Constructing Symmetric Boolean Functions with Maximum Algebraic Immunity

Transcription

1 Cotructig Symmetric Boolea Fuctio with Maximum Algebraic Immuity Keqi Feg, Feg Liu, Logiag Qu, Lei Wag Abtract Symmetric Boolea fuctio with eve variable ad maximum algebraic immuity AI(f have bee cotructed i A. Braee thei [3]. I thi correpodece we how more cotructio of uch Boolea fuctio icludig the geeralizatio of a reult i [3] ad prove a coecture raied i [3]. Idex Term: Symmetric Boolea fuctio, algebraic immuity. I. INTRODUCTION I recet year algebraic attac ha become a importat method i cryptographic aalyzig tream ad bloc cipher ytem, ee [, 2, 6, 7, 8]. A ew cryptographic property for deigig Boolea fuctio to reit thi id of attac, called algebraic immuity, ha bee itroduced ad tudied i [3, 4, 5, 9, 0,, 2]. Let B ad SB be the rig of the Boolea fuctio ad the ymmetric Boolea fuctio repectively with variable x, x 2,..., x. For f B, the algebraic immuity of f, deoted by AI(f, i defied to be the mallet degree of o-zero g B uch that fg 0 or ( fg 0. It i proved i [8, ] that AI(f /2 for all f B. Oe of the iteretig problem i to determie the Boolea fuctio with maximum algebraic immuity. I thi paper, we preet ome ymmetric Boolea fuctio with maximum AI. A ymmetric Boolea fuctio f SB ca be characterized by a vector v f (v f (0, v f (,..., v f ( F 2 v f (i f(x for x F2 with Hammig weight w(x i. It i proved i [2] that for odd 3, there are oly two ymmetric Boolea fuctio f ad f i SB with maximal AI( v f (,,...,, 0, 0,..., 0. O the other had, there exit plety of ymmetric Boolea fuctio f SB with maximum AI(f whe i eve. At firt we have the followig geeral fact which K.Q. Feg, F. Liu are with the Departmet of Mathematic, Tighua Uiverity, Beiig, 00084, P.R. Chia ( feg@math.tighua.edu.c; lgat@63.com. The wor of K.Feg wa upported by the Natioal Sciece Reearch Program of Chia(NO.2004 CB ad the State Key Lab. o Iformatio Security(SKLOIS of Chia. L.J. Qu i with the Departmet of Mathematic ad Sytem Sciece, Sciece College, Natioal Uiverity of Defece Techology, ChagSha, 40073, ad Natioal Mobile Commuicatio Reearch Laboratory, Southeat Uiverity, Naig 20096, P.R.Chia. ( lqu happy@hotmail.com The wor of L.J. Qu wa upported by the Natural Sciece Foudatio of Chia(NO , ad the ope reearch fud of Natioal Mobile Commuicatio Reearch Laboratory of Southeat Uiverity(W L. Wag i with the Departmet of Mathematic, Georgia Tech. USA( waglei07@gmail.com. ay that the algebraic immuity i a ivariat uder affie traformatio. Lemma.: Let f, f B be Boolea fuctio with variable x (x,..., x, f (x f(xa c, c F 2 ad A i a ivertible matrix over F 2. The AI(f AI(f. For, there are four affie traformatio i SB : (x,..., x (x,..., x ; (x,..., x (x σ,..., x σ ; (x,..., x (x,..., x ; (x,..., x (x σ,..., x σ. σ x... x.thu we have the followig reult: Lemma.2: Let f SB,, ad f (x,..., x f(x,..., x ; f 2 (x,..., x f(x σ,..., x σ ; f 3 (x,..., x f(x σ,..., x σ. The f, f 2, f 3 SB, AI(f AI(f 2 AI(f 3 AI(f, ad for each 0 i, we have: v f (i v f ( i; v f3 ( i v f2 (i { vf (i, if 2 i v f ( i, if 2 i Alo, for each f SB, we have f SB ad AI( f AI(f. Sice v f (i v f (i (0 i, from ow o we may aume that v f (0. I A. Braee thei [3](alo ee [4] the followig ymmetric Boolea fuctio with maximum algebraic immuity have bee cotructed. Lemma.3: Let 4 ad f SB. We deote i e i e i e (0 i a vector i F2 uch that it th poitio i ad the other poitio are 0. The AI(f uder oe of the followig coditio: ( ([3]T heorem4..30 v f (... a, a F 2 ; (2 ([3]T heorem4..3 v f (... ; (3 ([3]T heorem4..32 v f (... ad 4 ; 4 (4 ([3]T heorem4..33 v f (... 0 ad 2 mod 4.

2 2 Remar: It i well-ow that for each poitive iteger m ad a 0 atifyig 2 a m! ad 2 a m!, we have a i m 2. i From thi fact ad (!!!, we ca ee that the coditio that 2 mod 4 i Lemma.3(4 i equivalet to 2 l for ome l 0. Baed o computatio, A. Braee raied the followig coecture i [3]: Coecture.4: Let f SB, 4, i /2. If t i t mod 2 for all t, t i, ad v f (... e i the AI(f. I the ext ectio we will preet more ymmetric Boolea fuctio f SB with maximum AI(f(. Particularly we geeralize Lemma.3(3 ad prove Coecture.4. It i ot hard to ee that our approach i ext ectio ca be ued to prove all reult i Lemma.3 i a uiform way. II. RESULTS AND PROOFS Firtly we itroduce a combiatorial reult give by Wilo [3] which we eed to prove our reult. For each i, 0 i, we defie T i {a F 2 w(a i} w(a i the Hammig weight of a. For a (a,..., a, b (b,..., b ad d (d,..., d F 2, we defie a b a i b i, ( i a b a b ad a b d a b d i max{a i, b i }, ( i Lemma 2.: (Wilo[3] Suppoe that i mi{, } ad M (m ba a Ti,b T be the ( ( i matrix over F2 {, if a b m ba 0, otherwie The the F 2 ra of M i ra(m 0 t i, ( t i t mod 2 ( [ t ] t we aume ( ( 0. Particularly, ra(m i if ad oly if ( t i t mod 2 for all t, 0 t i. To determie the value of ( mod 2, Luca formula i a powerful tool. Let l 2, 0 l 2, (, {0, } 0 mea that for all (0 l,. The Luca formula ay 0 l mod 2 0 { l mod 2, if 0 mod 2, otherwie Each Boolea fuctio g(x g(x,..., x B ca be expreed by g(x c g (ax a (c g (a F 2 a F 2 for a (a,..., a F2, x a i defied a x a x a...xa. If we aume 0 0, the for ay b (b,..., b F2, we have a b b a. g(b c g (a a F2,a b For f, g B, fg 0 if ad oly if for each a F2, f(a g(a 0. If f SB, the fg 0 if ad oly if for each i, (0 i, v f (i g(a 0 for all a T i. After thee prelimiary obervatio,we how our firt reult which i a geeralizatio of Lemma.3(3. Theorem 2.2: Let f SB, 4 uch that 2 i 3 2 i for ome i 0. If v f (... α 2 i (α F 2, the AI(f. Proof: Suppoe that fg 0 for ome g B ad deg(g, o we have that g(x a F 2, w(a x a From fg 0 we ow that g(b 0 for all b F2 that w(b {0,..., 2 i, 2 i,...,, 2 i } uch We eed to how g 0. Firtly we claim that 0 for all a F2 uch that w(a 2 i. We prove thi claim by iductio o w(a. From 0 g(0 c(0 we ow that 0 for w(a 0. Aume that for ome l < 2 i we have 0 for all a F2 uch that w(a l. Now coider b F2 with w(b l. Becaue l 2 i, we have g(b 0, the we have 0 g(b c(b c(b w(a, a b w(a l, a b Thi complete the proof of the claim. g(x x a 2 i w(a Next we claim that for all b F2 w(b, c(b w(a 2 i,a b uch that 2 i ( We alo prove thi claim by iductio o w(b. If w(b 2 i, the 0 g(b 2 i w(a, a b c(b w(a 2 i,a b

3 3 therefore c(b w(a 2 i,a b, o the claim i true for w(b 2 i. Suppoe 2 i l < ad the claim i true for all b F2 uch that 2 i w(b l. Now let w(b l. The 0 g(b c(b c(b w(a 2 i, a b 2 i w(a l, a b ad by iductio hypothei, 2 i w(a l, a b 2 i w(a l, a b w(a 2 i, a b w(a 2 i, a b c(b 2 i w(a l, a b w(a 2 i, a a a: a a b (2 w(b w(a 2 0 mod 2 w(a 2 i, a b proof of the claim. At lat, for w(b 2 i, we have imilarly 0 g(b ad 2 i w(a, a b 2 i w(a, a b w(a 2 i, a b 2 i w(a, a a b. Thi complete the w(a 2 i, a a w(a ( w(b w(a λ λ0 2 2i 2 i 2 2 i mod 2 2 i w(a, a a b 2 i λ0 2 i for all b F2 uch that w(b 2 i, 0, (2 w(a 2 i, a b which are ( 2 i 2 homogeou liear equatio i with 2 variable { a F i 2, w(a 2 i }. The coefficiet matrix i M (m ba w(a 2i,w(b2 i m ba {, if a b 0, otherwie λ Let l 2 i, the 0 l < 2 i. For ay t uch that 0 t l, we have 0 l t l < 2 i ad ( 2 i ( t 2 i l t 2 i t 2 i mod 2 The by Lemma 2. we ow M i full ra ad the liear equatio (2 ha oly zero-olutio: 0 for all a F 2, w(a 2 i. Thu g 0 ice all coefficiet of g are zero by (. If (fg 0 for ome g B, deg(g, coider f (x,..., x f(x,..., x, g (x,..., x g(x,..., x The f g 0, g B, deg(g deg(g, f SB ad v f (... (α } {{} 2 i By the proof above we get g 0 o that g 0. I ummary, we have AI(f. Next reult i a proof of Coecture.4. Theorem 2.3: Let 4, l, 2 l i for ome 0 ad i 2 l. The for f SB with v f (... e i, we have AI(f. Remar: It i eay to ee by Luca formula that the coditio 2 l i, i 2 l i thi theorem i equivalet to the coditio t i t mod 2 for t i i the Coecture.4. Proof of Theorem 2.3: If 0, the i ad by Lemma.3( we ow AI(f. From ow o we ca aume. Suppoe that fg 0 g B ad deg(g. From v f (i for 0 i, we ow that g(a 0 for all a F2 uch that w(a. The we ca how that all coefficiet i g(x x a are zero w(a by the ame argumet i the proof of Theorem 2.2. g 0. Next we uppoe that ( fg 0 g B ad deg(g. Coider f (x,..., x f(x,..., x, g (x,..., x g(x,..., x The f g 0, deg(g, o we ca write g a g (x x a ad f SB with v f (... e i. w(a By imilar argumet i the proof of Theorem 2.2, we ca how that: ( 0, whe w(a i ; (2 c(b, whe i w(b ; (3 w(ai, a b w(ai, a b 0, whe w(b Coditio (3 preet homogeou equatio over F2 with i variable { a F 2, w(a i} with coefficiet

4 4 matrix M (m ba w(b,w(ai, m ba {, if a b 0, otherwie From the aumptio 2 l i ad i 2 l, we ow that for 0 t i, t i t t 2l (i t i 2 l i t mod 2 0 A mi{, } > i, o by Lemma 2., the ra of M over F 2 i i, o that 0 for all a F 2 uch that w(a i. The we have g 0 ad g 0. Thi complete the proof of AI(f. At the ed of thi paper, we preet a ew cotructio of ymmetric Boolea fuctio f SB with maximum algebraic immuity. Theorem 2.4: Let with 4 2 < 5 2 for ome 0. For the fuctio f SB defied by v f (... a (a F 2 we have AI(f. Proof: For 0, we have 4. It ca be verified directly that thi theorem i true for 0. So from ow o we aume. Let 2 2, the 0 d < 2. Suppoe that fg 0 for ome g B uch that deg(g. We will how that g 0 o matter a 0 or. Let g(x w(a x a Firtly, we ca prove the followig two reult by imilar argumet ued i the proof of Theorem 2.2: ( For 0 w(a < 3 2, we have 0; (2 For 3 2 < w(a < 2, we have Now we claim that w(β 3 2, (3 For 2 < w(a, w(β 2,. I fact, for w(a 2, we have f(a, o that 0 g(a. But β a 3 2 w(β 2 w(β 3 2 or 2 w(β 3 2 or 2 w(β 3 2 or 2 w(γ 3 2 γ 2 i 3 2 w(γ 3 2 γ 2 ( (2 mod 2 for w(a 2. w(β 2 Now we aume that for ome l, Claim (3 i true for all a uch that 2 w(a l. If w(a l, the A By Claim (2 we have Becaue A γ 3 2 w(β l w(β 3 2 or 2, B A B 2 <w(β l w(γ 3 2 w(γ 3 2 γ 2 i l 3 2

5 5 ad 2 l 2, we have 2 l By Luca formula 2 l we have A ( l l 2 mod 2 w(γ 3 2. O the other had, by aumptio, we have B 2 <w(β l w(γ 2 w(γ 2 γ a w(γ 2 γ a 2 <w(β l γ (2 w(a w(γ 2 0 mod 2 Thu, Claim (3 i true for w(a l. Now we claim that (4 For w(a 2 ad w(a 3 2 we have 0 w(β 3 2 w(β 2 Aume that w(a 2. From f(a we ow that 0 g(a A 3 2 w(β w(β 3 2,or 2 w(γ 3 2 w(γ 3 2 By Luca formula we ca compute γ 2 i A B γ mod 2 A 0. Similarly, B 2 <w(β w(γ 2 w(γ 2 2 <w(β γ 2 2 <w(β w(γ mod 2 we ow that Claim (4 i true for w(a 2. Now we aume that w(a 3 2. From f(a we ow that 0 g(a A 3 2 w(β w(β 3 2,or 2 w(γ 3 2 w(γ 3 2 By Luca formula we ca compute γ A B γ 2 i mod 2 A 0. Similarly, B 2 <w(β w(γ 2 w(γ 2 2 <w(β γ 2 ( <w(β w(γ 2 B 0 ad we ow that Claim (4 i alo true for w(a 3 2. Recall that T i i the et of a F2 with Hammig weight i. The Claim (4 provide N ( homogeou liear equatio over F 2 for ( N variable { β T 3 2 T 2 }. The coefficiet matrix i M (m a,β a T 2 T 3 2 β T 2 T 3 2

6 6 m a,β {, if β a 0, otherwie We eed to how that det(m F 2. Namely, M i a ivertible matrix over F 2. For doig thi we deote by M T the trapoe of the matrix M ad coider M T X Y M ( β,β Y T Z X i a ( 2 ( 2 matrix ad Z i a 3 2 ( 3 2 matrix. It i eay to ee that β,β m a,β m a,β a #{a T 2 T 3 2 β a, β a} We claim that (5 Z 0, X I (, Y Y T I 2 (. 3 2 Let Z (z β,β, Y (y β,β, X (x β,β. The z β,β #{a F 2 w(a 2 or 3 2, β a, β a} for β (β,..., β, β (β,..., β T 3 2. By the defiitio of β β, we ow that β a, β a (β β a ad w(β β 3 2 λ, 0 λ ( ( 3 2 z β,β 2 ( 3 2 ( ( ( 3 2 ( 3 2 ( ( ( From 0 λ 2, we ow 0 2 < 2. Thu by Luca formula oe ca get ( 2 ( 2 z β,β mod 2 which mea z β,β 0 for all β, β T 3 2. Thu we get Z 0. Next we prove X I (. For β, β T 2 we have 2 w(β β 2 λ, 0 λ ( ( 2 x β,β 2 ( 2 ( ( ( 2 ( 2 ( ( ( The ( mod b for ome b, b d, 0 b < 2 λ 2 b (b d, 0 b < 2 Moreover, ( mod {2 2 2, 2 2 b, 2 b} for ome b, b d, 0 b < 2 λ {0, 2 b, 2 2 b} λ {0, 2 b}(sice λ 2 2 From thi we ow that x β,β λ 0 β β Thu X I (. 2 At lat we prove that Y T Y I (. For β T 2, 3 2 β T 3 2, w(β β 2 λ, 0 λ The ( ( 2 y β,β 2 ( 2 ( ( ( 2 ( 2 ( ( ( ( 2 ( mod 2 y β,β λ 0 β β Let Y T Y (b β,β 2, β, β 2 T 3 2. The b β,β 2 #{β T 2 β (β β 2 } Let w(β β λ, the 0 λ d ad ( ( 3 2 ( 3 2 b β,β 2 2 ( ( ( 2 2 mod 2 b β,β 2 λ 0 β β 2 which mea that Y T Y I ( 3 2. Thi complete the proof of Claim (5.

7 7 From Claim (5 we get M T X Y M Y T Z ( I Y Y T 0 The from Y T Y I we ow that M i ivertible. So the equatio i Claim (4 ha oly zero-olutio, ad the by Claim (2 ad Claim (3 all the coefficiet of g are zero, which mea g 0. O the other had, if ( fh 0 for ome h B, deg(h, let f (x,..., x f(x,..., x, h (x,..., x h(x,..., x the f h 0, deg(h ad v f i the ame a v f except a beig chaged to a. Thu h 0 ad the h 0. Thi mea that AI(f. Acowledgemet The author would lie to tha the aoymou reviewer for their valuable commet ad uggetio which have improved much both o the techical equality ad o the editorial quality of thi correpodece. REFERENCES [2] L.J. Qu, C. Li ad K. Feg, A ote o ymmetric Boolea fuctio with maximum algebraic immuity i odd umber of variable. IEEE Tra. If. Theory, vol. 53, o. 8, pp , Aug [3] R.M.Wilo, A diagoal form for the icidece matrice of t-ubet v -ubet. Europea J.Combi.(990, Logiag Qu received hi B.A. degree i 2002 ad Ph.D. degree i 2007 i mathematic from the Natioal Uiverity of Defee Techology, Chagha, Chia. He i ow a Lecturer with the Departmet of Mathematic ad Sytem Sciece, Natioal Uiverity of Defee Techology of Chia. Hi reearch field iclude cryptography ad codig theory. Keqi Feg graduated from the Uiverity of Sciece ad Techology of Chia (USTC, Beig, a a graduate tudet i 968 (there wa o degree ytem i Chia at that time. Sice 973, he ha bee with the Departmet of Mathematic at USTC, ad the i the State Key Laboratory of Iformatio Safety of USTC i Beiig. Now he i worig i the Departmet of Mathematical Sciece, Tighua Uiverity, Beiig. Hi curret reearch iteret are codig theory, cryptography ad algebraic umber theory. Feg Liu received hi B.A. degree i 2000 from Zhegzhou Iformatio ad Egieerig Uiverity(Mathematic. He i tudyig i Tighua Uiverity of Chia for PhD degree ow. Lei Wag received hi B.A. degree i 2006 from Tighua Uiverity of Chia(Mathematic. He i tudyig for PhD degree i Georgia Tech. (USA ow. [] F. Armecht, Improvig fat algebraic attac, i Proc. Worhop o Fat Software Ecryptio (Lecture Note i Computer Sciece. Berli, Germay: Spriger-Verlag, 2004, vol. 307, pp [2] L.M. Batte, Algebraic attac over GF(q, i Progre i Cryptology-INDOCRYPT 2004 (Lecture Note i Computer Sciece. Berli, Germay: Spriger-Verlag, 2004, vol. 3348, pp [3] A. Braee, Cryptographic propertie of Boolea fuctio ad S-boxe. PhD thei. [Olie]. Available at URL abraee/theia.pdf. Katholiee Uiverity [4] A. Braee ad B. Preeel, O the algebraic immuity of ymmetric Boolea fuctio, i Idocrypt 2005 (Lecture Note i Computer Sciece, Jul. 26, 2005, vol. 3797, pp [Olie]. Available: eprit.iacr.org/. [5] C.Carlet, D.K.Dalai, K.C.Gupta ad S.Maitra, Algebraic Immuity for Cryptographically Sigificat Boolea Fuctio: Aalyi ad Cotructio. IEEE Tra. If. Theory, vol. 52, o. 7, pp , Jul [6] N. Courtoi ad J. Pieprzy, Cryptaalyi of bloc cipher with overdefied ytem of equatio, i Advace i Cryptology- ASIACRYPT 2002 (Lecture Note i Computer Sciece. Berli, Germay: Spriger-Verlag, 2002, vol. 250, pp [7] N. Courtoi ad W. Meier, Algebraic attac o tream cipher with liear feedbac, i Advace i Cryptology-EUROCRYPT 2003 (Lecture Note i Computer Sciece. Berli, Germay: Spriger-Verlag, 2003, vol. 2656, pp [8] N. Courtoi, Fat algebraic attac o tream cipher with liear feedbac, i Advace i Cryptology-CRYPTO 2003 (Lecture Note i Computer Sciece. Berli, Germay: Spriger-Verlag, 2003, vol. 2729, pp [9] D. K. Dalai, K. C. Gupta, ad S. Maitra, Reult o algebraic immuity for cryptographically igificat Boolea fuctio, i Idocrypt 2004 (Lecture Note i Computer Sciece. Berli, Germay: Spriger- Verlag, 2004, vol. 3348, pp [0] D. K. Dalai, S.Maitra, ad S. Sarar, Baic theory i cotructio of Boolea fuctio with maximum poible aihilator immuity, De. Code, Cryptogr., vol. 40, o., pp. 4-58, Jul. 2006, Alo, avaialable [Olie] at [] W. Meier, E. Paalic, ad C. Carlet, Algebraic attac ad decompoitio of Boolea fuctio, i Advace i Cryptology-EUROCRYPT 2004 (Lecture Note i Computer Sciece. Berli, Germay: Spriger- Verlag, 2004, vol. 3027, pp