Paper 2024/1693
A notion on S-boxes for a partial resistance to some integral attacks
Claude Carlet, University of Bergen, 5005 Bergen, Norway, University of Paris 8, 93526 Saint-Denis, France
Abstract
In two recent papers, we introduced and studied the notion of th-order sum-freedom of a vectorial function . This notion generalizes that of almost perfect nonlinearity (which corresponds to ) and has some relation with the resistance to integral attacks of those block ciphers using as a substitution box (S-box), by preventing the propagation of the division property of -dimensional affine spaces. In the present paper, we show that this notion, which is rarely satisfied by vectorial functions, can be weakened while retaining the property that the S-boxes do not propagate the division property of -dimensional affine spaces. This leads us to the property that we name th-order -degree-sum-freedom, whose strength decreases when increases, and which coincides with th-order sum-freedom when . The condition for th-order -degree-sum-freedom is that, for every -dimensional affine space , there exists a non-negative integer of 2-weight at most such that . We show, for a general th-order -degree-sum-free function , that can always be taken smaller than or equal to under some reasonable condition on , and that it is larger than or equal to , where is the algebraic degree of . We also show two other lower bounds: one, that is often tighter, by means of the algebraic degree of the compositional inverse of when is a permutation, and another (valid for every vectorial function) by means of the algebraic degree of the indicator of the graph of the function. We study examples for (case in which corresponds to APNness) showing that finding of 2-weight 2 can be challenging, and we begin the study of power functions, for which we prove upper bounds. We study in particular the multiplicative inverse function (used as an S-box in the AES), for which we characterize the th-order -degree-sum-freedom by the coefficients of the subspace polynomials of -dimensional vector subspaces (deducing the exact value of when divides ) and we extend to th-order -degree-sum-freedom the result that it is th-order sum-free if and only if it is th-order sum-free.