Statistical Properties of the Square Map Modulo a Power of Two

Transcription

1 Statistical Properties of the Square Map Modulo a Power of Two S. M. Dehavi, A. Mahmoodi Rishakai, M. R. Mirzee Shamsabad 3, Hamidreza Maimai, Eiollah Pasha Kharazmi Uiversity, Faculty of Mathematical ad Computer Scieces, Tehra, Ira {std_dehavism@khu.ac.ir, pasha@khu.ac.ir} Shahid Rajaee Teacher Traiig Uiversity, Faculty of Scieces, Tehra, Ira {am.rishakai@srttu.edu, maimai@ipm.ir} 3 Shahid Bahoar Uiversity, Faculty of Mathematics ad Computer Sciece, Kerma, Ira mohammadmirzaeesh@yahoo.com Abstract: The square map is oe of the fuctios that is used i cryptography. For istace, the square map is used i Rabi ecryptio scheme, block cipher RC6 ad stream cipher Rabbit, i differet forms. I this paper we study a special case of the square map, amely the square fuctio modulo a power of two. We obtai probability distributio of the output of this map as a vectorial Boolea fuctio. We fid probability distributio of the compoet Boolea fuctios of this map. We preset the joit probability distributio of the compoet Boolea fuctios of this fuctio. We itroduce a ew fuctio which is similar to the fuctio that is used i Rabbit cipher ad we compute the probability distributio of the compoet Boolea fuctios of this ew map. Key Words: Square map modulo a power of two, Vectorial Boolea fuctio, Compoet Boolea fuctio, Rabbit cipher. Itroductio The square map, like the operator of multiplicatio, has various applicatios i cryptography. For istace i asymmetric cryptography, RSA ecryptio scheme [] makes use of multiplicatio ad Rabi ecryptio scheme [] applies the square map. I symmetric cryptography, some symmetric ciphers have the operator of multiplicatio or the square map i their desig. For example block cipher Mars [] uses the operator of multiplicatio ad i desig of block cipher RC6 [3] the square map (the operator of multiplicatio) is used. I desigig

2 some stream ciphers, the operator of multiplicatio ad the square map is also used. For istace, the stream cipher Sosemauk [4] uses the operator of multiplicatio ad the stream cipher Rabbit [5] uses the square map. I all the aforemetioed cases the operator of multiplicatio ad the square map is used i a variety of methods. I this paper we ivestigate a special case of the square map, i.e. the square map modulo a power of two ad we study probability distributio of this map alog with its compoet Boolea fuctios. I [6,7] we have studied some statistical ad algebraic properties of the operator of multiplicatio modulo a power of two, but i this paper we study statistical properties of the square map modulo a power of two. At first we cosider the square map modulo a power of two as a vectorial Boolea fuctio [8] ad we obtai probability distributio of its output. The, we ivestigate compoet Boolea fuctios of this map ad we obtai the probability distributio of these compoet fuctios. After that, we cosider the joit probability distributio of these compoet fuctios for the case of two compoet fuctios ad we compute the joit probability distributio of these compoet fuctios. We itroduce a ew fuctio similar to what is preseted i Rabbit cipher ad usig joit probability distributio of compoet Boolea fuctios of the square map, we obtai the probability distributio of compoet Boolea fuctios of this ew fuctio. I Sectio we preset the defiitios ad otatios. Sectio 3 studies probability distributio of the output of the square map modulo a power of two as a vectorial Boolea fuctio. I Sectio 4 we ivestigate probability distributio of the compoet Boolea fuctios of square map modulo a power of two. I Sectio 5 we obtai the joit probability distributio of the compoet Boolea fuctios of square map modulo a power of two for the case of two compoet Boolea fuctios ad fially i Sectio 6 we coclude.. Notatios ad Defiitios I this article, the umber of elemets or cardiality of a fiite set A is deoted by A. For a fuctio f: A B, the preimage of a elemet b B is deoted by f (b) ad is defied as {a A f(a) = b}. The greatest power of that divides a atural umber a is deoted by p (a) ad the odd part of a or a p (a) is deoted by O (a). Let F be the fiite field with two elemets. Each elemet of F (The Cartesia product of copies of F ) ca be cosidered as a vector of legth. Each fuctio f: F F is called a Boolea fuctio ad each fuctio f: F F m with m > is called a vectorial Boolea fuctio; such a fuctio ca be viewed as a vector (f m,, f 0 ) of f i s, 0 i < m. Here, f i s are Boolea fuctios from F to F. These Boolea fuctios are called compoet Boolea fuctios of the vectorial Boolea fuctio f. Also, if x F, the the i-th bit of x is deoted by x i. Note that for each vectorial Boolea fuctio f: F F m we have vectorial Boolea fuctios

3 f i,j : F F, i > j, f i,j (x) = (f i (x), f j (x)), x F. We call these vectorial Boolea fuctios joit Boolea fuctios of f. I this paper, we cosider the complete set of remaiders modulo as {0,,, } ad deote it by Z. We defie the iverse parity fuctio e j as follows: e j = { 0 j odd, j eve. Let (G, ) be a group ad φ: G G be a group edomorphism; we deote the kerel of φ by ker(φ) ad the image of φ by Im(φ). I the sequel, by the square map (ad its compoet Boolea fuctios) we mea the square map modulo a power of two. 3. Probability Distributio of the Square Map as a Vectorial Boolea Fuctio I this sectio, we cosider the square map as a vectorial Boolea fuctio ad we obtai probability distributio of the output of this map. I Theorem, we employ some facts from group theory [9] ad umber theory. Oe of the results of this theorem is idetifyig the square umbers modulo a power of two. We ote that the square of each odd atural umber is i the form of 8k +, but ot every atural umber i the form of 8k + is a square umber. Lemma shows that i Z the square of each odd elemet is i the form of 8k + ; the iterestig poit is that, based o Theorem, i Z every elemet i the form of 8k + is also a square elemet. Lemma : Let a Z be a odd elemet; we have a = mod 8. Proof: Sice a is odd, so there exists a q Z such that a = q + mod. Therefore, a = 4q(q + ) + = 8 ( q(q+) ) + mod = mod 8.

4 Theorem : Suppose that > 4 ad f: Z Z is defied as f(x) = x mod ; the we have: a) For the case a = 0, the case a = with e = 0, ad the case a = with e = : f (a) = +e ; b) For the case p (a) mod 0 ad the case p (a) mod = 0 with 0 p (a) 3 ad O (a) mod 8 : f (a) = 0; c) For the case p (a) mod = 0 with 0 p (a) 3 ad O (a) mod 8 = : f (a) = p (a)+4. Proof: a) Cosider the equatio x = 0 mod ; o oe had, every x Z with p (x) satisfies x = 0 mod. So, f (0) is at least = = +e. O the other had, for each x Z with p (x) < we have x 0 mod. Thus, f (0) = +e. Suppose that is odd ad p (a) =. So a equals to. Cosider the equatio x = mod ; let x = r q with q odd. We have r q = mod. So r =, q + ad q = mod. Thus, oly odd q s satisfy the equatio x = mod ; therefore, f (a) = = +e. Now suppose that is eve ad p (a) =. So p (a) = ad a = s, where s {,3}. If s =, the we cosider the equatio x = mod. Let x = r q with q odd. We have r q = mod. Hece r =, q + ad q = mod 4. So oly half of odd q s satisfy the equatio x = mod ; therefore, f (a) = = +e. b) Cotiuig the proof of the Case a, if s = 3, the cosiderig the equatio x =. 3 mod ad supposig that x = r q with q odd, we have r q =. 3 mod ;

5 so, r = ad q = 3 mod 4. Thus, accordig to Lemma, we coclude that f (a) = 0. Suppose that p (a) = mod. Cosider the equatio x = a mod. Sice the square of ay odd elemet is a odd elemet, so oly eve elemets x Z ca satisfy x = a mod. Suppose that x = r q where r 0 ad q is odd. We have p (x ) = r which cotradicts p (a) = mod. Therefore, f (a) = 0. Now suppose that p (a) = 0 mod ad O (a) mod 8 ; the a = j t, where p (a) = j ad t = O (a). Cosider the equatio x = a mod. Let x = r q with q odd. We have r q = j t mod. Cosequetly, r = j ad q = t mod j ; therefore, regardig Lemma, we have f (a) = 0. c) We use Theorem 3.3 i [9] to prove this case. Suppose that p (a) = 0 ad a = mod 8; the algebraic structure (G, ), where G is the subset of odd elemets i Z ad is the operator of multiplicatio modulo is a group structure. The fuctio φ: G G with φ(g) = g g is a group edomorphism o G. To compute ker(φ) we must cout the umber of solutios for the equatio x x = G. I other words, we must cout the umber of solutios for the equatio x = mod. We have (x )(x + ) = 0 mod. Sice x is odd, for some q Z we have x = q +. So, 4q(q + ) = 0 mod. Cosequetly, we have q = 0, q =, q = or q + =, q + =, q + =. Substitutig the values of q, we have these solutios: x =, x =, x 3 = +, x 4 = +. Thus, ker (φ) = 4 ad sice Im(φ) = G ker (φ), we have Im(φ) = 4 = 3.

6 O the other had, accordig to Lemma ad sice the umber of elemets i Z i the form of 8q + is equal to 3 ad Im(φ) = 3, so every elemet i the form of 8q + i Z is a square elemet. Therefore, the equatio x = a mod at least has a solutio x = t. It is ot hard to verify that ad x = t. ( ) mod, x 3 = t. ( ) mod, x 4 = t. ( + ) mod, are the oly other solutios for the equatio. Cosequetly, we have f (a) = ker (φ) = 4 = p (a)+4. Now suppose that p (a) = 0 mod with p (a) 3 ad O (a) mod 8 =. I this case, we have a = j t with p (a) = j ad t = O (a). Cosider the equatio x = a mod. Let x = r q with q odd. We have r q = j t mod ; so, r = j ad q = t mod j. Regardig Lemma ad the proof of Case b, this equatio has four solutios with 0 q j. For each of these solutios we preset j solutios We have x = j (s j+ + q), 0 s j. x = j (s 4j+ + q + sq j+ ) = s j+ + j q + sq + = j q mod. I fact, regardig the iequality j 3, we have j + 3. Thus, f (a) = p (a) + = p (a)+4.

7 4. Probability Distributio of Compoet Boolea Fuctios of the Square Map I this sectio, we study the compoet Boolea fuctios of square map ad we fid the probability distributio of these compoet fuctios. Theorem has bee proved i [0] with the help of some cocepts i T-fuctio theory. Here, we reprove this theorem usig Theorem. Theorem : Suppose that > 4 ad the fuctio f: Z Z is defied as z = f(x) = x mod ; the we have i = 0 P(z i = 0) = { + i+ i < Proof: The cases i = 0, are obvious. Suppose that < i < ad i is odd; the umber of elemets a with p (a) = j is equal to j ad the umber of a s with p (a) = j ad O (a) mod 8 is equal to j 3. By Theorem, P(z i = ) = f (a) 0 p (a)<i p (a) mod =0 a i = i 3 = j 3 j+. j=0 = ( i ) = i+. Suppose that < i < ad i is eve; the umber of elemets a with p (a) = j is equal to j ad the umber of a s with p (a) = j ad O (a) mod 8 is equal to j 3. By Theorem, P(z i = ) = f (a) 0 p (a)<i p (a) mod =0 a i =

8 i = j 3 j+. j=0 = ( i ) = i+. Now suppose that i = ad i is eve; we have P(z = ) = f (a) 0 p (a)< p (a) mod =0 a = = f ( ) + 6 j 3 j+ j=0. = = i+. Now if i = ad i is odd, the we have P(z = ) = f (a) 0 p (a)< p (a) mod =0 a = 5 = j 3 j+. j=0 Now if i = ad i is eve, the we have = i+. P(z = ) = f (a) 0 p (a)< p (a) mod =0 a =

9 Fially, if i = ad i is odd, the we have 3 = j 3 j+. j=0 = i+. P(z i = ) = f (a) 0 p (a)<i p (a) mod =0 a i = 4 = j 3 j+. j=0 = i+ 5. Joit Probability Distributio of Compoet Boolea Fuctios of the Square Map I this sectio, we ivestigate the joit compoet Boolea fuctios of square map ad we obtai the joit probability distributio of these compoet fuctios. The, usig these distributios, we itroduce a ew map similar to what is preseted i Rabbit cipher ad we fid the probability distributio of compoet Boolea fuctios of this ew map. Theorem 3: Suppose that > 4 ad the fuctio f: Z Z is defied as z = f(x) = x mod ; we have: a) For j + < i, b) For j < i j + with j >, 4 + ( )a ( ) b + ( a) j 0, j + i + P(z i = b, z j = a) = ( )b + ( a) j = 0. { 4 i +

10 c) For the other cases, P(z i = b, z j = a) = 4 + e j(a b) + e a + ea( )b. j+3 j+ j+ i+ 4 + ( e ae i+j ) ( )b 4 j = 0, i =, P(z i = b, z j = a) = ( a) ( + ( )b ) j =, i =,3 4 a+ b 4 j =, i = 3 3e a { 8 + ae b 4 j =, i = 4. Proof: At first, suppose that j 0 is eve; or j = r, r > 0. We have P(z i = b, z r = ) = P(z = c) c i =b,c r = = P(z = c). 0 p (c) r p (c) mod =0 c i =b,c r = () I summatio (), if p (c) = k, 0 k r, the biary represetatio of c is i this form: c = (,,, b,,,,,,,, i r 0 k+, 0 k+,, 0,,0). Cosequetly, k + 5 bits are determied ad so we have k 5 ozero summads, the p(c)+4 probability of each is equal to, by Theorem. Thus, the cotributio of this case i () is equal to (k+3). We ote that the case k = r cotradicts Theorem. For the case k = r, r + 4 bits are determied, ad so we have r 4 ozero summads, the probability of each p(c)+4 equals to by Theorem. Therefore, the cotributio of this case i () is equal to (r+). Hece, r P(z i = b, z r = ) = ( (k+3) ) + (r+) Now, usig basic probability theory ad Theorem ad (), we have k=0 k =. () 4 r+

11 P(z i = b, z r = 0) = P(z i = b ) P(z r = ) + P(z i = b, z r = ) = 4 + ( )b +. r+ i + So, P(z i = b, z r = a) = + ( )a ( )b 4 r+ + ( a) i +. At this poit, suppose that j 0 is odd; i.e. j = r +, r 0. We have P(z i = b, z r+ = ) = c i =b,c r+ = P(z = c) = P(z = c). 0 p (c) r+ p (c) mod =0 c i =b,c r+ = (3) I (3), accordig to Theorem, p (c) ca be 0,,,r. Similar to the previous case, ad So, Thus, i the case j 0, we have Now, suppose that j = 0: P(z i = b, z r+ = ) = 4 r+, P(z i = b, z r+ = 0) = + ( )b +. 4 r+ i + P(z i = b, z r+ = a) = 4 + ( )a ( )b + ( a). r+ i + P(z i = b, z j = a) = 4 + ( )a j + + ( a) P(z i = b, z 0 = ) = P(z = c) c i =b,c 0 = ( ) b i +. = P(z = c). p (c)=0,c i =b (4)

12 I (4), four bits are determied ad so we have 4 summads, the probability of each is equal to by Theorem. Hece, ad similarly, P(z i = b, z 0 = ) = 4. = 4, P(z i = b, z 0 = 0) = P(z i = b ) P(z 0 = ) + P(z i = b, z 0 = ) So, for the case j = 0, we have = 4 + ( )b. i+ P(z i = b, z 0 = a) = 4 b) For < j ad i = j + or = j +, we have P(z i = b, z j = ) = P(z = c) c i =b,c j = + ( a) ( )b i +. = P(z = c). 0 p (c) j p (c) mod =0 c i =b,c j = Accordig to the proof of Case a ad regardig the biary represetatio of c, for the eve ad odd cases of j, we have ad P(z i = b, z j = ) = = 4 + e je b. j ( j+ j+ j+ +) + e je b (j+3) P(z i = b, z j = 0) = (P(z i = b ) + P(z j = ) P(z i = b, z j = )) = j j+ j+ + ( )b + be j. i+ j+ j+4

13 So, for j < i j + ad j >, we have P(z i = b, z j = a) = 4 + e j(a b) + e a + ea( )b j+3 j+ j+. i+ c) All the cases are simple. Now, we itroduce a ew fuctio similar to what is preseted i stream cipher Rabbit ad we obtai the probability distributio of its compoet Boolea fuctios. Theorem 4: Suppose that 8 is a eve atural umber, the fuctio f: Z Z is defied as z = f(x) = x mod ad w = g(x) = x (x ) mod. Here, is the bitwise right shift operator ad meas the bitwise XOR. We have Proof: Accordig to Theorem 3, we have P(w i = 0) = + i + i ( 4 ), 0 i <. P(w 0 = 0) = P(z 0 z = 0) = P(z 0 = 0, z = 0) + P(z 0 =, z = ) ad for 0 < i <, = , P(w i = 0) = P(z i z i+( ) = 0) = P(z i = 0, z i+( ) = 0) + P(z i =, z i+( ) = ) = + i For, accordig to Theorem, we have Therefore, P(w i = 0) = + i P(w i = 0) = + i + i ( 4 ).

14 6. The Imbalace of Square Map I this sectio, we study the imbalace of the square map ad we prove that this map is a very imbalaced map. Suppose that m, ad d are atural umbers with = dm. The fuctio f: A B with A = ad B = m is called balaced if ad oly if b B, f (b) = d. Now, usig oe of the defiitios for measurig the distace of two probability distributios, we itroduce a criterio for measurig the imbalace of maps. Defiitio []: Suppose that P ad P are two probability distributios o a fiite sample space X; the distace betwee these two probability distributios is defied as, D(P, P ) = P (x) P (x) x X. Now, for the fuctio f: A B, with A =, B = m ad = dm we defie the probability distributio P o B as b B, P (b) = f (b), ad we defie the probability distributio P o B as the uiform distributio, b B, P (b) = d. Defiitio : Usig Defiitio, we defie a criterio for measurig the imbalace D f for the fuctio f: A B, with A =, B = m ad = dm, as, m D f = (m ) D(P, P ) = b B f (b) d. (m )d Lemma : For each fuctio f: A B with A =, B = m ad = dm, we have, 0 D f. Proof: It s obvious that for every balaced fuctio f, we have D f = 0; o the other had, accordig to defiitio, we have 0 D f for each f. So it suffices to prove that for each f, we have D f. Let C = {b B f (b) d}, D f = ( (m )d b C ( f (b) d) + b C (d f (b) ) )

15 = ( C d C d + f (b) (m )d b C f (b) = b C c ) (m )d ( (m C )d C d + f (C) f (C ) ) = f (C) C d (m )d. Sice C = 0 is a cotradictio, we have C ; o the other had f (c). So, For each costat fuctio f, we have, D f = f (C) C d (m )d d (m )d =. D f = (m )d + ( d) (m )d = (m )d + (md d) (m )d = (m )d (m )d =. Theorem 5: Suppose that the fuctio f: Z Z is defied as f(x) = x mod ; we have, D f = { eve odd Proof: I the proof of this theorem, we repeatedly use Theorem. We have, D f = b Z f (b) ( ). (5) For eve s, the cotributio of f (0) i (5) is equal to ad for odd s, the cotributio of f (0) i (5) is equal to. For odd s, the cotributio of a s with odd p (a) is equal to = i p (a)< p (a) mod = i= = 4 i i= = 3 ( ). For eve s, the cotributio of a s with odd p (a) is equal to

16 = i p (a)< p (a) mod = i= = 4 i i= = 3 ( ). For odd s, the cotributio of a = is equal to ad for eve s, the cotributio of a = is equal to. For eve s, the cotributio of a s with O (a) mod 8 = ad 0 p (a) 3 ad p (a) = 0 mod is equal to i 3 ( i+ ) = i i 3 = i 3 4 i = ( + ) 3 ( ). For eve s, the cotributio of a s with O (a) mod 8 ad 0 p (a) 3 ad p (a) = 0 mod is equal to 3 i 3 = i =. For odd s, the cotributio of a s with O (a) mod 8 = ad 0 p (a) 3 ad p (a) = 0 mod is equal to 3 i 3 ( i+ ) = i i = i 3 4 i 3 = ( + ) 3 ( ). For odd s, the cotributio of a s with O (a) mod 8 ad 0 p (a) 3 ad p (a) = 0 mod is equal to

17 3 3 i 3 = i 3 =. So, for eve s, we have, D f = ( ) + 3 ( ) + ( ) + ( + ) 3 ( ) + ( ) + = = Ad for for odd s, we have, D f = = ( ) + 3 ( ) + ( ) + ( + ) 3 ( ) + ( ) = It's obvious that the asymptotic imbalace of the square map modulo is equal to 5 ; so we 6 ca say that this map is very imbalace. Theorem 6: Suppose that the fuctio f: Z Z is defied as f(x) = x mod ; we have, 0 i = 0 D fi = { i i < Proof: The cases i = 0, are obvious. Accordig to Theorem, we have, D fi = f i (0) + f i () ()( = i. )

18 Refereces [] D.R. STINSON, Cryptography - Theory ad Practice, 3rd ed. Chapma & Hall/CRC, Boca Rato, 003. [] C. Burwick, D. Coppersmith, E. D Avigo, R. Gearo, Sh. Halevi, Ch. Jutla, S. M. Matyas Jr., L. O Coor, M. Peyravia, D. Safford, N. Zuic: MARS - a Cadidate Cipher for AES, proceedig of st Advaced Ecryptio Stadard Cadidate Coferece, Veture, Califoria, Aug [3] R. L. Rivest, M. J. B. Robshaw, R. Sidey, Y.L. Yi: The RC6 Block Cipher, Proceedig of st Advaced Ecryptio Stadard Cadidate Coferece, Veture, Califoria, Aug [4] C. Berbai, O. Billet, A. Cateaut, N. Courtois, H. Gilbert, L. Goubi, A. Gouget, L. Graboula, C. Lauradoux, M. Miier, T. Pori, ad H. Sibert, Sosemauk, a Fast Software-Orieted Stream Cipher, submitted to Ecrypt, 005. [5] M. Boesgaard, M. Vesterager, T. Pederse, J. Christiase, ad O. Scaveius, Rabbit: A New High-Performace Stream Cipher, i Fast Software Ecryptio (FSE 03), LNCS 887, pp , Spriger-Verlag, 003. [6] A. Mahmoodi Rishakai, M. R. Mirzaee Shamsabad, S. M. Dehavi, Hamidreza Maimai, Eiollah Pasha, Statistical Properties of Modular Multiplicatio Modulo a Power of Two, 9 th Iteratioal Coferece o Iformatio Security ad Cryptology (ISCISC ), Uiversity of Tabriz, Tabriz, Ira, 0 [7] S. M. Dehavi, A. Mahmoodi Rishakai, M. R. Mirzaee Shamsabad, Eiollah Pasha, Cryptographic Properties of Modular Multiplicatio Modulo a Power of Two, Kharazmi Joural of Sciece, No. -, pp , 03 (I Persia) [8] Claude Carlet, Boolea fuctios for Cryptography ad Error Correctig Codes, available via [9] J. B. Fraleigh. A First Course i Abstract Algebra. Sixth editio, ADDISON-WESLEY publishig compay Ic, 999. [0] A. Klimov ad A. Shamir, A New Class of Ivertible Mappigs, Workshop o Cryptographic Hardware ad Embedded Systems (CHES), 00. [] T. M. Cover ad J. A. Thomas, Elemets of Iformatio Theory, Secod Editio, Joh Wiley & Sos, 006.