“Reader digest of " 16-year achievements on Boolean functions and open problems

“Reader digest of " 16-year achievements on Boolean functions and open problems

Sihem Mesnager

University of Paris VIII (department of Mathematics), University of Paris XIII (LAGA), CNRS and Telecom Paris

The 5th International Conference on Boolean functions and their

Applications (BFA 2020) 15-17 September 2020, Norway

1 / 39

Boolean functionsFⁿ2→F2orF2ⁿ→F2

+

In both Error correcting coding and Symmetric cryptography, Boolean functions are important objects !

Boolean functions

Symmetric Cryptosystems (secret key)

Reed-Muller codes, etc.

Coding Theory Cryptography

Boolean functions in Error Correcting Coding

B_n={f :Fⁿ2→F2}

TheReed-Muller codeRM(r,n)can be defined in terms ofBoolean functions:RM(r,n)is the set of alln-variable Boolean functionsB_nof algebraic degrees at mostr. More precisely, it is the linear code of all binary words of length2ⁿcorresponding in the truth-tables of these functions.

For every0≤r≤n, the Reed-Muller codeRM(r,n)of orderr, is a linear code :











 2ⁿ

|{z}

length

,

r

X

i=0

n i

| {z }

dimension

, 2^n−r

|{z}

minimum distance













3 / 39

Cryptographic framework for Boolean functions

Pseudo-random generator with

L Ciphertext

Plaintext

Stream ciphers

Encrypting operation Key

x

x

· · ·

y

y

· · · Plaintext

Ciphertext

outputs of

(depending on the key) over x

x

Bloc ciphers

Cryptographic framework for Boolean functions

The two models of pseudo-random generators with a Boolean function :

mt: plain text ct: cipher text kt: key stream

L 6

6 -

mt

ct

k_t

f

LFSR1 x^(t)₁- LFSR2 x^(t)₂-

LFSRn x^(t)n-

.. .

LFSR : Linear Feedback Shift Register

•

A Boolean function combines the outputs of several LFSR to produce the key stream : a combining (Boolean) function f .

•The initial state of the LFSR’s depends on a secret key.

5 / 39

Cryptographic framework for Boolean functions

FILTER MODEL :

s

s

s

6 6

6

L L

L

-

? ? ?

x

x

x

f

x

x

output : key stream

•

A Boolean function takes as inputs several bits of a single LFSR to produce the key stream : a filtering (Boolean) function f

+

To make the cryptanalysis very difficult to implement, we have to

pay attention when choosing the Boolean function, that has to

follow several recommendations : cryptographic criteria !

Some main cryptographic criteria for Boolean functions

•CRITERION1: To protect the system against distinguishing attacks, the cryptographic function must bebalanced, that is, its Hamming weight is2ⁿ⁻¹.

•CRITERION2: The cryptographic function must have ahigh algebraic degreeto protect against the Berlekamp-Massey attack.

The Hamming distanced_H(f,g) := #{x∈F2ⁿ|f(x)6=g(x)}.

•CRITERION3: To protect the system against linear attacks and correlation attacks,the Hamming distancefrom the cryptographic functionto all affine functions must be large.

•CRITERION4: To be resistant against correlation attacks on combining registers, a combining functionf must bem-resilientwheremis as large as possible.

Algebraic immunity off :AI(f)is the lowest degree of any nonzero functiong such thatf ·g=0or(1+f)·g=0.

•CRITERION5: To be resistant against algebraic attacks,f must be ofhigh algebraic immunitythat is, close to the maximumdⁿ₂e. But this condition is not sufficient because of Fast Algebraic Attacks (FFA) : cryptographic functions should beresistant against FFA!

Some of these criteria are antagonistic ! Tradeoffs between all these criteria must be found.

7 / 39

The discrete Fourier (Walsh) Transform of Boolean functions

DEFINITION (THE DISCRETEWALSHTRANSFORM) χbf(a) =X

x∈Fⁿ2

(−1)^f(x)+a·x, a∈Fⁿ2

where "·" is the canonical scalar product inFⁿ2defined by x·y=Pn

i=1xiyi,∀x= (x1, . . . ,xn)∈Fⁿ2, ∀y= (y1, . . . ,yn)∈Fⁿ2. or

DEFINITION (THE DISCRETEWALSHTRANSFORM) χbf(a) = X

x∈F2n

(−1)^{f(x)+Tr1n(ax)}, a∈F2ⁿ

where "Trⁿ₁" is the absolute trace function onF2ⁿ.

Cryptographic Boolean functions

Cryptographic parameters for Boolean and vectorial functions Nonlinearity and higher-order nonlinearity

Correlation immunity and resiliency

Algebraic immunity and fast algebraic immunity Boomerang uniformity

etc.

Interests are in four aspects :

1 Characterizations

2 Constructions

3 Classifications

4 Enumerations

Extension of the theory of cryptographic Boolean functions to :

1 Vectorial Boolean functions

2 Functions in odd characteristic

3 Generalized functions

9 / 39

Bent functions

A much particular interest in : Bent Boolean functions

Bent vectorial Boolean functions

Subclasses of bent Boolean functions : hyper-bent Boolean functions Super classes of bent Boolean functions : plateaued Boolean functions + Book [SM, 2016] : Bent Functions - Fundamentals and Results. Springer

2016

+ Survey [Carlet-SM 2016] : Four decades of research on bent functions.

Des. Codes Cryptogr. 2016

Boolean functions and codes

Reed-Muller codes Minimal codes LRC codes LCD codes etc.

11 / 39

Approaches and tools used to solve problems in the Boolean world

Approaches: algebraic approach, combinatoric approach, asymptotic approach and geometric approach.

Mathematical tools :

discrete Fourier/Walsh transforms

polynomials over finite fields (polynomials, Linearized polynomials, permutation polynomials, involutions, Dickson polynomials, polynomials e- to-1, etc)

functions over finite fields (symmetric functions, quadratic forms, etc) tools from algebraic geometry (algebraic curves, elliptic curves, hyper-elliptic curves, etc)

finite geometry (oval polynomials, hyperovals, etc) linear algebra and group theory

tools from combinatorics

tools from arithmetic number theory

A cryptographic parameter for Boolean functions : correlation immunity

DEFINITION

An n-variable Boolean function f is said to be

if any sub-function deduced from f by fixing at most k inputs is balanced, equivalently,

χbf(v) = 0

for all v

such that

w

k

If f is moreover balanced then f is said to be

A CRYPTOGRAPHIC CRITERION

: a (combining) Boolean function must be resilient of order m with m large.

A new application of correlation immune functions (not resilient) in relation with block ciphers is with the counter-measure against side channel attacks.

13 / 39

A cryptographic parameter for Boolean functions : resilience

Estimating the number of Boolean functions satisfying one or more cryptographic criteria is useful :

it indicates for which values of parameters there is a chance of finding good cryptographic Boolean functions by random search.

a large number of Boolean functions is necessary if we want to impose several constraints on the function.

+

Count the number of m-resilient n-variable Boolean functions (seems to be an intractable open problem !)

NOTATION

.

Res

: the set of all n-variable Boolean functions which are m-resilient.

. #Res^m_n

: the cardinality of Res

.

Known results for#Res^m_n

The value of

is known for m

n

[Camion et al 1991].

The value of

is known for n

[Harary-Palmer 1973], [Le Bars-Viola 2007].

Asymptotic estimation on

[Canfield et al 2010].

Upper bounds : [Schneider 1990] (b

), [Carlet-Klapper 2002] (b

), [Carlet-Gouget 2002] (b

) :

-

1 ⁿ₂

? n

m b

is better

than b

and b

b

and b

improve upon b

b

b

b

b

15 / 39

Our approach for#Res^m_n

We use the characterization of the resiliency by means of the

Numerical Normal Form (N.N.F) (representation of a Boolean function as polynomial over

).

DEFINITION (CARLET

-G

1999)

We call Numerical Normal Form (NNF) the representation of

pseudo-Boolean functions in

x

x

x

x

Our approach for#Res^m_n

We use the characterization of the resiliency by means of the

Numerical Normal Form (N.N.F) (representation of a Boolean function as polynomial over

).

PROPOSITION (CARLET

-G

1999)

Let f :

Let g(x) = f

x

x

(viewed as an integer-valued function). Then f is m-resilient if and only if,

n

m

1

We show that counting m-resilient n-variable Boolean functions is equivalent to count the number of integer points in a particular convex polytope.

2

We introduce a multivariate generating function whose one of its coefficients is

.

3

This derives us to interpret

as a Taylor coefficient in the series expansion of a multivariate partial fraction.

17 / 39

Two representations formulas for#Res^m_n

PROPOSITION (SM 2007)

#Res^m_n

is the coefficient of

I⊆{1,...,n}

z

in the series expansion of

Y

I⊆{1,...,n}

(1+

z

#J≤n−m−1

1 1−Y

I⊇J

z

where

b

min(i,n−m−1)

X

j=1

i j

2^j−1,

i

n}

PROPOSITION ([SM 2007])

#Res^m_n = 1 (2iπ)²ⁿ

Z

· · · Z

γ⊂C

Y

I⊆{1,...,n}

1+

z

z

Y

#J≤n−m−1

1 1−Y

I⊇J

z

Y

I⊆{1,...,n}

dz

where

b

min(i,n−m−1)

X

j=1

i j

2^j−1,

i

n}

and

n}, z

18 / 39

Two representations formulas for#Res^m_n

OPEN PROBLEM

Compute the value of

for n

or improve the known upper bounds on

.

19 / 39

A cryptographic parameter for Boolean functions : nonlinearity

ACRYPTOGRAPHIC CRITERION: The distance of a cryptographic function to all affine functions must be high to protect the system against linear attacks and correlation attacks.

+ Thenonlinearityoff is the minimum Hamming distance to affine functions :

DEFINITION (NONLINEARITY)

f :F2ⁿ →F2a Boolean function. The nonlinearity denoted bynl(f)off is

nl(f) := min

l∈An

dH(f,l) whereA_n:is the set of affine functions overF2ⁿ.

A cryptographic parameter for Boolean functions : therth-order nonlinearity

DEFINITION (r-TH-ORDER NONLINEARITY :nlr(f)(r∈N,r≤n))

Ther-th order nonlinearityoff is the minimum Hamming distance betweenf and the set of all then-variable Boolean functions of algebraic degree at most r:nl_r(f) = min

g∈RM(r,n)d_H(f,g)

+ We were interested in :

for a given integerk,nl_r(f)ofn-variable Boolean functionsf with algebraic immunityk.

the maximal value ofnlr(f)(r>1) ofn-variable Boolean functionsf.

21 / 39

A cryptographic parameter for Boolean functions : therth-order nonlinearity

In 2005 : [Lobanov 2005] provided a lower bound on the nl

: nl

i=0 n−r

i

In 2006 : two lower bounds on nl

involving the algebraic

immunity ([Carlet 2006],[Carlet-Dalai-Gupta-Maitra 2006]). None

of them is better than the other one for all values of the algebraic

immunity.

A cryptographic parameter for Boolean functions : therth-order nonlinearity

In 2008 : a new lower bound on the rth-order nonlinearity profile of Boolean functions, given their algebraic immunity, that improves significantly upon the known lower bounds [Carlet et al. 2006] for all orders and upon the bound [Carlet 2006 ] for low orders :

Let f be an n-variable Boolean function of algebraic immunity k and let r be a positive integer strictly less than k. Then

nl

k−r−1

X

i=0

n i

+

k−r−1

X

i=k−2r

n

r i

23 / 39

A cryptographic parameter for Boolean functions : therth-order nonlinearity

In 2010 : [Rizomiliotis 2010] gave precisions on the bounds, involving the maximum between the minimal algebraic degree of the nonzero annihilators of f and the minimal algebraic degree of the nonzero annihilators of f⊕1.

In 2015 : [SM, McGrew, Davis, Steele, Marsten 2015] constructed a family of Boolean functions where the first bound [Carlet

2006](the presumed weaker bound) is tight and the second bound [Carlet et al. 2006] is strictly worse than the first bound. They showed that the difference between the two bounds can be made arbitrarily large.

In 2020 : [Carlet 2020] gave a very general proof of Lobanov

result.

A cryptographic parameter for Boolean functions : therth-order nonlinearity

OPEN PROBLEM

Improve further the known lower bounds on the rth-order nonlinearity profile of Boolean functions, given their algebraic immunity.

25 / 39

Covering radius of the Reed-Muller codeRM(r,n)

+ The maximal nonlinearity of orderrof n-variable Boolean functions coincides with the covering radius ofRM(r,n).

DEFINITION (COVERING RADIUS OF THEREED-MULLER CODERM(r,n)) Covering radius of the Reed-Muller codeRM(r,n)of orderrand length2ⁿ:

•ρ(r,n) := max

f∈Bn

min

g∈RM(r,n)d_H(f,g) = max

f∈Bn

nl_r(f)

whereB_n:={f :Fⁿ2→F2}. Or :

•ρ(r,n) := min{d∈N| ∪

x∈RM(r,n)B(x,d) =Fⁿ2} whereB(x,d) :={y∈Fⁿ2|dH(x,y)≤d}(Hamming ball)

+ The covering radius plays an important role in error correcting codes : measures the maximum errors to be corrected in the context of maximum-likelihood decoding.

•The best upper bound ofρ(r,n)(r>1) before 2007 :[Cohen-Litsyn 1992].

Covering radius of the Reed-Muller codeRM(r,n)

[Carlet-SM 2007]Letr>1. The covering radius of the Reed-Muller code of orderrsatisfies

asymptotically :ρ(r,n)≤2ⁿ⁻¹−

√ 15

2 ·(1+√

2)^r−2·2^n/2+O(n^r−2)

Our results have improved the best known upper bounds dating from 15 years ago. Up to now, our bounds are the best bounds known in the literature.

Our results are obtained by induction onrthanks to improved upper bounds on the covering radiusρ(2,n):

THEOREM (CARLET-SM 2007)

For every positive integern≥17, the covering radiusρ(2,n)of the second-order Reed-Muller codeRM(2,n)is upper bounded by

$ 2ⁿ⁻¹−

√ 15 2 ·2ⁿ² ·

1−122929

21·2ⁿ −155582504573 4410·2²ⁿ

%

(1)

27 / 39

Brief outline of the proof

B

We prove an asymptotic upper bound on the covering radius

n) of the Reed-Muller code of order

:

ρ(2,

n)

15 2ⁿ²⁻¹+

O(1).

Indeed, we have :

∀k∈N, ρ(2,

n)

f∈Bn

sS_k+1(f) Sk(f)

where

S_k(f) = X

g∈RM(2,n)



 X

x∈Fⁿ₂

(−1)^f(x)+g(x)





2k

,

f

k

Brief outline of the proof

∀k∈N, ρ(2,

n)

f∈B_n

s

S_k+1(f) S_k(f)

1

Decomposition of

into sums of characters : S

w=0

N

M

where M

g∈RM(n−3,n) wt(g)=2w

(−1)^hf,gi

and N

is an integer independent of f .

2

Lower bound of the sums of characters M

thanks to the characterization of the words of Reed-Muller codes given by Kasami, Tokura and Azumi :

, M

M

.

3

Lower bound of

k(f)

,

, leading to an upper bound

n)

rS_k+1^min

S_k^min

for k

where

varies according to the value of n and

w=0

N

M

.

29 / 39

Covering radius of the Reed-Muller codeRM(r,n)

Remarks :

The greater we take the value ofk, the better the upper bound obtained.

Our method could be applied directly toρ(r,n)but the best result is obtained with our method toρ(2,n).

We were able to improveρ(2,n)thanks to the characterization of those elements of theRM(r,n)whose Hamming weights are<2.5dmin. OPEN PROBLEM

Improve further the covering radius of the Reed-Muller codeRM(2,n)by getting a better estimation of the sums of charactersM^(2w)_f .

The covering radius ofRM(1,n)and bent functions

+ The Covering radiusρ(1,n)of the Reed-Muller codeRM(1,n)coincides with the maximum nonlinearitynl(f).

+ General upper bound on the nonlinearity:nl(f)≤2ⁿ⁻¹−2ⁿ²⁻¹ Whennis odd,ρ(1,n)<2ⁿ⁻¹−2ⁿ²⁻¹

Whenniseven,ρ(1,n) =2ⁿ⁻¹−2ⁿ²⁻¹and the associatedn-variable Boolean functions are thebent functions.

DEFINITION (BENT FUNCTION[ROTHAUS 1976])

f :F2ⁿ →F2 (neven) is said to be a bent functionifnl(f) =2ⁿ⁻¹−2ⁿ²⁻¹

A main characterization of bentness :

(f is bent) ⇐⇒ χb_f(ω) =±2ⁿ², ∀ω∈F2ⁿ

+ some classes of bent functions are known (Maiorana-Mc Farland’s class, Spreads classPS⁻,PS_ap, ClassH).

31 / 39

Spread

DEFINITION (SPREAD)

Am-spread ofF2ⁿis a set of pairwise supplementarym-dimensional subspaces ofF2ⁿwhose union equalsF2ⁿ

EXAMPLE (ACLASSICAL EXAMPLE OFm-SPREAD)

inF2ⁿ :{uF2^m,u∈U}whereU:={u∈F2ⁿ |u^2m+1=1}

inF2ⁿ ≈F2^m×F2^m :{Ea,a∈F2^m} ∪ {E∞}whereEa:={(x,ax) ; x∈F2^m} andE∞:={(0,y) ;y∈F2^m}={0} ×F2^m.

+ We were interested inbentfunctionsgdefined onF2^m×F2^m, whose restrictions to elements of them-spread{Ea,E_∞}arelinear.

ClassH

Functionsgof the classHdefined overF2^m×F2^m whoserestrictions to elements of them-spread{E_a,E∞}are linear, are of the form (2)

g(x,y) =

Tr^m₁ xψ ^y_x

ifx6=0

Tr^m₁(µy)ifx=0 (2)

whereψ:F2^m →F2^m etµ∈F2^m. THEOREM (CARLET-SM 2010)

A functiongof the classHsi bent if and only if

G(z) :=ψ(z) +µzis a permuation onF2^m (3)

∀β ∈F^?2^m,the functionz7→G(z) +βzis 2-to-1 onF2^m. (4) the condition (4) implies condition (3).

A functionGfromF2^m toF2^m satisfying (4) if and only if for allγ∈F2^m, the functionHγ :z∈F2^m 7→

G(z+γ)+G(γ)

z ifz6=0

0ifz=0 is a permutation overF2^m.

33 / 39

o-polynomes

DEFINITION

Letmbe any positive integer. A permutation polynomialGoverF2^m is called an o-polynomial if, for everyγ∈F2^m, the functionHγ :

z∈F2^m 7→

G(z+γ)+G(γ)

z ifz6=0

0ifz=0 is a permutation onF2^m.

The notion of o-polynomial comes from Finite Projective Geometry :

+ There is a close connection between "o-polynomials" and "hyperovals" : DEFINITION (AHYPEROVAL OFPG2(2ⁿ))

Denote byPG2(2ⁿ)the projective plane overF2ⁿ.

A hyperoval ofPG2(2ⁿ)is a set of2ⁿ+2points no three collinear.

A hyperoval ofPG2(2ⁿ)can then be represented by

D(f) ={(1,t,f(t)),t∈F2ⁿ} ∪ {(0,1,0),(0,0,1)}wheref is an o-polynomial.

ClassH, Niho bent functions and o-polynomial

ClassH(bent functions in bivariate forms ; contains a class H introduced by Dillon in 1974).

ClassH Niho bent functions

o-polynomials (1)

(2)

OPEN PROBLEM

Find new Niho bent functions and find new o-polynomials.

35 / 39

Hyper-bent Boolean functions

DEFINITION (HYPER-BENTBOOLEAN FUNCTION[YOUSSEF-GONG01]) f :F2ⁿ →F2 (neven) is said to be a hyper-bent if the functionx7→f(xⁱ)is bent, for every integerico-prime to2ⁿ−1.

Characterization :f is hyper-bent onF2ⁿif and only if its extended Hadamard transform takes only the values±2ⁿ².

DEFINITION (THE EXTENDED DISCRETEFOURIER(WALSH) TRANSFORM)

∀ω∈F2ⁿ, χb_f(ω,k) = X

x∈F2n

(−1)^{f(x)+Trn1(ωxk)},with(k,2ⁿ−1) =1.

Hyper-bent functions have properties stronger than bent functions ; they are rarer than bent functions.

+ Hyper-bent functions are used in S-boxes (DES).

+ A new criterion[Canteaut-Rotella, 2016]given on filtered LFSRs has revived the interest inhyper-bent functions.

+ New results on (generalized) hyper-bent functions[SM 2020].

Characterizations of hyper-bent Boolean functions in polynomial forms

NOTATION

We denote byDn the set ofbentfunctionsf defined onF2ⁿ by f(x) =P

iTr^o(d₁ ⁱ⁾(aix^di)with∀i,di≡0 (mod 2^m−1)such thatf(0) =0.

All theknown constructionsof hyper-bentness are obtained for functions inD_n.

In 2020,[SM-Mandal-Tang, 2020]provided new construction method and characterizations of the hyper-bentness property.

OPEN PROBLEM

Find new hyper-bent functions outside the setDn.

37 / 39

Conclusions

An intensive work has been done on Boolean functions but many interesting problems are still open.

An important reference in this topic is the extraordinary book of Claude Carlet entitled "Boolean Functions for Cryptography and Coding Theory

" to appear in Cambridge Press.

Book of Claude Carlet

Claude Carlet

BOOLEAN FUNCTIONS for CRYPTOGRAPHY

and CODING THEORY

39 / 39