SLIDE 1
On CCZ-Equivalence, Extended-Affine Equivalence and Function Twisting
Anne Canteaut, Léo Perrin June 18, 2018
BFA’2018
SLIDE 2 Definition (CCZ-Equivalence)
F : Fn
2 → Fm 2 and G : Fn 2 → Fm 2 are C(arlet)-C(harpin)-Z(inoviev) equivalent if
ΓG = { (x, G(x)), ∀x ∈ Fn
2
} = L ({ (x, F(x)), ∀x ∈ Fn
2
}) = L(ΓF) ,
where L : Fn+m
2
→ Fn+m
2
is an affine permutation.
Definition (EA-Equivalence; EA-mapping)
F and G are E(xtented) A(ffine) equivalent if G x B F A x C x , where A B C are affine and A B are permutations; so that x G x x
n 2
A
1
CA
1
B x F x x
n 2
Affine permutations with such linear part are EA-mappings; their transposes are TEA-mappings What is the relation between functions that are CCZ- but not EA-equivalent?
SLIDE 3 Definition (CCZ-Equivalence)
F : Fn
2 → Fm 2 and G : Fn 2 → Fm 2 are C(arlet)-C(harpin)-Z(inoviev) equivalent if
ΓG = { (x, G(x)), ∀x ∈ Fn
2
} = L ({ (x, F(x)), ∀x ∈ Fn
2
}) = L(ΓF) ,
where L : Fn+m
2
→ Fn+m
2
is an affine permutation.
Definition (EA-Equivalence; EA-mapping)
F and G are E(xtented) A(ffine) equivalent if G(x) = (B ◦ F ◦ A)(x) + C(x), where A, B, C are affine and A, B are permutations; so that
{ (x, G(x)), ∀x ∈ Fn
2
} = [
A−1 CA−1 B
] ({ (x, F(x)), ∀x ∈ Fn
2
}) .
Affine permutations with such linear part are EA-mappings; their transposes are TEA-mappings What is the relation between functions that are CCZ- but not EA-equivalent?
SLIDE 4 Definition (CCZ-Equivalence)
F : Fn
2 → Fm 2 and G : Fn 2 → Fm 2 are C(arlet)-C(harpin)-Z(inoviev) equivalent if
ΓG = { (x, G(x)), ∀x ∈ Fn
2
} = L ({ (x, F(x)), ∀x ∈ Fn
2
}) = L(ΓF) ,
where L : Fn+m
2
→ Fn+m
2
is an affine permutation.
Definition (EA-Equivalence; EA-mapping)
F and G are E(xtented) A(ffine) equivalent if G(x) = (B ◦ F ◦ A)(x) + C(x), where A, B, C are affine and A, B are permutations; so that
{ (x, G(x)), ∀x ∈ Fn
2
} = [
A−1 CA−1 B
] ({ (x, F(x)), ∀x ∈ Fn
2
}) .
Affine permutations with such linear part are EA-mappings; their transposes are TEA-mappings What is the relation between functions that are CCZ- but not EA-equivalent?
SLIDE 5 Definition (CCZ-Equivalence)
F : Fn
2 → Fm 2 and G : Fn 2 → Fm 2 are C(arlet)-C(harpin)-Z(inoviev) equivalent if
ΓG = { (x, G(x)), ∀x ∈ Fn
2
} = L ({ (x, F(x)), ∀x ∈ Fn
2
}) = L(ΓF) ,
where L : Fn+m
2
→ Fn+m
2
is an affine permutation.
Definition (EA-Equivalence; EA-mapping)
F and G are E(xtented) A(ffine) equivalent if G(x) = (B ◦ F ◦ A)(x) + C(x), where A, B, C are affine and A, B are permutations; so that
{ (x, G(x)), ∀x ∈ Fn
2
} = [
A−1 CA−1 B
] ({ (x, F(x)), ∀x ∈ Fn
2
}) .
Affine permutations with such linear part are EA-mappings; their transposes are TEA-mappings What is the relation between functions that are CCZ- but not EA-equivalent?
SLIDE 6 Admissible Mapping
For F : Fn
2 → Fm 2 , the affine permutation L is admissible for F if
L
( {(x, F(x)) , ∀x ∈ Fn
2}
) = {(x, G(x)) , ∀x ∈ Fn
2}
for a well defined function G : Fn
2 → Fm 2 .
Definition (LAT/Walsh Spectrum)
The L(inear) A(pproximation) T(able) of F
n 2 m 2 is F x
n 2
1
x F x
SLIDE 7 Admissible Mapping
For F : Fn
2 → Fm 2 , the affine permutation L is admissible for F if
L
( {(x, F(x)) , ∀x ∈ Fn
2}
) = {(x, G(x)) , ∀x ∈ Fn
2}
for a well defined function G : Fn
2 → Fm 2 .
Definition (LAT/Walsh Spectrum)
The L(inear) A(pproximation) T(able) of F : Fn
2 → Fm 2 is
WF(α, β) = ∑
x∈Fn
2
(−1)α·x+β·F(x) .
SLIDE 8
Structure of this talk
0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT 1.2 - Partition CCZ-class into EA-classes 2.1 - t-twist 3.3 - Revisiting known results 4.1 - CCZ-Equivalence to a permutation 4.2 - Application to APN functions
SLIDE 9
Structure of this talk
0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT 1.2 - Partition CCZ-class into EA-classes 2.1 - t-twist 3.3 - Revisiting known results 4.1 - CCZ-Equivalence to a permutation 4.2 - Application to APN functions
SLIDE 10
Structure of this talk
0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT 1.2 - Partition CCZ-class into EA-classes 2.1 - t-twist 3.3 - Revisiting known results 4.1 - CCZ-Equivalence to a permutation 4.2 - Application to APN functions
SLIDE 11
Structure of this talk
0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT 1.2 - Partition CCZ-class into EA-classes 2.1 - t-twist 3.3 - Revisiting known results 4.1 - CCZ-Equivalence to a permutation 4.2 - Application to APN functions
SLIDE 12
Structure of this talk
0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT 1.2 - Partition CCZ-class into EA-classes 2.1 - t-twist
⊞
3.3 - Revisiting known results 4.1 - CCZ-Equivalence to a permutation 4.2 - Application to APN functions
SLIDE 13
Structure of this talk
0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT 1.2 - Partition CCZ-class into EA-classes 2.1 - t-twist
⊞
3.2 - CCZ = EA + twist 3.3 - Revisiting known results 4.1 - CCZ-Equivalence to a permutation 4.2 - Application to APN functions
SLIDE 14
Structure of this talk
0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT 1.2 - Partition CCZ-class into EA-classes 2.1 - t-twist
⊞
3.2 - CCZ = EA + twist 3.3 - Revisiting known results 4.1 - CCZ-Equivalence to a permutation 4.2 - Application to APN functions
SLIDE 15
Structure of this talk
0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT 1.2 - Partition CCZ-class into EA-classes 2.1 - t-twist
⊞
3.2 - CCZ = EA + twist 3.3 - Revisiting known results 4.1 - CCZ-Equivalence to a permutation 4.2 - Application to APN functions
SLIDE 16
Structure of this talk
0 - CCZ-Equivalence ; Bijectivity 1.1 - Vector spaces of zeroes in LAT 1.2 - Partition CCZ-class into EA-classes 2.1 - t-twist
⊞
3.2 - CCZ = EA + twist 3.3 - Revisiting known results 4.1 - CCZ-Equivalence to a permutation 4.2 - Application to APN functions
SLIDE 17 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Outline
1
CCZ-Equivalence and Vector Spaces of 0
2
Function Twisting
3
Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation
4
Conclusion
3 / 32
SLIDE 18 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Plan of this Section
1
CCZ-Equivalence and Vector Spaces of 0 Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
2
Function Twisting
3
Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation
4
Conclusion
3 / 32
SLIDE 19 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Walsh Zeroes
For all F : Fn
2 → Fm 2 , we have
WF(α, 0) = ∑
x∈Fn
2
(−1)α·x+0·F(x) = 0. Definition (Walsh Zeroes)
The Walsh zeroes of F
n 2 m 2 is the set F
u
n 2 m 2 F u
With x 0 x
n 2 n m 2
, we have
F.
Note that if
G
L
F , then G
LT
1 F .
4 / 32
SLIDE 20 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Walsh Zeroes
For all F : Fn
2 → Fm 2 , we have
WF(α, 0) = ∑
x∈Fn
2
(−1)α·x+0·F(x) = 0. Definition (Walsh Zeroes)
The Walsh zeroes of F : Fn
2 → Fm 2 is the set
ZF = {u ∈ Fn
2 × Fm 2 , WF(u) = 0} ∪ {0} .
With V = {(x, 0), ∀x ∈ Fn
2} ⊂ Fn+m 2
, we have V ⊂ ZF. Note that if
G
L
F , then G
LT
1 F .
4 / 32
SLIDE 21 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Walsh Zeroes
For all F : Fn
2 → Fm 2 , we have
WF(α, 0) = ∑
x∈Fn
2
(−1)α·x+0·F(x) = 0. Definition (Walsh Zeroes)
The Walsh zeroes of F : Fn
2 → Fm 2 is the set
ZF = {u ∈ Fn
2 × Fm 2 , WF(u) = 0} ∪ {0} .
With V = {(x, 0), ∀x ∈ Fn
2} ⊂ Fn+m 2
, we have V ⊂ ZF. Note that if ΓG = L(ΓF), then ZG = (LT)−1(ZF).
4 / 32
SLIDE 22 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Admissibility for F
Lemma
Let L : Fn+m
2
→ Fn+m
2
be a linear permutation. It is admissible for F : Fn
2 → Fm 2
if and only if LT(V) ⊆ ZF
5 / 32
SLIDE 23 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Admissibility of EA-mappings
EA-mappings are admissible for all F : Fn
2 → Fm 2 :
[
A C B
]T (V) = [
AT CT BT
] ({[
x
] , ∀x ∈ Fn
2
}) = V . Theorem (Budaghyan, Carlet (2011))
The CCZ-class of a bent function contains only its EA-class.
Proof.
A function is bent no zeroes outside of no vector spaces of zeroes other than
6 / 32
SLIDE 24 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Admissibility of EA-mappings
EA-mappings are admissible for all F : Fn
2 → Fm 2 :
[
A C B
]T (V) = [
AT CT BT
] ({[
x
] , ∀x ∈ Fn
2
}) = V . Theorem (Budaghyan, Carlet (2011))
The CCZ-class of a bent function contains only its EA-class.
Proof.
A function is bent no zeroes outside of no vector spaces of zeroes other than
6 / 32
SLIDE 25 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Admissibility of EA-mappings
EA-mappings are admissible for all F : Fn
2 → Fm 2 :
[
A C B
]T (V) = [
AT CT BT
] ({[
x
] , ∀x ∈ Fn
2
}) = V . Theorem (Budaghyan, Carlet (2011))
The CCZ-class of a bent function contains only its EA-class.
Proof.
A function is bent no zeroes outside of no vector spaces of zeroes other than
6 / 32
SLIDE 26 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Admissibility of EA-mappings
EA-mappings are admissible for all F : Fn
2 → Fm 2 :
[
A C B
]T (V) = [
AT CT BT
] ({[
x
] , ∀x ∈ Fn
2
}) = V . Theorem (Budaghyan, Carlet (2011))
The CCZ-class of a bent function contains only its EA-class.
Proof.
A function is bent
= ⇒
no zeroes outside of V no vector spaces of zeroes other than
6 / 32
SLIDE 27 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Admissibility of EA-mappings
EA-mappings are admissible for all F : Fn
2 → Fm 2 :
[
A C B
]T (V) = [
AT CT BT
] ({[
x
] , ∀x ∈ Fn
2
}) = V . Theorem (Budaghyan, Carlet (2011))
The CCZ-class of a bent function contains only its EA-class.
Proof.
A function is bent
= ⇒
no zeroes outside of V
= ⇒
no vector spaces of zeroes other than V
6 / 32
SLIDE 28 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Admissibility of EA-mappings
EA-mappings are admissible for all F : Fn
2 → Fm 2 :
[
A C B
]T (V) = [
AT CT BT
] ({[
x
] , ∀x ∈ Fn
2
}) = V . Theorem (Budaghyan, Carlet (2011))
The CCZ-class of a bent function contains only its EA-class.
Proof.
A function is bent
= ⇒
no zeroes outside of V
= ⇒
no vector spaces of zeroes other than V
= ⇒
6 / 32
SLIDE 29 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Permutations
We define
V⊥ = {(0, y), ∀y ∈ Fm
2 } ⊂ Fn+m 2
. Lemma
F : Fn
2 → Fm 2 is a permutation if and only if
V⊥ ⊂ ZF .
7 / 32
SLIDE 30 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
EA-classes imply vector spaces
Lemma
let F, G and G′ be such that ΓG = L(ΓF) and ΓG′ = L′(ΓF). If L(V) = L′(V), then G and G′ are EA-equivalent. Can we use this knowledge to partition a CCZ-class into its EA-classes?
The Lemma gives us hope!
1 EA-class 1 vector space of zeroes of dimension n in
n
Reality takes it back...
The converse of the lemma is wrong.
8 / 32
SLIDE 31 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
EA-classes imply vector spaces
Lemma
let F, G and G′ be such that ΓG = L(ΓF) and ΓG′ = L′(ΓF). If L(V) = L′(V), then G and G′ are EA-equivalent. Can we use this knowledge to partition a CCZ-class into its EA-classes?
The Lemma gives us hope!
1 EA-class 1 vector space of zeroes of dimension n in
n
Reality takes it back...
The converse of the lemma is wrong.
8 / 32
SLIDE 32 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
EA-classes imply vector spaces
Lemma
let F, G and G′ be such that ΓG = L(ΓF) and ΓG′ = L′(ΓF). If L(V) = L′(V), then G and G′ are EA-equivalent. Can we use this knowledge to partition a CCZ-class into its EA-classes?
The Lemma gives us hope!
1 EA-class =
⇒ 1 vector space of zeroes of dimension n in Zn Reality takes it back...
The converse of the lemma is wrong.
8 / 32
SLIDE 33 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
EA-classes imply vector spaces
Lemma
let F, G and G′ be such that ΓG = L(ΓF) and ΓG′ = L′(ΓF). If L(V) = L′(V), then G and G′ are EA-equivalent. Can we use this knowledge to partition a CCZ-class into its EA-classes?
The Lemma gives us hope!
1 EA-class =
⇒ 1 vector space of zeroes of dimension n in Zn Reality takes it back...
The converse of the lemma is wrong.
8 / 32
SLIDE 34 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Counter-example
Let F : Fn
2 → Fn 2 be a permutation and let
Mn =
[
In In
] .
It holds that
ΓF−1 = { (x, F(x)) , ∀x ∈ Fn
2
} = { (
F−1(y), (F ◦ F−1)(y)
) , ∀y ∈ Fn
2
} = { (
F−1(y), y
) , ∀y ∈ Fn
2
} = Mn(ΓF) . The contradiction
If F is an involution then
F F
1
Mn
F
Mn In ... but Mn and In send
F in the same EA-class
(namely that of F).
9 / 32
SLIDE 35 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Counter-example
Let F : Fn
2 → Fn 2 be a permutation and let
Mn =
[
In In
] .
It holds that
ΓF−1 = { (x, F(x)) , ∀x ∈ Fn
2
} = { (
F−1(y), (F ◦ F−1)(y)
) , ∀y ∈ Fn
2
} = { (
F−1(y), y
) , ∀y ∈ Fn
2
} = Mn(ΓF) . The contradiction
If F is an involution then ΓF = ΓF−1 = Mn(ΓF) Mn In ... but Mn and In send
F in the same EA-class
(namely that of F).
9 / 32
SLIDE 36 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Counter-example
Let F : Fn
2 → Fn 2 be a permutation and let
Mn =
[
In In
] .
It holds that
ΓF−1 = { (x, F(x)) , ∀x ∈ Fn
2
} = { (
F−1(y), (F ◦ F−1)(y)
) , ∀y ∈ Fn
2
} = { (
F−1(y), y
) , ∀y ∈ Fn
2
} = Mn(ΓF) . The contradiction
If F is an involution then ΓF = ΓF−1 = Mn(ΓF)
= ⇒
Mn(V) = V⊥ ̸= In(V) ... but Mn and In send
F in the same EA-class
(namely that of F).
9 / 32
SLIDE 37 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Counter-example
Let F : Fn
2 → Fn 2 be a permutation and let
Mn =
[
In In
] .
It holds that
ΓF−1 = { (x, F(x)) , ∀x ∈ Fn
2
} = { (
F−1(y), (F ◦ F−1)(y)
) , ∀y ∈ Fn
2
} = { (
F−1(y), y
) , ∀y ∈ Fn
2
} = Mn(ΓF) . The contradiction
If F is an involution then ΓF = ΓF−1 = Mn(ΓF)
= ⇒
Mn(V) = V⊥ ̸= In(V) ... but Mn and In send ΓF in the same EA-class (namely that of F).
9 / 32
SLIDE 38 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Making the converse work (1/2)
Definition (CCZ-invariants)
The CCZ-invariants of F : Fn
2 → Fn 2 are the affine permutations L of Fn+n 2
such that L(ΓF) = ΓF .
Examples
For an involution, Mn is a CCZ-invariant. For a quadratic function q, there are CCZ-invariants with the following linear parts: In q In
10 / 32
SLIDE 39 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Making the converse work (1/2)
Definition (CCZ-invariants)
The CCZ-invariants of F : Fn
2 → Fn 2 are the affine permutations L of Fn+n 2
such that L(ΓF) = ΓF .
Examples
For an involution, Mn is a CCZ-invariant. For a quadratic function q, there are CCZ-invariants with the following linear parts:
[
In
∆αq
In
] .
10 / 32
SLIDE 40 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Making the converse work (2/2)
Theorem (Number of EA-classes)
For F : Fn
2 → Fm 2 , let:
sF be the number of vector spaces of dimension n in ZF cF be the number of CCZ-invariants of F eF be the number of EA-classes in the CCZ-class of F. Then sF cF eF sF
Corollary
If cF 1, then we do have a bijection between EA-classes and vector spaces of 0
F.
11 / 32
SLIDE 41 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Making the converse work (2/2)
Theorem (Number of EA-classes)
For F : Fn
2 → Fm 2 , let:
sF be the number of vector spaces of dimension n in ZF cF be the number of CCZ-invariants of F eF be the number of EA-classes in the CCZ-class of F. Then sF cF
≤ eF ≤ sF . Corollary
If cF 1, then we do have a bijection between EA-classes and vector spaces of 0
F.
11 / 32
SLIDE 42 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Vector Spaces of Zeroes Partitioning a CCZ-Class into EA-Classes
Making the converse work (2/2)
Theorem (Number of EA-classes)
For F : Fn
2 → Fm 2 , let:
sF be the number of vector spaces of dimension n in ZF cF be the number of CCZ-invariants of F eF be the number of EA-classes in the CCZ-class of F. Then sF cF
≤ eF ≤ sF . Corollary
If cF = 1, then we do have a bijection between EA-classes and vector spaces of 0
11 / 32
SLIDE 43 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Outline
1
CCZ-Equivalence and Vector Spaces of 0
2
Function Twisting
3
Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation
4
Conclusion
11 / 32
SLIDE 44 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Plan of this Section
1
CCZ-Equivalence and Vector Spaces of 0
2
Function Twisting The Twist CCZ = EA + Twist Revisiting some Results
3
Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation
4
Conclusion
11 / 32
SLIDE 45 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
EA-equivalence is a simple sub-case of CCZ-Equivalence... What must we add to EA-equivalence to fully describe CCZ-Equivalence?
12 / 32
SLIDE 46 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
EA-equivalence is a simple sub-case of CCZ-Equivalence... What must we add to EA-equivalence to fully describe CCZ-Equivalence?
12 / 32
SLIDE 47 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Definition of the Twist
Any function F : Fn
2 → Fm 2 can be projected on Ft 2 × Fm−t 2
. T U t n − t t m − t F T
1
U t n t t m t G If T is a permutation for all secondary inputs, then we define the t-twist equivalent
G x y T
1 y
x UT
1 y
x
y for all x y
t 2 n t 2
.
13 / 32
SLIDE 48 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Definition of the Twist
Any function F : Fn
2 → Fm 2 can be projected on Ft 2 × Fm−t 2
. T U t n − t t m − t F T−1 U t n − t t m − t G If T is a permutation for all secondary inputs, then we define the t-twist equivalent
G(x, y) =
(
T−1
y (x), UT−1
y (x)(y)
)
for all (x, y) ∈ Ft
2 × Fn−t 2
.
13 / 32
SLIDE 49 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Examples of Twisting
Inversion is an n-twist. Open and closed butterflies operating on n bits are obtained from another with an n 2 -twist. Some degenerate cases exist for t m and n n. T
m; n m m
t m (start) T
1
m n m m
t m (end) T U
n m n n
t n (start) T
1
U
n m n n
t n (end)
14 / 32
SLIDE 50 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Examples of Twisting
Inversion is an n-twist. Open and closed butterflies operating on n bits are obtained from another with an (n/2)-twist. Some degenerate cases exist for t m and n n. T
m; n m m
t m (start) T
1
m n m m
t m (end) T U
n m n n
t n (start) T
1
U
n m n n
t n (end)
14 / 32
SLIDE 51 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Examples of Twisting
Inversion is an n-twist. Open and closed butterflies operating on n bits are obtained from another with an (n/2)-twist. Some degenerate cases exist for t = m and n = n. T
m; n m m
t m (start) T
1
m n m m
t m (end) T U
n m n n
t n (start) T
1
U
n m n n
t n (end)
14 / 32
SLIDE 52 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Examples of Twisting
Inversion is an n-twist. Open and closed butterflies operating on n bits are obtained from another with an (n/2)-twist. Some degenerate cases exist for t = m and n = n. T
m; n − m m
t = m (start) T−1
m n − m m
t = m (end) T U
n m − n n
t = n (start) T−1 U
n m − n n
t = n (end)
14 / 32
SLIDE 53 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Swap Matrices
The swap matrix permuting Fn+m
2
is defined for t ≤ min(n, m) as Mt =
It In−t It Im−t
.
It has a simple interpretation: t n t t m t For all t min n m , Mt is an orthogonal and symmetric involution.
15 / 32
SLIDE 54 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Swap Matrices
The swap matrix permuting Fn+m
2
is defined for t ≤ min(n, m) as Mt =
It In−t It Im−t
.
It has a simple interpretation: t n − t t m − t For all t min n m , Mt is an orthogonal and symmetric involution.
15 / 32
SLIDE 55 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Swap Matrices
The swap matrix permuting Fn+m
2
is defined for t ≤ min(n, m) as Mt =
It In−t It Im−t
.
It has a simple interpretation: t n − t t m − t For all t ≤ min(n, m), Mt is an orthogonal and symmetric involution.
15 / 32
SLIDE 56 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Swap Matrices and Twisting
F : Fn
2 → Fm 2
T U t n − t t m − t t-twist G : Fn
2 → Fm 2
T−1 U t n − t t m − t
F
x F x x
n 2
Mt
G
x G x x
n 2 F u G Mt u
16 / 32
SLIDE 57 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Swap Matrices and Twisting
F : Fn
2 → Fm 2
T U t n − t t m − t t-twist G : Fn
2 → Fm 2
T−1 U t n − t t m − t
ΓF = { (x, F(x)) , ∀x ∈ Fn
2
}
Mt
ΓG = { (x, G(x)) , ∀x ∈ Fn
2
}
F u G Mt u
16 / 32
SLIDE 58 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Swap Matrices and Twisting
F : Fn
2 → Fm 2
T U t n − t t m − t t-twist G : Fn
2 → Fm 2
T−1 U t n − t t m − t
ΓF = { (x, F(x)) , ∀x ∈ Fn
2
}
Mt
ΓG = { (x, G(x)) , ∀x ∈ Fn
2
} WF(u) = WG (Mt(u))
16 / 32
SLIDE 59 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Twisting and CCZ-Class
Lemma
Twisting preserves the CCZ-equivalence class.
17 / 32
SLIDE 60 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Twisting and CCZ-Class
Lemma
Twisting preserves the CCZ-equivalence class.
17 / 32
SLIDE 61 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Main Result
Theorem
If F : Fn
2 → Fm 2 and G : Fn 2 → Fm 2 are CCZ-equivalent, then
ΓG = (B × Mt × A)(ΓF) ,
where A and B are EA-mappings and where t = dim
(
projV⊥
( (AT × Mt × BT)(V) )) .
In other words, EA-equivalence and twists are sufficient to fully describe CCZ-equivalence!
Corollary
If a function is CCZ-equivalent but not EA-equivalent to another function, then they have to be EA-equivalent to functions for which a t-twist is possible.
18 / 32
SLIDE 62 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Main Result
Theorem
If F : Fn
2 → Fm 2 and G : Fn 2 → Fm 2 are CCZ-equivalent, then
ΓG = (B × Mt × A)(ΓF) ,
where A and B are EA-mappings and where t = dim
(
projV⊥
( (AT × Mt × BT)(V) )) .
In other words, EA-equivalence and twists are sufficient to fully describe CCZ-equivalence!
Corollary
If a function is CCZ-equivalent but not EA-equivalent to another function, then they have to be EA-equivalent to functions for which a t-twist is possible.
18 / 32
SLIDE 63 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Proof sketch
- 1. As F is CCZ-equivalent to G, there is a linear permutation L : Fn+m
2
→ Fn+m
2
such that
ΓG = L(ΓF) and LT(V) ⊂ ZF .
- 2. Any vector space V of dimension n such that dim proj
V t can be written as V AT Mt where A is an EA-mapping. 1+2. We deduce that LT AT Mt
F.
1+2+lem. As LT AT Mt , the functions G and G such that
G
L
F and G
AT Mt
F are EA-equivalent.
We conclude that
G
B Mt A
F
19 / 32
SLIDE 64 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Proof sketch
- 1. As F is CCZ-equivalent to G, there is a linear permutation L : Fn+m
2
→ Fn+m
2
such that
ΓG = L(ΓF) and LT(V) ⊂ ZF .
- 2. Any vector space V of dimension n such that dim(projV⊥(V)) = t can be
written as V = (AT × Mt)(V) , where A is an EA-mapping. 1+2. We deduce that LT AT Mt
F.
1+2+lem. As LT AT Mt , the functions G and G such that
G
L
F and G
AT Mt
F are EA-equivalent.
We conclude that
G
B Mt A
F
19 / 32
SLIDE 65 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Proof sketch
- 1. As F is CCZ-equivalent to G, there is a linear permutation L : Fn+m
2
→ Fn+m
2
such that
ΓG = L(ΓF) and LT(V) ⊂ ZF .
- 2. Any vector space V of dimension n such that dim(projV⊥(V)) = t can be
written as V = (AT × Mt)(V) , where A is an EA-mapping. 1+2. We deduce that LT(V) = (AT × Mt)(V) ⊂ ZF. 1+2+lem. As LT AT Mt , the functions G and G such that
G
L
F and G
AT Mt
F are EA-equivalent.
We conclude that
G
B Mt A
F
19 / 32
SLIDE 66 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Proof sketch
- 1. As F is CCZ-equivalent to G, there is a linear permutation L : Fn+m
2
→ Fn+m
2
such that
ΓG = L(ΓF) and LT(V) ⊂ ZF .
- 2. Any vector space V of dimension n such that dim(projV⊥(V)) = t can be
written as V = (AT × Mt)(V) , where A is an EA-mapping. 1+2. We deduce that LT(V) = (AT × Mt)(V) ⊂ ZF. 1+2+lem. As LT(V) = (AT × Mt)(V), the functions G and G′ such that ΓG = L(ΓF) and
ΓG′ = (AT × Mt)(ΓF) are EA-equivalent.
We conclude that
ΓG = (B × Mt × A)(ΓF) .
19 / 32
SLIDE 67 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Usage?
What can we do with this knowledge?
20 / 32
SLIDE 68 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Boolean Functions
Theorem (Budaghyan, Carlet (2011))
The CCZ-class of F : Fn
2 → F2 is limited to its EA-class.
Proof.
F is CCZ- but not EA-equivalent to some G F x y Ty x , x y
2 n 1 2
, where Ty is always a permutation of
2
F x y x f y , x y
2 n 1 2
, 1-twisting F does not change the EA-class it is impossible to leave the EA-class of F
21 / 32
SLIDE 69 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Boolean Functions
Theorem (Budaghyan, Carlet (2011))
The CCZ-class of F : Fn
2 → F2 is limited to its EA-class.
Proof.
F is CCZ- but not EA-equivalent to some G F x y Ty x , x y
2 n 1 2
, where Ty is always a permutation of
2
F x y x f y , x y
2 n 1 2
, 1-twisting F does not change the EA-class it is impossible to leave the EA-class of F
21 / 32
SLIDE 70 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Boolean Functions
Theorem (Budaghyan, Carlet (2011))
The CCZ-class of F : Fn
2 → F2 is limited to its EA-class.
Proof.
F is CCZ- but not EA-equivalent to some G
= ⇒
F(x||y) = Ty(x), ∀(x, y) ∈ F2 × Fn−1
2
, where Ty is always a permutation of F2 F x y x f y , x y
2 n 1 2
, 1-twisting F does not change the EA-class it is impossible to leave the EA-class of F
21 / 32
SLIDE 71 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Boolean Functions
Theorem (Budaghyan, Carlet (2011))
The CCZ-class of F : Fn
2 → F2 is limited to its EA-class.
Proof.
F is CCZ- but not EA-equivalent to some G
= ⇒
F(x||y) = Ty(x), ∀(x, y) ∈ F2 × Fn−1
2
, where Ty is always a permutation of F2
= ⇒
F(x||y) = x ⊕ f(y), ∀(x, y) ∈ F2 × Fn−1
2
,
= ⇒
1-twisting F does not change the EA-class
= ⇒
it is impossible to leave the EA-class of F
21 / 32
SLIDE 72 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Modular Addition (1/2)
Theorem (Schulte-Geers’13)
Addition modulo 2m is CCZ-equivalent to q(x, y) = (0, x0y0, x0y0 + x1y1, ..., x0y0 + ... + xn2yn2) , where Γ⊞ = L(Γq) with L =
Im Im Im Im Im Im Im
.
It holds that L
1
Im Im Im Im Im
A1
Im Im Im
Mm
Im Im Im Im Im
A2
22 / 32
SLIDE 73 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Modular Addition (1/2)
Theorem (Schulte-Geers’13)
Addition modulo 2m is CCZ-equivalent to q(x, y) = (0, x0y0, x0y0 + x1y1, ..., x0y0 + ... + xn2yn2) , where Γ⊞ = L(Γq) with L =
Im Im Im Im Im Im Im
.
It holds that L−1 =
Im Im Im Im Im
×
Im Im Im
×
Im Im Im Im Im
.
22 / 32
SLIDE 74 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Modular Addition (2/2)
Lemma
Let T⊞
z : Fm 2 → Fm 2 be defined by
T⊞
z (x) =
(
x ⊞ (x ⊕ z)
) ⊕ (x ⊕ z) .
Tz is a permutation for all z; it is EA-equivalent to x y x y; x z Tz x has algebraic degree m; x z Tz
1 x is quadratic!
Let v Tz x . Then: v0 x0 vi
1
xi xi
1
vizi and, convertly, x0 v0 xi
1
xi vi
1
vizi
23 / 32
SLIDE 75 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Modular Addition (2/2)
Lemma
Let T⊞
z : Fm 2 → Fm 2 be defined by
T⊞
z (x) =
(
x ⊞ (x ⊕ z)
) ⊕ (x ⊕ z) .
T⊞
z is a permutation for all z;
it is EA-equivalent to (x, y) → x ⊞ y; x z Tz x has algebraic degree m; x z Tz
1 x is quadratic!
Let v Tz x . Then: v0 x0 vi
1
xi xi
1
vizi and, convertly, x0 v0 xi
1
xi vi
1
vizi
23 / 32
SLIDE 76 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Modular Addition (2/2)
Lemma
Let T⊞
z : Fm 2 → Fm 2 be defined by
T⊞
z (x) =
(
x ⊞ (x ⊕ z)
) ⊕ (x ⊕ z) .
T⊞
z is a permutation for all z;
it is EA-equivalent to (x, y) → x ⊞ y;
(x, z) → T⊞
z (x) has algebraic degree m;
(x, z) → (T⊞
z )−1(x) is quadratic!
Let v Tz x . Then: v0 x0 vi
1
xi xi
1
vizi and, convertly, x0 v0 xi
1
xi vi
1
vizi
23 / 32
SLIDE 77 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion The Twist CCZ = EA + Twist Revisiting some Results
Modular Addition (2/2)
Lemma
Let T⊞
z : Fm 2 → Fm 2 be defined by
T⊞
z (x) =
(
x ⊞ (x ⊕ z)
) ⊕ (x ⊕ z) .
T⊞
z is a permutation for all z;
it is EA-equivalent to (x, y) → x ⊞ y;
(x, z) → T⊞
z (x) has algebraic degree m;
(x, z) → (T⊞
z )−1(x) is quadratic!
Let v = T⊞
z (x). Then:
{
v0
= x0
vi+1
= xi + xi+1 + vizi
and, convertly,
{
x0
= v0
xi+1
= xi + vi+1 + vizi .
23 / 32
SLIDE 78 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Efficient Criteria Applications to APN Functions
Outline
1
CCZ-Equivalence and Vector Spaces of 0
2
Function Twisting
3
Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation
4
Conclusion
23 / 32
SLIDE 79 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Efficient Criteria Applications to APN Functions
Plan of this Section
1
CCZ-Equivalence and Vector Spaces of 0
2
Function Twisting
3
Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Efficient Criteria Applications to APN Functions
4
Conclusion
23 / 32
SLIDE 80 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Efficient Criteria Applications to APN Functions
Another Problem
How do we know if a function is CCZ-equivalent to a permutation?
24 / 32
SLIDE 81 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Efficient Criteria Applications to APN Functions
Remainder
Recall that F is a permutation if and only if V ⊂ ZF and V⊥ ⊂ ZF.
Lemma
G is CCZ-equivalent to a permutation if and only if V L
G and V
L
G
for some linear permutation L. Note that span V V
n 2 m 2
25 / 32
SLIDE 82 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Efficient Criteria Applications to APN Functions
Remainder
Recall that F is a permutation if and only if V ⊂ ZF and V⊥ ⊂ ZF.
Lemma
G is CCZ-equivalent to a permutation if and only if V = L(V) ⊂ ZG and V′ = L(V⊥) ⊂ ZG for some linear permutation L. Note that span
(
V ∪ V′)
= Fn
2 × Fm 2 .
25 / 32
SLIDE 83 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Efficient Criteria Applications to APN Functions
3-Spaces Criteria
3-space criteria
Let F : Fn
2 → Fm 2 , not be a permutation. If it is CCZ-equivalent to a permutation
then ZF must contain at least 3 vector spaces of zeroes of dimension n.
26 / 32
SLIDE 84 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Efficient Criteria Applications to APN Functions
Projected Spaces Criteria
Key observation
The projections p : (x, y) → x and p′ : (x, y) → y mapping Fn
2 × Fm 2 to Fn 2 and Fm 2 respectively are linear.
Thus, If G is CCZ-equivalent to a permutation then p V and p V are subspaces of
n 2 whose span is n 2.
We deduce that dim p V dim p V n
Projected Spaces Criteria
If F
n 2 m 2 is CCZ-equivalent to a permutation, then there are at least two
subspaces of dimension n 2 in p
F and in p F .
27 / 32
SLIDE 85 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Efficient Criteria Applications to APN Functions
Projected Spaces Criteria
Key observation
The projections p : (x, y) → x and p′ : (x, y) → y mapping Fn
2 × Fm 2 to Fn 2 and Fm 2 respectively are linear.
Thus, If G is CCZ-equivalent to a permutation then p(V) and p(V′) are subspaces of
Fn
2 whose span is Fn 2.
We deduce that dim p V dim p V n
Projected Spaces Criteria
If F
n 2 m 2 is CCZ-equivalent to a permutation, then there are at least two
subspaces of dimension n 2 in p
F and in p F .
27 / 32
SLIDE 86 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Efficient Criteria Applications to APN Functions
Projected Spaces Criteria
Key observation
The projections p : (x, y) → x and p′ : (x, y) → y mapping Fn
2 × Fm 2 to Fn 2 and Fm 2 respectively are linear.
Thus, If G is CCZ-equivalent to a permutation then p(V) and p(V′) are subspaces of
Fn
2 whose span is Fn 2.
We deduce that dim (p(V)) + dim (p(V′)) ≥ n
Projected Spaces Criteria
If F
n 2 m 2 is CCZ-equivalent to a permutation, then there are at least two
subspaces of dimension n 2 in p
F and in p F .
27 / 32
SLIDE 87 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Efficient Criteria Applications to APN Functions
Projected Spaces Criteria
Key observation
The projections p : (x, y) → x and p′ : (x, y) → y mapping Fn
2 × Fm 2 to Fn 2 and Fm 2 respectively are linear.
Thus, If G is CCZ-equivalent to a permutation then p(V) and p(V′) are subspaces of
Fn
2 whose span is Fn 2.
We deduce that dim (p(V)) + dim (p(V′)) ≥ n
Projected Spaces Criteria
If F : Fn
2 → Fm 2 is CCZ-equivalent to a permutation, then there are at least two
subspaces of dimension n/2 in p(ZF) and in p′(ZF).
27 / 32
SLIDE 88 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Efficient Criteria Applications to APN Functions
QAM
Yu et al. (DCC’14) generated 8180 8-APN quadratic functions from “QAM” (matrices). None of them are CCZ-equivalent to a permutation
28 / 32
SLIDE 89 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Efficient Criteria Applications to APN Functions
QAM
Yu et al. (DCC’14) generated 8180 8-APN quadratic functions from “QAM” (matrices). None of them are CCZ-equivalent to a permutation
28 / 32
SLIDE 90 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Efficient Criteria Applications to APN Functions
Göloğlu’s Candidates (1/2)
Göloğlu’s introduced APN functions fk : x → x2k+1 + (x + x2n/2)2k+1 for n = 4t. They have the subspace property of the Kim mapping. Unfortunately, fk are not equivalent to permutations on n 4 8 and does not seem to be equivalent to one on n 12 (we say “it does not seem to be equivalent to a permutation” since checking the existence
- f CCZ-equivalent permutations requires huge amount of computing
and is infeasible on n 12; our program was still running at the time
29 / 32
SLIDE 91 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Efficient Criteria Applications to APN Functions
Göloğlu’s Candidates (1/2)
Göloğlu’s introduced APN functions fk : x → x2k+1 + (x + x2n/2)2k+1 for n = 4t. They have the subspace property of the Kim mapping. Unfortunately, fk are not equivalent to permutations on n = 4, 8 and does not seem to be equivalent to one on n = 12 (we say “it does not seem to be equivalent to a permutation” since checking the existence
- f CCZ-equivalent permutations requires huge amount of computing
and is infeasible on n = 12; our program was still running at the time
29 / 32
SLIDE 92 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Efficient Criteria Applications to APN Functions
Göloğlu’s Candidates (2/2)
n cardinal proj. time proj. (s) time BasesExtraction (s) 12 1365 0.066 0.0012 16 21845 16.79 0.084 20 349525 10096.00 37.48 Time needed to show that fk is not CCZ-equivalent to a permutation.
30 / 32
SLIDE 93 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Summary Open Problems
Outline
1
CCZ-Equivalence and Vector Spaces of 0
2
Function Twisting
3
Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation
4
Conclusion
30 / 32
SLIDE 94 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Summary Open Problems
Plan of this Section
1
CCZ-Equivalence and Vector Spaces of 0
2
Function Twisting
3
Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation
4
Conclusion Summary Open Problems
30 / 32
SLIDE 95 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Summary Open Problems
Conclusion
CCZ = EA + Twist, both of which have a simple interpretation. Efficient criteria to know if a function is CCZ-equivalent to a permutation... ... implemented using a very efficient vector space extraction algorithm (not presented) The Fourier transform solves everything!
31 / 32
SLIDE 96 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Summary Open Problems
Conclusion
CCZ = EA + Twist, both of which have a simple interpretation. Efficient criteria to know if a function is CCZ-equivalent to a permutation... ... implemented using a very efficient vector space extraction algorithm (not presented) The Fourier transform solves everything!
31 / 32
SLIDE 97 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Summary Open Problems
Open Problems
EA-equivalence
How can we efficiently check the EA-equivalence of two functions?
Conjecture
If the CCZ-class of a permutation P is not reduced to the EA-classes of P and P
1,
then P has the following decomposition T U t n t t n t where both T and U are keyed permutations.
32 / 32
SLIDE 98 CCZ-Equivalence and Vector Spaces of 0 Function Twisting Necessary and Efficient Conditions for CCZ-Equivalence to a Permutation Conclusion Summary Open Problems
Open Problems
EA-equivalence
How can we efficiently check the EA-equivalence of two functions?
Conjecture
If the CCZ-class of a permutation P is not reduced to the EA-classes of P and P−1, then P has the following decomposition T U t n − t t n − t where both T and U are keyed permutations.
32 / 32
