Unicyclic strong permutations Claude Gravel (Universit e de Montr - PowerPoint PPT Presentation

Unicyclic strong permutations Claude Gravel (Universit´ e de Montr´ eal) Daniel Panario (Carleton University) David Thomson (Carleton University) Tuesday, June 19 th , and Wednesday, 20 th , 2018 The 3 rd International Workshop on B oolean F unctions and their A pplications BFA 2018 Loen (Norway) 1 / 41

Some properties of permutations By unicyclic strong permutations, we mean permutations that satisfy: ( 1 ) Unicyclic (contains only one cycle of maximal length), ( 2 ) Number of terms per output bits is about 2 d − 1 , where d is the degree of the irreducible polynomial, ( 3 ) Maximal algebraic degree, ( 4 ) Easy to describe, ( 5 ) Small values of the first-order differences (differential cryptanalysis), ( 6 ) Small values of Walsh sums (Walsh spectrum cryptanalysis), ( 7 ) On-the-fly generation. We shall refer to above properties later when necessary. 2 / 41

Finding unicyclic permutation For large n > 0, listing all of the n ! permutations, and retaining only the unicyclic ones is infeasible. The are exactly ( n − 1)! unicyclic permutations over a finite set of n distinct elements. 3 / 41

Finding unicyclic permutation For large n > 0, listing all of the n ! permutations, and retaining only the unicyclic ones is infeasible. The are exactly ( n − 1)! unicyclic permutations over a finite set of n distinct elements. QUESTION : Is it possible to construct efficiently a subset of the set of all permutations which are easy to describe, permutations there have only one cycle (and eventually other strong properties)? 3 / 41

Polynomial & permutation–example We construct a permutation over the set { 0 , 1 } d of binary words, hence n = 2 d . To fit here, d = 3. The construction uses operations over polynomials. 4 / 41

Polynomial & permutation–example We construct a permutation over the set { 0 , 1 } d of binary words, hence n = 2 d . To fit here, d = 3. The construction uses operations over polynomials. NOTATION : P a ( X ) = a 0 + a 1 X + . . . + a d − 1 X d − 1 where a = ( a 0 , . . . , a d − 1 ) ∈ { 0 , 1 } d . FACT : For all nonzero a ∈ { 0 , 1 } 3 , functions over { 0 , 1 } 3 defined through P a ( X ) �→ P ℓ a ( X ) for ℓ = 1 , 2 , 3 , 4 , 5 , 6 are permutations. a ( X ) = P 2 d − 2 For example, we compute P 6 ( X ). a 4 / 41

Polynomial & permutation–example cont’d For example, choosing the irreducible polynomial Q ( X ) = 1 + X 2 + X 3 , compute X j mod Q ( X ) for j = 0 , . . . , 6. 5 / 41

Polynomial & permutation–example cont’d For example, choosing the irreducible polynomial Q ( X ) = 1 + X 2 + X 3 , compute X j mod Q ( X ) for j = 0 , . . . , 6. For a = a 0 a 1 a 2 ∈ { 0 , 1 } 3 , focus on P 2 k a ( X ). P 2 0 a ( X ) = P a ( X ) , P 2 1 X 2 , � � � � a ( X ) = a 0 + a 2 + a 2 X + a 1 + a 2 P 2 2 � 2 P 2 � a ( X ) = a ( X ) X + a 1 X 2 . � � � = a 0 + a 1 ) + a 1 + a 2 5 / 41

Polynomial & permutation–example cont’d Finally, a ( X ) = P 2 1 a ( X ) P 2 2 P 6 a ( X ) � � = a 0 + a 2 + a 0 a 1 + a 0 a 2 + a 1 a 2 + � � a 1 + a 2 + a 0 a 1 + a 1 a 2 X + X 2 � � a 1 + a 0 a 2 + a 1 a 2 def = P b ( X ) , and 6 / 41

Polynomial & permutation–example cont’d Finally, a 0 a 1 a 2 b 0 b 1 b 2 a ( X ) = P 2 1 a ( X ) P 2 2 P 6 0 0 0 0 0 0 a ( X ) 0 0 1 1 1 0 � � = a 0 + a 2 + a 0 a 1 + a 0 a 2 + a 1 a 2 + 0 1 0 0 1 1 � � a 1 + a 2 + a 0 a 1 + a 1 a 2 X + 0 1 1 0 1 0 X 2 � � a 1 + a 0 a 2 + a 1 a 2 1 0 0 1 0 0 def 1 0 1 1 1 1 = P b ( X ) , 1 1 0 0 0 1 1 1 1 1 0 1 and 6 / 41

Polynomial & permutation–example cont’d Finally, a 0 a 1 a 2 b 0 b 1 b 2 a ( X ) = P 2 1 a ( X ) P 2 2 P 6 0 0 0 0 0 0 a ( X ) 0 0 1 1 1 0 � � = a 0 + a 2 + a 0 a 1 + a 0 a 2 + a 1 a 2 + 0 1 0 0 1 1 � � a 1 + a 2 + a 0 a 1 + a 1 a 2 X + 0 1 1 0 1 0 X 2 � � a 1 + a 0 a 2 + a 1 a 2 1 0 0 1 0 0 def 1 0 1 1 1 1 = P b ( X ) , 1 1 0 0 0 1 1 1 1 1 0 1 and FACT : For all d and irreducible polynomial Q ( X ) of degree d , the permutation obtained by considering P 2 d − 2 ( X ) mod Q has fixed a points and cycles of length two. NOTE : Another example with fixed points and cycle of length two is the non-linear part of AES for which d = 8. 6 / 41

Polynomial & permutation–example cont’d Three binary coordinate functions, one for each power of X . Bits b 0 , b 1 , b 2 are themselves polynomials of the bits a 0 , a 1 , a 2 modulo 2. b 0 ( a 0 , a 1 , a 2 ) = a 0 + a 2 + a 0 a 1 + a 0 a 2 + a 1 a 2 , b 1 ( a 0 , a 1 , a 2 ) = a 1 + a 2 + a 0 a 1 + a 1 a 2 , b 2 ( a 0 , a 1 , a 2 ) = a 1 + a 0 a 2 + a 1 a 2 . 7 / 41

Polynomial & permutation–example cont’d Three binary coordinate functions, one for each power of X . Bits b 0 , b 1 , b 2 are themselves polynomials of the bits a 0 , a 1 , a 2 modulo 2. b 0 ( a 0 , a 1 , a 2 ) = a 0 + a 2 + a 0 a 1 + a 0 a 2 + a 1 a 2 , b 1 ( a 0 , a 1 , a 2 ) = a 1 + a 2 + a 0 a 1 + a 1 a 2 , b 2 ( a 0 , a 1 , a 2 ) = a 1 + a 0 a 2 + a 1 a 2 . Like for polynomials with real coefficients, differential calculus can be used to approximate, and get information on the polynomials b 0 , b 1 , and b 2 ; this is differential cryptanalysis. Another cryptanalytic method is based the Walsh spectrum, and can translate easily into a quantum cryptanalytic method by using the quantum Fourier transform. 7 / 41

Polynomial & permutation–example cont’d Three binary coordinate functions, one for each power of X . Bits b 0 , b 1 , b 2 are themselves polynomials of the bits a 0 , a 1 , a 2 modulo 2. b 0 ( a 0 , a 1 , a 2 ) = a 0 + a 2 + a 0 a 1 + a 0 a 2 + a 1 a 2 , b 1 ( a 0 , a 1 , a 2 ) = a 1 + a 2 + a 0 a 1 + a 1 a 2 , b 2 ( a 0 , a 1 , a 2 ) = a 1 + a 0 a 2 + a 1 a 2 . Like for polynomials with real coefficients, differential calculus can be used to approximate, and get information on the polynomials b 0 , b 1 , and b 2 ; this is differential cryptanalysis. Another cryptanalytic method is based the Walsh spectrum, and can translate easily into a quantum cryptanalytic method by using the quantum Fourier transform. FACT : The degree of the functions b j ( a )’s is d − 1 = 2. However, all the functions involved in P 2 k a ( X ) are linear in the a j ’s. . . 7 / 41

Unicyclic strong permutations–Definition I Let P ( X ) be a fixed non-constant perturbation polynomial. Here σ is a permutation over { 0 , 1 } d constructed by composing d permutations σ k for k = 0 , . . . , d − 1 such that σ k is defined by the map: 8 / 41

Unicyclic strong permutations–Definition I Let P ( X ) be a fixed non-constant perturbation polynomial. Here σ is a permutation over { 0 , 1 } d constructed by composing d permutations σ k for k = 0 , . . . , d − 1 such that σ k is defined by the map: � 2 d − 2 k − 1 � P σ k ( a ) ( X ) = P a ( X ) + P ( X ) (mod Q ) for k = 0 , . . . , d − 1 8 / 41

Unicyclic strong permutations–Definition I Let P ( X ) be a fixed non-constant perturbation polynomial. Here σ is a permutation over { 0 , 1 } d constructed by composing d permutations σ k for k = 0 , . . . , d − 1 such that σ k is defined by the map: � 2 d − 2 k − 1 � P σ k ( a ) ( X ) = P a ( X ) + P ( X ) (mod Q ) for k = 0 , . . . , d − 1 a �→ σ k ( a ) 8 / 41

Unicyclic strong permutations–Definition I Let P ( X ) be a fixed non-constant perturbation polynomial. Here σ is a permutation over { 0 , 1 } d constructed by composing d permutations σ k for k = 0 , . . . , d − 1 such that σ k is defined by the map: � 2 d − 2 k − 1 � P σ k ( a ) ( X ) = P a ( X ) + P ( X ) (mod Q ) for k = 0 , . . . , d − 1 a �→ σ k ( a ) And then σ = σ d − 1 ◦ σ d − 2 ◦ · · · ◦ σ 0 8 / 41

Unicyclic strong permutations–Definition II Let P ( X ) be a fixed non-constant perturbation polynomial. Here σ is permutation over { 0 , 1 } d constructed by recurrence. A word a ∈ { 0 , 1 } d is mapped to b ∈ { 0 , 1 } d through a sequence of steps a = a (0) → . . . → a ( i ) → . . . → a ( d ) = σ ( a ) = b defined by 9 / 41

Unicyclic strong permutations–Definition II Let P ( X ) be a fixed non-constant perturbation polynomial. Here σ is permutation over { 0 , 1 } d constructed by recurrence. A word a ∈ { 0 , 1 } d is mapped to b ∈ { 0 , 1 } d through a sequence of steps a = a (0) → . . . → a ( i ) → . . . → a ( d ) = σ ( a ) = b defined by P a (0) ( X ) = P a ( X ) � 2 d − 2 j − 1 − 1 � P a ( j ) ( X ) = P a ( j − 1) ( X ) + P ( X ) (mod Q ) for j = 1 , . . . , d 9 / 41

Unicyclic strong permutations–Definition II Let P ( X ) be a fixed non-constant perturbation polynomial. Here σ is permutation over { 0 , 1 } d constructed by recurrence. A word a ∈ { 0 , 1 } d is mapped to b ∈ { 0 , 1 } d through a sequence of steps a = a (0) → . . . → a ( i ) → . . . → a ( d ) = σ ( a ) = b defined by P a (0) ( X ) = P a ( X ) � 2 d − 2 j − 1 − 1 � P a ( j ) ( X ) = P a ( j − 1) ( X ) + P ( X ) (mod Q ) for j = 1 , . . . , d a �→ b = ( b 0 ( a ) , . . . , b d − 1 ( a )) . 9 / 41

An example without a giant cycle a = a ( 0 ) a = a ( 0 ) 0 32 1 33 2 34 3 35 4 36 5 37 6 38 7 39 8 40 9 41 10 42 11 43 12 44 13 45 14 46 15 47 16 48 17 49 18 50 19 51 20 52 21 53 22 54 23 55 24 56 25 57 26 58 27 59 28 60 29 61 30 62 31 63 P ( X ) = X 5 + 1, Q ( X ) = 1 + X + X 4 + X 5 + X 6 10 / 41