Functions on Finite Fields, Boolean Functions, and S-Boxes

Transcription

1 Functions on Finite Fields, Boolean Functions, and S-Boxes Claude Shannon Institute and School of Mathematical Sciences University College Dublin Ireland 1 July, 2013

2 Boolean Function Let F 2 = {0, 1} be the integers modulo 2. Let n be a positive integer. A Boolean function in n variables is a function f : (F 2 ) n F 2 (named after George Boole, professor in Cork, Ireland) There are 2 (2n) Boolean functions in n variables. A Boolean function can be given by listing all the possible values Input Value (n = 3 here)

3 Boolean Function Usually we use variables x 1,..., x n called Boolean variables (taking values 0,1) and we write the function as f (x 1,..., x n ) Example: n = 3, f (x 1, x 2, x 3 ) = x 1 x 2 + x 3 For large n this is more efficient than the truth table! Input Value Suitable for software and hardware, see other talks.

4 Boolean Function How many functions can we write down in this way? Note that xi 2 = x i for Boolean variables. When n = 3, any function is a 0,1 combination of 1, x 1, x 2, x 3, x 1 x 2, x 1 x 3, x 2 x 3, x 1 x 2 x 3. In other words, any function can be written c c 1 x 1 + c 2 x 2 + c 3 x 3 + c 4 x 1 x 2 + c 5 x 1 x 3 + c 6 x 2 x 3 + c 7 x 1 x 2 x 3 where c i F 2. Note: 8 terms, so 2 8 such functions. All of them! In general, any Boolean function in n variables can be written c u x u where c u F 2, x u = x u 1 1 x n un, u = (u 1,..., u n ) (F 2 ) n. This is called the Algebraic Normal Form (ANF) of f. u

5 Boolean Function The algebraic degree of f is the max of the degrees of the terms in the ANF. e.g. f (x 1, x 2, x 3 ) = x 1 x 2 + x 3 has algebraic degree 2. High algebraic degree is needed for some cryptographic applications, e.g. as a combining function in stream ciphers:

6 Linear Boolean Function If the algebraic degree is 1, f looks like f (x 1,..., x n ) = a 0 + a 1 x a n x n and we say that f is affine linear. Say f is linear if a 0 = 0. Linear functions can also be defined by f (x + y) = f (x) + f (y). The set of all affine linear functions in n variables is important. There are 2 n+1 such functions. In error-correcting code terminology, this set is the first-order Reed-Muller code, denoted RM(1, n).

7 Nonlinearity, Boolean Function Define the Hamming distance between two Boolean functions f and g by d(f, g) = Number of x (F 2 ) n with f (x) g(x) The distance from f to the set of affine linear functions is min d(f, a) a RM(1,n) This is called the nonlinearity of f. Combining functions in stream ciphers need high algebraic degree, high nonlinearity, and some other criteria are also important (balanced, resilient,...) but are not the topic of this talk. Research problem: how to find functions that satisfy all the criteria. (see other talks)

8 Bent Function What do we mean by high nonlinearity? It can be proved that the nonlinearity of a Boolean function is at most 2 n 1 2 n 2 1 Boolean functions that meet this bound are called bent functions. Unfortunately bent functions by themselves do not satisfy some of the other cryptographic criteria.

9 Walsh Transform The nonlinearity is nicely related to the Walsh transform. The Walsh (or Walsh-Hadamard, or Fourier) transform of a Boolean function f is f (a) = x (F 2 ) n ( 1) f (x)+a(x) where a(x) is any linear Boolean function. This measures how much f agrees with a. Maximising f (a) gives the nearest linear function to f. Nonlinearity(f ) = 2 n max f (a) a

10 Boolean Function, Finite Field There is another common way to write down a Boolean function, i.e. another representation, using a finite field. Recall that a finite field F 2 n (also denoted GF (2 n )) is a field with 2 n elements. In a field you can add, subtract, multiply and divide (except by 0). The field F 2 n is constructed by finding an irreducible polynomial of degree n and performing multiplication modulo this polynomial. The elements of F 2 n are all polynomials of degree < n with coefficients in F 2.

11 Boolean Function, Finite Field Example: x 2 + x + 1 is irreducible over F 2. This polynomial can be used to construct a finite field with 2 2 = 4 elements. Elements are 0, 1, x, x + 1 and x 2 + x + 1 = 0 in this field. Example: x 8 + x 4 + x 3 + x + 1 is irreducible over F 2. This polynomial can be used to construct a finite field with 2 8 = 256 elements. This example is important in AES.

12 Boolean Function, Finite Field Because you can add, subtract, multiply, divide, elements in finite fields, we can construct functions F 2 n F 2 n using these operations, for example, f (x) = x 3, f (x) = 1 x, f (x) = x 23 + x 9 + x x 2 + x + 1 (which are defined everywhere the denominator is nonzero) The trace is the function Tr : F 2 n F 2 defined by Tr(x) = x + x 2 + x x 2n 1 Given any function f : F 2 n F 2 n, x f (x), we can obtain a Boolean function F 2 n F 2 by taking x Tr(f (x)). Can all Boolean functions be obtained in this way?

13 Boolean Function, Finite Field This point of view can be mathematically simpler. We are using F 2 n for (F 2 ) n. For example, a maximal LFSR sequence (s i ) of period 2 n 1 can be described as s i = Tr(cα i ) where α is a primitive element in the finite field F 2 n.

14 S-Box Claude Shannon introduced some design criteria for ciphers. He proposed confusion and diffusion in the encryption algorithm. Many symmetric block ciphers (and hash functions) now have an S-Box to provide the confusion.

15 Vectorial Boolean Functions This S-box represents a function from (F 2 ) 4 to itself. We need to talk about functions from (F 2 ) n (F 2 ) n, or functions F 2 n F 2 n. These are sometimes called vectorial Boolean functions. So consider f : (F 2 ) n (F 2 ) n, where x (f 1 (x),..., f n (x)) The f i are called the coordinate functions of f. Each f i is a Boolean function. [We could also have (F 2 ) n (F 2 ) m, like DES for example.]

16 Vectorial Boolean Functions, S-Boxes Functions used in S-Boxes need to have several properties, to be resistant to various attacks. 1 Differential Attack 2 Linear Attack 3 others omitted for this talk.

17 Differential Cryptanalysis Consider equations f (x + a) f (x) = b, an input difference of a and an output difference of b. In differential cryptanalysis one exploits an output difference which occurs with high probability. To be resistant to this attack, for every a and b the equation f (x + a) + f (x) = b should have a small number of solutions x. The highest possible number of solutions is called the differential uniformity of f. The smallest (best) possible differential uniformity is 2, because if x is a solution, then x + a is another solution.

18 Vectorial Boolean Functions, Walsh Transform We extend the definition of Walsh/Fourier transform to these functions: f (a, b) := where x (F 2 ) n ( 1) b,f (x) + a,x a = (a 1,..., a n ), a i F 2, a, x = a 1 x a n x n b = (b 1,..., b n ), b i F 2, b, f (x) = b 1 f 1 (x) + + b n f n (x) The nonlinearity of a vectorial Boolean function (F 2 ) n (F 2 ) n is the minimum of the nonlinearities over all linear combinations of the coordinate Boolean functions. In other words, Nonlinearity(f ) = 2 n max f (a, b) a,b (b 0)

19 Linear Cryptanalysis This is also a powerful attack. Try to approximate the function in the S-box by a linear function. Best resistance is provided by functions with highest nonlinearity.

20 How do we find good functions for S-Boxes? Research problem: find functions from (F 2 ) n (F 2 ) n, or functions F 2 n F 2 n, that are good for S-Boxes. (high nonlinearity, low differential uniformity,...) Method 1: use random search. Method 2: use algebraic construction. (Both methods have several sub-methods.)

21 Nonlinearity n = 8 Largest possible nonlinearity is = 112. Random search typically gives nonlinearity of 94, at most 98

22 Differential Uniformity n = 8 Smallest possible differential uniformity is 2. Random search typically gives diff. uniformity of 12, at best 8

23 How do we find good functions for S-Boxes? What about the function f : F 2 n F 2 n defined by f (x) = 1 x and f (0) = 0. The nonlinearity is given by the sum K(a, b) = x F 2 n ( 1) Tr(bx 1 +ax) This is known as a Kloosterman sum. There is a lot of literature about Kloosterman sums. In particular, from the Weil bound it is known that 2 n/2+1 K(a, b) 2 n/2+1 and it follows that the nonlinearity is 112 when n = 8.

24 How do we find good functions for S-Boxes? It is not hard to show that the differential uniformity is 4. (Exercise: show this.) This function, f (x) = x 1, is the function used in the S-Box in Rijndael/AES.