Recently in Çeşmelioğlu, Meidl (Adv. Math. Commun., 18, 2024), the study of EA-equivalence and CCZ-equivalence for functions from 𝕍_n^(p) to the cyclic group ℤ_p^k has been initiated, where 𝕍_n^(p) denotes an n-dimensional vector space over 𝔽_p . Amongst others it has been shown that there exist functions from 𝕍_n^(2) to ℤ_4 which are CCZ-equivalent but not EA-equivalent. We extend these results to larger classes of functions from 𝕍_n^(p) to ℤ_p^k . We then discuss constructions of generalized bent functions from 𝕍_n^(p) to ℤ_p^k , p odd or p=2 and n is even, which correspond to large affine spaces of bent functions. In particular we employ versions of the direct sum, the semi-direct sum and of a recent secondary bent function construction in Wang et. al., (IEEE Trans. Inform. Theory 69, 2023), to generate large affine spaces of bent functions. Finally we present a solution for constructing generalized bent functions from 𝕍_n^(2) to ℤ_2^k , n odd, from arbitrary generalized bent functions from 𝕍_n-1^(2) to ℤ_2^k-1 .
We instantiate the hash-then-evaluate paradigm for pseudorandom functions (PRFs), (k,x):=(k,(x)) , which builds a PRF from a weak PRF via a public pre-processing random oracle . In applications to secure multiparty computation (MPC), only the low-complexity performs secret-depending operations. Our construction replaces by f(k_,(x)) , where f is a non-adaptive PRF and the key k_ is public and thus known to the distinguishing adversary. We show that, perhaps surprisingly, several existing weak PRF candidates are plausibly also secure when their inputs are generated by f(k_,(.)) . Firstly, analogous cryptanalysis applies (because pseudorandomness of f implies good statistical properties) and/or secondly an attack against the weak PRF with such pseudorandom inputs generated by f would imply surprising results such as key agreement from the hardness of the high-noise version of the Learning Parity with Noise (LPN) when implementing both and f from this assumption. Our simple transformation of replacing (· ) public pre-processing by f(k_,(x)) public pre-processing applies to the entire family of PRF-style functions. Specifically, we obtain results for oblivious PRFs, which are a core building block for password-based authenticated key exchange (PAKE) and private set intersection (PSI) protocols, and we also obtain results for pseudorandom correlation functions (PCF), which are a key tool for silent oblivious transfer (OT) extension.
Many modern cryptographic primitives for hashing and (authenticated) encryption make use of constructions that are instantiated with an iterated cryptographic permutation that operates on a fixed-width state consisting of an array of bits. Often, such permutations are the repeated application of a relatively simple round function consisting of a linear layer and a non-linear layer. These constructions do not require that the underlying function is a permutation and they can plausibly be based on a non-invertible transformation. Recently, Grassi proposed the use of non-invertible mappings operating on arrays of digits that are elements of a finite field of odd characteristic for so-called MPC-/FHE-/ZK-friendly symmetric cryptographic primitives. In this work, we consider a mapping that we call γ that has a simple expression and is based on squaring. We discuss, for the first time, the differential and linear propagation properties of γ and observe that these follow the same rules up to a relabeling of the digits. This is an intriguing property that, as far as we know, only exists for γ and the binary mapping χ __3 that is used in the cryptographic permutation Xoodoo. Moreover, we study the implications of its non-invertibility on differentials with zero output difference and on biases at the output of the γ mapping and show that they are as small as they can possibly be.
To evaluate the security of a cryptographic primitive, investigating its resistance against differential and linear cryptanalysis is required. Many modern cryptographic primitives repeatedly apply similar round functions alternated with the addition of round keys or constants. A round function usually consists of a non-linear mapping and a number of linear mappings. The non-linear mapping χ is used in different cryptographic primitives such as Keccak and Subterranean. An alternative version of χ is used in Ascon and the non-linear layer of Simon has the same differential and linear properties of χ. The mapping χ can be applied to strings with different lengths. For instance, it can be parallelly applied to small-length strings as in Keccak, where it works on 5-bit strings, or it can be applied to big-length strings as in Subterranean, where it works on a string of length 257. Investigating the differential and linear properties of χ working on alternative lengths of strings, provides useful information to designers to make a better choice for the non-linear layer. Some differential properties of χ have been analyzed in [8] and in this work we provide a revised presentation of them. We then extend this study and we analyze linear propagation properties of χ. Thanks to these additional results, we extend the comparison between the application of parallel instances of χ on small-length strings and the application of a single instance of χ on a big-length string. We show how we can apply the results of this study also to the non-linear layers of Ascon and Simon thanks to their affine-equivalence with χ.
Multiplicative complexity (MC) is defined as the minimum number of AND gates required to implement a function with a circuit over the basis (AND, XOR, NOT). Boolean functions with MC 1 and 2 have been characterized in Fisher and Peralta (2002), and Find et al. (IJICoT 4(4), 222–236, 2017), respectively. In this work, we identify the affine equivalence classes for functions with MC 3 and 4. In order to achieve this, we utilize the notion of the dimension dim(f) of a Boolean function in relation to its linearity dimension, and provide a new lower bound suggesting that the multiplicative complexity of f is at least ⌈dim(f)/2⌉. For MC 3, this implies that there are no equivalence classes other than those 24 identified in Çalık et al. (2018). Using the techniques from Çalık et al. and the new relation between the dimension and MC, we identify all 1277 equivalence classes having MC 4. We also provide a closed formula for the number of n-variable functions with MC 3 and 4. These results allow us to construct AND-optimal circuits for Boolean functions that have MC 4 or less, independent of the number of variables they are defined on.
