if it happens to be equal to $q$ for a permutations $F$ then its boomerang uniformity must be $q$, as well. In fact [24], in general, for quadratic permutations $F$, then we have,

It is also easy to show that for monomials $F(x)=x^{d}$, then $\displaystyle\beta_{F}=\max_{b\neq 0}\beta_{F}(1,b)$. For the Bracken-Tan-Tan function (which is an extension of Budaghyan-Carlet function [10]), $F(x)=\alpha x^{2^{s}+1}+\alpha^{2^{k}}x^{2^{-k}+2^{k+s}}$ (under some conditions on the parameters), then $\beta_{F}=4$ (see [28]). More work has been done recently on BCT, and we mention here [7, 11, 25, 31].

Surely, $\Delta_{F}(a,b)=0,2^{n}$ and ${\mathcal{B}}_{F}(a,b)=2^{n}$ whenever $ab=0$. It is well-known from prior work that $\delta_{F}=\delta_{F^{-1}}$ and $\beta_{F}=\beta_{F^{-1}}$. In general, for permutations, $\beta_{F}\geq\delta_{F}$ and they are equal for APN permutations. A natural question is what is the algebraic difference between these two concepts and Boura and Canteaut answered that question in [6], showing that

where ${\mathcal{U}}_{\gamma,a}^{F^{-1}}=\{x\in{\mathbb{F}_{p^{n}}}|D_{\gamma}F^{-1}(x)=a\}$. This was reformulated by Mesnager et al. [28] in the following way:

where ${\mathcal{U}}_{\gamma,a}^{F}=\{x\in{\mathbb{F}_{p^{n}}}|D_{\gamma}F(x)=a\}$, and further, by Li et al. [24], as

and easily observed in [28] that this transforms into (labeling $y=x+\gamma$),

Avoiding the inverse of $F$, allows these last expressions to define the boomerang uniformity for functions that are not necessarily permutations.

Before, we continue with our approach, let us recall the concept we (along with others) introduced in [21] (we will define it in general on ${\mathbb{F}}_{p^{n}}$, $p$ prime, not only for $p=2$).

Inspired by a practical differential attack developed in [5] (though, via a different differential), we extended the definition of derivative and differential uniformity in  [21], in the following way. For a $p$-ary $(n,m)$-function $F:{\mathbb{F}}_{p^{n}}\to{\mathbb{F}}_{p^{m}}$, and $c\in{\mathbb{F}}_{p^{m}}$, the (multiplicative) $c$-derivative of $F$ with respect to $a\in{\mathbb{F}}_{p^{n}}$ is the function

(Observe that, if $c=1$, then we obtain the usual derivative, and, if $c=0$ or $a=0$, then we obtain a shift of the function, in the input/output.)

For an $(n,n)$-function $F$, and $a,b\in{\mathbb{F}}_{p^{n}}$, we let the entries of the $c$-Difference Distribution Table ($c$-DDT) be defined by ${{}_{c}\Delta}_{F}(a,b)=\#\{x\in{\mathbb{F}}_{p^{n}}:F(x+a)-cF(x)=b\}$. We call the quantity

the $c$-differential uniformity of $F$ (observe that we slightly change here the way we denoted the $c$-differential uniformity in [21]). If $\delta_{F,c}=\delta$, then we say that $F$ is differentially $(c,\delta)$-uniform (or that $F$ has $c$-uniformity $\delta$, or for short, $F$ is $\delta$-uniform $c$-DDT). If $\delta=1$, then $F$ is called a perfect $c$-nonlinear (PcN) function (certainly, for $c=1$, they only exist for odd characteristic $p$; however, as proven in [21], there exist PcN functions for $p=2$, for all $c\neq 1$). If $\delta=2$, then $F$ is called an almost perfect $c$-nonlinear (APcN) function. When we need to specify the constant $c$ for which the function is PcN or APcN, then we may use the notation $c$-PN, or $c$-APN. It is easy to see that if $F$ is an $(n,n)$-function, that is, $F:{\mathbb{F}}_{p^{n}}\to{\mathbb{F}}_{p^{n}}$, then $F$ is PcN if and only if ${}_{c}D_{a}F$ is a permutation polynomial.

In light of the formulations (1) via differentials, by using our $c$-differential concept of [21], we extend the notion of boomerang uniformity to $c$-boomerang uniformity for all characteristics, in the following way (see Figure 1).

As in the classical case, we find an alternative formulation that avoids inverses, allowing the definition to be extended to all $(n,n)$-function, not only permutations. Though the proof is not complicated, we label as a theorem, since it is the way to extend the definition to non-permutations.

While we already knew that, in general, the $c$-differential uniformity of $F,F^{-1}$ are not the same, we show below a connection (that we did not observe in [21]) between some of the entries in the $c$-Differential Distribution Table of a permutation monomial $F$ and the one of the inverse of $F$.

We next show a connection between $c$-differential and $c$-boomerang uniformities.

Using a method of Carlet [14] and Chabaud and Vaudenay [15] connecting the differential uniformity of an $(n,m)$-function to its Walsh coefficients, we characterized the $c$-differential uniformity in [21] and Li et al. [24] characterized the boomerang uniformity. We can use a similar method to do the same for the $c$-boomerang uniformity, in any characteristic.