On Hidden Sums Compatible with A Given Block Cipher Diffusion Layer

TL;DR

This paper explores the concept of hidden sums in block ciphers, providing a theoretical framework and an algorithm to identify algebraic trapdoors related to the cipher's diffusion layer.

Contribution

It introduces a novel approach combining group theory and cryptography to characterize and efficiently detect hidden sums that could serve as trapdoors in block ciphers.

Findings

Characterization of hidden sums related to regular subgroups of the affine group

Development of an efficient algorithm for trapdoor exploitation

Insights into algebraic structures that threaten cipher security

Abstract

Sometimes it is possible to embed an algebraic trapdoor into a block cipher. Building on previous research, in this paper we investigate an especially dangerous algebraic structure, which is called a hidden sum and which is related to some regular subgroups of the affine group. Mixing group theory arguments and cryptographic tools, we pass from characterizing our hidden sums to designing an efficient algorithm to perform the necessary preprocessing for the exploitation of the trapdoor.

Tables

Table 1. Table 1: Computation timing for a Mac Book Pro 15” early 2011, 4 GB Ram, Intel i7 2.00 Ghz.

Dimension of $V$	$n$, $d$	Timing in second
$64$	$62$, $2$	32.620 seconds
$80$	$78$, $2$	84.380 seconds
$96$	$94$, $2$	188.200 seconds
$112$	$110$, $2$	338.590 seconds
$128$	$126$, $2$	616.670 seconds

Table 2. Table 2: PRESENT mixing layer

$i$	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16
$i{\lambda }_P$	1	17	33	49	2	18	34	50	3	19	35	51	4	20	36	52
$i$	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31	32
$i{\lambda }_P$	5	21	37	53	6	22	38	54	7	23	39	55	8	24	40	56
$i$	33	34	35	36	37	38	39	40	41	42	43	44	45	46	47	48
$i{\lambda }_P$	9	25	41	57	10	26	42	58	11	27	43	59	12	28	44	60
$i$	49	50	51	52	53	54	55	56	57	58	59	60	61	62	63	64
$i{\lambda }_p$	13	29	45	61	14	30	46	62	15	31	47	63	16	32	48	64

Equations

$${\mathbf{e}}_i=(\underset{i-1}{\underbrace{0,\dots ,0}},1,\underset{N-i}{\underbrace{0,\dots ,0}})\in ({\mathbb{F}}_q{)}^N$$

$$V=V_1\oplus \cdots \oplus V_b,$$

$${\Gamma }_h(\mathcal{C})=⟨{\rho }_{k,h}\mid k\in \mathcal{K}⟩\subseteq \text{mbox}\mathrm{Sym}(V),$$

$${\Gamma }_{\infty }(\mathcal{C})=⟨{\Gamma }_h(\mathcal{C})\mid h=1,\dots ,\ell ⟩.$$

$$T=\{{\tau }_{\mathbf{a}}\mid \mathbf{a}\in V\},$$

$$U(T)=\{\mathbf{v}\in V\mid {\sigma }_{\mathbf{v}}\in T\}.$$

$$\kappa_{\bf y}=\left[\begin{array}[]{cc}I_{n}&B_{\bf y}\\ 0&I_{d}\end{array}\right].$$

$$\kappa_{{\bf e}_{i}}=\left[\begin{array}[]{cccc}&b^{(i)}_{1,1}&\dots&b^{(i)}_{1,d}\\ I_{n}&\vdots&&\vdots\\ &b^{(i)}_{n,1}&\dots&b^{(i)}_{n,d}\\ 0&&I_{d}&\end{array}\right],$$

$${\left[\genfrac{}{}{0ex}{}{N}{d}\right]}_2\cdot |\mathcal{V}({\mathcal{I}}_{n,d})|$$

$${\mathcal{S}}_0\cup {\mathcal{S}}_1\cup {\mathcal{S}}_2\cup {\mathcal{S}}_3$$

$${\mathcal{S}}_0$$

$${\mathcal{S}}_1$$

$${\mathcal{S}}_2$$

$${\mathcal{S}}_3$$

$$|\mathcal{V}({\mathcal{I}}_{n,d})|\le 2^{d\frac{n(n-1)}{2}}-1-\sum _{r=1}^{n-2}\left(\genfrac{}{}{0ex}{}{n}{r}\right)\prod _1^{\left(\genfrac{}{}{0ex}{}{n-r}{2}\right)}\left(2^d-1\right)=\mu (n,d).$$

$$\kappa_{\bf v}=\left[\begin{array}[]{cc}I_{n}&\sum_{i=1}^{n}{v_{i}}B_{{\bf e}_{i}}\\ 0&I_{d}\end{array}\right]$$

$$B_{{\mathbf{e}}_1}=\left[\begin{array}{cc}0& 0\\ 1& 1\\ 1& 1\end{array}\right],B_{{\mathbf{e}}_2}=\left[\begin{array}{cc}1& 1\\ 0& 0\\ 0& 1\end{array}\right]B_{{\mathbf{e}}_3}=\left[\begin{array}{cc}1& 1\\ 0& 1\\ 0& 0\end{array}\right],B_{{\mathbf{e}}_4}=\left[\begin{array}{cc}0& 0\\ 0& 0\\ 0& 0\end{array}\right],B_{{\mathbf{e}}_5}=\left[\begin{array}{cc}0& 0\\ 0& 0\\ 0& 0\end{array}\right]$$

$$B_{{\mathbf{e}}_1}=\left[\begin{array}{c}0\\ \alpha +1\\ \alpha +1\end{array}\right],B_{{\mathbf{e}}_2}=\left[\begin{array}{c}\alpha +1\\ 0\\ \alpha \end{array}\right],B_{{\mathbf{e}}_3}=\left[\begin{array}{c}\alpha +1\\ \alpha \\ 0\end{array}\right]$$

$${\mathfrak{B}}_{\circ }=\left[\begin{array}{ccc}{B}_{{\mathbf{e}}_1}& B_{{\mathbf{e}}_2}& B_{{\mathbf{e}}_3}\end{array}\right]=\left[\begin{array}{ccc}0& \alpha +1& \alpha +1\\ \alpha +1& 0& \alpha \\ \alpha +1& \alpha & 0\end{array}\right]$$

$${\mathcal{M}}_{n,d}=\{{\mathfrak{B}}_{\circ }\in ({\mathbb{F}}_{2^d}{)}^{n\times n}\mid {\mathfrak{B}}_{\circ }\text{ satisfies conditions (I), (II), and (III)}\}$$

$$\{\begin{array}{ll}{q}^{\left(\genfrac{}{}{0ex}{}{n}{2}\right)}{\prod }_{j=1}^{\lceil \frac{n-1}{2}\rceil }\left(1-q^{1-2j}\right)& \text{if n is even}\\ 0& \text{if n is odd}\end{array}.$$

$$\nu (n,d)=\{\begin{array}{ll}{q}^{\left(\genfrac{}{}{0ex}{}{n}{2}\right)}{\prod }_{j=1}^{\lceil \frac{n-1}{2}\rceil }\left(1-q^{1-2j}\right)& \text{if n is even}\\ (q^{n-1}-2^{n-1})q^{\left(\genfrac{}{}{0ex}{}{n-1}{2}\right)}{\prod }_{j=1}^{\lceil \frac{n-2}{2}\rceil }\left(1-q^{1-2j}\right)& \text{if n is odd}\end{array}$$

$$\mathfrak{B}_{\circ}=\left[\begin{array}[]{cc}0&{\bf b}\\ {\bf b}^{\intercal}&\mathfrak{B}_{\circ}^{\prime}\end{array}\right].$$

$$|{\mathcal{M}}_{n,d}|=\{\begin{array}{ll}{2}^d-1& \text{if n=2}\\ (2^d+3)(2^d-1)(2^d-2)& \text{if n=3}\\ 2^{\left(\genfrac{}{}{0ex}{}{n}{2}\right)}{\prod }_{j=1}^{\lceil \frac{n-1}{2}\rceil }\left(1-2^{1-2j}\right)& \text{if d=1 and n is even}\\ 0& \text{if d=1 and n is odd}\end{array}$$

$${\mathfrak{B}}_{\circ }=\left[\begin{array}{cc}0& \mathbf{x}\\ \mathbf{x}& 0\end{array}\right]$$

$${\mathfrak{B}}_{\circ }=\left[\begin{array}{ccc}0& \mathbf{y}& \mathbf{z}\\ \mathbf{y}& 0& \mathbf{x}\\ \mathbf{z}& \mathbf{x}& 0\end{array}\right]$$

$$(2^d-1)(2^d-2+2^d-2+2^d(2^d-2))+(2^d-1)(2^d-2)=(2^d-1)(2^d-2)(2^d+3)$$

$$1+\sum _{j=1}^{\infty }{p}_j\le \prod _{j=1}^{\infty }(1+p_j)\le e^{{\sum }_{j=1}^{\infty }{p}_j},$$

$$\frac{\mu (n,d)}{\nu (n,d)}\le \prod _{j=1}^{\infty }\frac{1}{(1-q^{1-2j})}\le e^{\frac{q+1}{q(q-1)}}$$

$$\frac{\mu (n,d)}{\nu (n,d)}\le 2\prod _{j=1}^{\infty }\frac{1}{(1-q^{1-2j})}\le 2e^{\frac{q+1}{q(q-1)}}.$$

$$\mu (n,d)=$$

$$\le$$

Full text

1 Introduction

Sometimes it is possible to embed an algebraic trapdoor into a block cipher. Building on previous research, in this paper we investigate an algebraic structure, which is called a hidden sum and which is related to some regular subgroups of the affine group. To be more precise, in [1], the authors study some elementary abelian regular subgroups of the affine general linear group acting on a space $V=({\mathbb{F}}_{2})^{N}$, in order to construct a trapdoor for a class of block ciphers. These subgroups induce alternative operations $\circ$ on $V$, such that $(V,\circ)$ is a vector space over ${\mathbb{F}}_{2}$. In [1], it is shown that for a class of these operations, which we will call practical hidden sums, it is possible to represent the elements with respect to a fixed basis of $(V,\circ)$ in polynomial time. Moreover, an estimate on the number of these operations is given. Using this class of hidden sums, the authors provide an attack, which works in polynomial time, on ciphers that are vulnerable to this kind of trapdoor.

In this article we continue the analysis started in [1]. In Section 3 we give a lower bound on the number of practical hidden sums, comparing also this value with a previous upper bound. From these bounds it is obvious that it is not feasible to generate all possible practical hidden sums due to the large number of these even in small dimensions, e.g. for $N=6$ we have $\sim 2^{23}$ practical hidden sums. In Section 4 we study the problem of determining the possible maps which are linear with respect to a given practical hidden sums. More precisely, we provide an algorithm that takes as input a given linear map $\lambda$ (with respect to the usual XOR on $V$) and returns some operations $\circ$, which can be defined over $V$, that are different from the XOR and for which the map $\lambda$ is linear, i.e. $\lambda(x\circ y)=\lambda(x)\circ\lambda(y)$ for all $x,\,y$ in $V$. Our aim is to individuate a family of hidden sums that can weaken the components of a given cipher, or to design a cipher containing the trapdoor based on hidden sums. In the last section we apply the procedure given in Section 3 to the mixing layer of the cipher PRESENT [2], yelding a set of hidden sums which linearize this permutation matrix and might in principle be used to attack the cipher.

2 Preliminaries and motivations

We write $\mathbb{F}_{q}$ to denote the finite field of $q$ elements, where $q$ is a prime power , and $(\mathbb{F}_{q})^{s\times t}$ to denote the set of all matrices with entries over $\mathbb{F}_{q}$ with $s$ rows and $t$ columns. The identity matrix of size $s$ is denoted by $I_{s}$. We use

[TABLE]

to denote the unit vector, which has a $1$ in the $i$th position, and zeros elsewhere. Let $m\geq 1$, the vector (sub)space generated by the vectors ${\bf v}_{1},\dots,{\bf v}_{m}$ is denoted by ${\rm{Span}}\{{\bf v}_{1},\dots,{\bf v}_{m}\}$.

Let $V=(\mathbb{F}_{q})^{N}$, we denote respectively by $\mbox{\rm Sym}(V)$, $\mbox{\rm Alt}(V)$ the symmetric and the alternating group acting on $V$. We will denote the translation with respect to a vector ${\bf v}\in V$ by $\sigma_{\bf v}:{\bf x}\mapsto{\bf x}+{\bf v}$, and $T(V,+)$ will denote the translations on the vector space $(V,+)$, that is, $T(V,+)=\{\sigma_{\bf v}\mid{\bf v}\in V\}$. By $\mbox{\rm AGL}(V{,+})$ and $\mbox{\rm GL}(V{,+})$ we denote the affine and linear groups of $V$. We write $\langle g_{1},\dots,g_{m}\rangle$ for the group generated by $g_{1},\dots,g_{m}$ in $\mbox{\rm Sym}(V)$. The map $1_{V}$ will denote the identity map on $V$.

Let $G$ be a finite group acting on $V$. We write the action of a permutation $g\in G$ on a vector ${\bf v}\in V$ as ${\bf v}g$.

We recall that a permutation group $G$ acts regularly (or is regular) on $V$ if for any pair ${\bf x},{\bf y}\in V$ there exists a unique map $g$ in $G$ such that ${\bf x}g={\bf y}$. Moreover, an elementary abelian group (or elementary abelian $p$-group) is an abelian group such that any nontrivial element has order $p$. In particular, the group of translations acting on $V$, $T(V,+)$, is a regular elementary abelian group.

2.1 Block ciphers and hidden sums

Most modern block ciphers are iterated ciphers, i.e. they are obtained by the composition of a finite number $\ell$ of rounds.

Several classes of iterated block ciphers have been proposed, e.g. substitution permutation network [3] and key-alternating block cipher [4]. Here we present one more recent definition [5] that determines a class large enough to include some common ciphers (AES [6], SERPENT [7], PRESENT [2]), but with enough algebraic structure to allow for security proofs, in the contest of symmetric cryptography. In particular, about properties of the groups related to the ciphers.

Let $V=({\mathbb{F}}_{2})^{N}$ with $N=mb$ and $b\geq 2$. The vector space $V$ is a direct sum

[TABLE]

where each $V_{i}$ has the same dimension $m$ (over ${\mathbb{F}}_{2}$). For any ${\bf v}\in V$, we will write ${\bf v}={\bf v}_{1}\oplus\dots\bf v_{b}$, where ${\bf v}_{i}\in V_{i}$.

Any $\gamma\in\mbox{\rm Sym}(V)$ that acts as ${\bf v}\gamma={\bf v}_{1}\gamma_{1}\oplus\dots\oplus{\bf v}_{b}\gamma_{b}$, for some $\gamma_{i}$’s in $\mbox{\rm Sym}(V_{i})$, is a bricklayer transformation (a “parallel map”) and any $\gamma_{i}$ is a brick. Traditionally, the maps $\gamma_{i}$’s are called S-boxes and $\gamma$ a “parallel S-box”. A linear map $\lambda:V\to V$ is traditionally said to be a “Mixing Layer” when used in composition with parallel maps. For any $I\subset{\{1,\dots,b\}}$, with $I\neq\emptyset,{\{1,\dots,b\}}$, we say that $\bigoplus_{i\in I}V_{i}$ is a wall.

Definition 2.1**.**

A linear map $\lambda\in\mbox{\rm GL}(V{,+})$ is a proper mixing layer if no wall is invariant under $\lambda$.

We can characterize the translation-based class by the following:

Definition 2.2**.**

A block cipher $\mathcal{C}=\{\varphi_{k}\mid k\in\mathcal{K}\}\subset\mbox{\rm Sym}(V)$, where $\mathcal{K}$ is the set containing all the session keys and $\varphi_{k}$ are keyed permutations, over ${{\mathbb{F}}_{2}}$ is called translation based (tb) if:

it is the composition of a finite number of $\ell$ rounds, such that any round $\rho_{k,h}$ can be written111we drop the round indices* as $\gamma\lambda\sigma_{\bar{k}}$, where*

$\gamma$* is a round-dependent bricklayer transformation (but it does not depend on $k$),*

• -

$\lambda$* is a round-dependent linear map (but it does not depend on $k$),*

• -

$\bar{k}$* is in $V$ and depends on both $k$ and the round ($\bar{k}$ is called a “round key”),*

• 2.

for at least one round, which we call proper, we have (at the same time) that $\lambda$ is proper and that the map $\mathcal{K}\to V$ given by $k\mapsto\bar{k}$ is surjective.

For a tb cipher it is possible to define the following groups. For each round $h$

[TABLE]

and the round function group is given by

[TABLE]

An interesting problem is determining the properties of the permutation group $\Gamma_{\infty}(\mathcal{C})=\Gamma_{\infty}$ that imply weaknesses of the cipher. A trapdoor (sometimes called backdoor see [8]) is a hidden structure of the cipher, whose knowledge allows an attacker to obtain information on the key or to decrypt certain ciphertexts.

The first paper dealing with properties of $\Gamma_{\infty}$ was published by Paterson [9], who showed that if this group is imprimitive, then it is possible to embed a trapdoor into the cipher. On the other hand, if the group is primitive no such trapdoor can be inserted. Other works, dealing with security properties of ciphers related to groups theory, study also whenever the group generated by the round functions is large [10, 11]. However, as shown in [12], even if a given set of round functions generates a large permutation group, it might be possible to approximate these round function by another set of round functions which generates a small group.

Similarly, the primitivity of $\Gamma_{\infty}$ does not guarantee the absence of other types of trapdoors based on the group structure of $\Gamma_{\infty}$. For example, if the group is contained in $\mbox{\rm AGL}(V)$ (which is a primitive group), the encryption function is affine and once we know the image of a basis of $V$ and the image of the zero vector, then we are able to reconstruct the matrix and the translation that compose the map. This motivated the authors of [1] on studying different abelian operations, which can be individuate on $V$ in order to embed a trapdoor into a block cipher. The authors in [1] called these operations hidden sums.

In the remainder of this section, we summarize the theory presented in [1, Section 2-3-5].

Remark 2.3**.**

If $T\subset\mbox{\rm Sym}(V)$ is an elementary abelian regular group acting on $V$, then there exists a vector space structure $(V,\circ)$ such that $T$ is the related translation group. In fact, since $T$ is regular the elements of the group can be labelled

[TABLE]

*where $\tau_{\bf a}$ is the unique map in $T$ such that $0\mapsto{\bf a}$. Then, the sum between two elements is defined by ${\bf x}\circ{\bf a}:={\bf x}\tau_{\bf a}$. Clearly, $(V,\circ)$ is an abelian additive group and thus a vector space over ${\mathbb{F}}_{2}$.

Conversely, if $(V,\circ)$ is a vector space over ${\mathbb{F}}_{2}$, then its translation group, given by the maps $\tau_{\bf a}:{\bf x}\mapsto{\bf x}\circ{\bf a}$, is an elementary abelian group acting regularly on $V$.*

In the following, with the symbol $+$ we refer to the usual sum over the vector space $V$. We denote by $T_{+}=\mathrm{T}(V,+)$, $\mbox{\rm AGL}(V,+)$ and $\mbox{\rm GL}(V,+)$, respectively, the translation, affine and linear groups w.r.t. $+$. We use $T_{\circ}$, $\mbox{\rm AGL}(V,\circ)$ and $\mbox{\rm GL}(V,\circ)$ to denote, respectively, the translation, affine and linear groups corresponding to a hidden sum $\circ$. That is, $T_{\circ}=\{\tau_{\bf a}\mid{\bf a}\in V\}$ where $\tau_{\bf a}:{\bf x}\mapsto{\bf x}\circ{\bf a}$, $\mbox{\rm GL}(V,\circ)$ is the group of the maps $\lambda$ such that $({\bf x}\circ{\bf y})\lambda={\bf x}\lambda\circ{\bf y}\lambda$ for all ${\bf x},{\bf y}\in V$, and any map in $\mbox{\rm AGL}(V,\circ)$ is the composition of a map $\lambda\in\mbox{\rm GL}(V,\circ)$ and a map $\tau_{\bf a}\in T_{\circ}$.

Since we will focus on a particular class of these operation $\circ$, we define a hidden sum any vector space structure $(V,\circ)$, different from the usual $(V,+)$, such that $T_{+}\subseteq\mbox{\rm AGL}(V,\circ)$. While, a practical hidden sum is a hidden sum such that $T_{\circ}$ is also contained in $\mbox{\rm AGL}(V,+)$.

From [1] we have three interesting problems:

Determine the operations $\circ$ (equivalently the translation groups $T_{\circ}$) such that $T_{+}\subseteq\mbox{\rm AGL}(V,\circ)$. 2. 2.

Determine the operations $\circ$ such that $T_{\circ}\subseteq\mbox{\rm AGL}(V,+)$ (i.e. those which are practical hidden sums). 3. 3.

Given a parallel S-box $\gamma$ and a mixing layer $\lambda$, determine the operations $\circ$ such that $\gamma,\,\lambda\in\mbox{\rm AGL}(V,\circ)$ or $\gamma\lambda\in\mbox{\rm AGL}(V,\circ)$.

Problem 1 is related to identifying the class of hidden sums that could potentially contain $\Gamma_{\infty}(\mathcal{C})$, of a given cipher $\mathcal{C}$, in the group $\mbox{\rm AGL}(V,\circ)$ since $T_{+}\subseteq\Gamma_{\infty}(\mathcal{C})$; or at least to individuating hidden sums for which the XOR with a round key is affine with respect to the operation $\circ$.

Operations with the characteristic given in Problem 2 and that of Problem 1 permit to represent an element ${\bf v}$ in $(V,\circ)$ efficiently, as we will see in Algorithm 2.1.

The last problem permits to understand if a given block cipher could be modified to introduce the algebraic structure of a hidden sum.

The following vector space plays an important role for studying these problems. Let $T$ be any subgroup of the affine group, we can define the vector space

[TABLE]

In [1] the authors proved

Proposition 2.4** (Proposition 3.6 [1]).**

Let $V=({\mathbb{F}}_{2})^{N}$, $\mbox{\rm dim}(V)=N$. Let $T\subseteq\mbox{\rm AGL}(V,+)$ be an elementary abelian regular subgroup. If $T\neq T_{+}$, then $1\leq\mbox{\rm dim}(U(T))\leq N-2$.

A characterization is given in [1] for the maps that generate a translation group $T_{\circ}\subseteq\mbox{\rm AGL}(V,+)$ such that $T_{+}\subseteq\mbox{\rm AGL}(V,\circ)$. We recall that for every ${\bf a}$, $\tau_{\bf a}\in T_{\circ}\subset\mbox{\rm AGL}(V,+)$ can be written as $\kappa_{\bf a}\sigma_{\bf a}$ for a linear map $\kappa_{\bf a}\in\mbox{\rm GL}(V,+)$. We will denote by $\Omega(T_{\circ})=\{\kappa_{\bf a}\mid{\bf a}\in V\}\subset\mbox{\rm GL}(V,+)$. Moreover $\kappa_{\bf a}=1_{V}$ if and only if ${\bf a}\in U(T_{\circ})$.

We recall the following definition.

Definition 2.5**.**

An element $r$ of a ring $R$ is called nilpotent if $r^{m}=0$ for some $m\geq 1$ and it is called unipotent if $r-1$ is nilpotent, i.e. $(r-1)^{m}=0$ for some $m\geq 1$.

Let $G\subseteq\mbox{\rm GL}(V,+)$ be a subgroup consisting of unipotent permutations, then $G$ is called unipotent.

Lemma 2.6** (Lemma 3.11 [1]).**

Let $T_{\circ}\subseteq\mbox{\rm AGL}(V,+)$. We have that $\Omega(T_{\circ})$ is unipotent. Moreover, for all ${\bf y}\in V$ $\kappa_{\bf y}^{2}=1_{V}$.

Theorem 2.7** (Theorem 3.17 [1]).**

Let $N=n+d$ and $V=({\mathbb{F}}_{2})^{N}$, with $n\geq 2$ and $d\geq 1$. Let $T_{\circ}\subseteq\mbox{\rm AGL}(V,+)$ be such that $U(T_{\circ})={\rm{Span}}\{{\bf e}_{n+1},\dots,{\bf e}_{n+d}\}$. Then, $T_{+}\subseteq\mbox{\rm AGL}(V,\circ)$ if and only if for all $\kappa_{\bf y}\in\Omega(T_{\circ})$ there exists a matrix $B_{\bf y}\in({\mathbb{F}}_{2})^{n\times d}$ such that

[TABLE]

Note that we can always suppose that $U(T_{\circ})$ is generated by the last vectors of the canonical basis, as any group $T_{\circ}$ is conjugated to a group $T_{\circ^{\prime}}$ such that $U(T_{\circ^{\prime}})={\rm{Span}}\{{\bf e}_{n+1},\dots,{\bf e}_{n+d}\}$ (see [1, Theorem 3.14]).

Indeed, let $T_{\circ}$ be a translation group of a practical hidden sum, with $U(T_{\circ})={\rm{Span}}\{{\bf v}_{1},\dots,{\bf v}_{d}\}$. We have that ${\bf v}_{1},\dots,{\bf v}_{d}$ are linear independent with respect to the sum $+$, which implies that there exists a linear map $g\in GL(V,+)$ such that ${\bf v}_{i}g={\bf e}_{n+i}$ for $i=1,\dots,d$. Thus, the conjugated group $T_{\circ^{\prime}}=gT_{\circ}g^{-1}$ is such that $U(T_{\circ^{\prime}})={\rm{Span}}\{{\bf e}_{n+1},\dots,{\bf e}_{n+d}\}$ and $\circ^{\prime}$ is again a practical hidden sum.

Practical hidden sums with $U(T_{\circ})={\rm{Span}}\{{\bf e}_{n+1},\dots,{\bf e}_{n+d}\}$ are easier to study thanks to the particular structure reported in Theorem 2.7.

Remark 2.8**.**

When $U(T_{\circ})$ is generated by the last vectors of the canonical basis, then the maps $\tau_{{\bf e}_{i}}$ generate $T_{\circ}$, i.e. the canonical vectors form a basis also for the vector space $(V,\circ)$. Indeed, thanks to the form of the maps $\kappa_{{\bf e}_{i}}$ given in Theorem 2.7, it is possible to verify that combining the maps $\tau_{{\bf e}_{i}}$’s we are able to obtain all the $2^{N}$ different maps contained in $T_{\circ}$ (see [1, Lemma 3.7 and Corollary 3.8] for further details).

In [1] it turns out that for any practical hidden sum $T_{\circ}\subseteq\mbox{\rm AGL}(V,+)$, any given vector ${\bf v}$ can be represented in $(V,\circ)$, with respect to the canonical vectors, in polynomial time ($\mathcal{O}(N^{3})$). Let $T_{\circ}$ be a practical hidden sum with $U(T_{\circ})={\rm{Span}}\{{\bf e}_{n+1},\dots,{\bf e}_{n+d}\}$ ($\mbox{\rm dim}(V)=N={n+d}$), then the algorithm for determining the representation of a given vector ${\bf v}$ is the following

Algorithm 2.1**.**

Input:* vector ${\bf v}=(v_{1},\dots,v_{N})\in V$

Output: coefficients $\alpha_{1},\dots,\alpha_{N}$ such that $\alpha_{1}{\bf e}_{1}\circ...\circ\alpha_{N}{\bf e}_{N}={\bf v}$.

$[i]$ $\alpha_{i}\leftarrow v_{i}$ for $1\leq i\leq n$;

$[ii]$ ${\bf v}^{\prime}\leftarrow{\bf v}\tau_{{\bf e}_{1}}^{\alpha_{1}}\cdots\tau_{{\bf e}_{n}}^{\alpha_{n}}$;

$[iii]$ $\alpha_{i}\leftarrow v_{i}^{\prime}$ for $n+1\leq i\leq n+d$;

return $\alpha_{1},\dots,\alpha_{N}$.*

*Correctness of Algorithm 2.1:

*To find the coefficients $\alpha_{1},\dots,\alpha_{N}$ is equivalent to individuating the maps $\tau_{{\bf e}_{i}}$ which generate the map $\tau_{\bf v}$. So, we need to understand which maps (among the $\tau_{{\bf e}_{i}}$) are needed to send [math] in ${\bf v}$, or equivalently ${\bf v}$ in [math] (since $T_{\circ}$ is an elementary regular subgroups, $\tau_{\bf v}$ is the unique map such that $0\tau_{\bf v}={\bf v}$ and ${\bf v}\tau_{\bf v}=0$).

Note that thanks to the form of the maps $\kappa_{{\bf e}_{i}}$ given in Theorem 2.7, whenever we apply a map $\kappa_{{\bf e}_{i}}$ to a vector ${\bf x}$, the first $n$ entries of ${\bf x}$ are left unchanged. So, if the entry $v_{i}$ is equal to $1$ for $1\leq i\leq n$, to delete it we need to apply $\tau_{{\bf e}_{i}}$. This explains step [ii].

Now, ${\bf v}^{\prime}={\bf v}\tau_{{\bf e}_{1}}^{\alpha_{1}}\cdots\tau_{{\bf e}_{n}}^{\alpha_{n}}$ is such that the first $n$ entries are all zero. So, we need to delete the entry $v^{\prime}_{j}$ for $n+1\leq j\leq N$, whenever $v^{\prime}_{j}=1$. Since $\tau_{{\bf e}_{j}}=\sigma_{{\bf e}_{j}}$ for $n+1\leq j\leq N$, we apply $\tau_{{\bf e}_{j}}$ if $v^{\prime}_{j}=1$.

So, we have obtained a map $\tau\in T_{\circ}$ such that ${\bf v}\tau=0$, and since this is unique we have $\tau=\tau_{\bf v}$.

Note that if $U(T_{\circ})$ is not generated by the last vectors of the canonical basis, then we can consider the conjugated group $T_{\circ^{\prime}}=gT_{\circ}g^{-1}$, with $g$ as above, and we need to apply Algorithm 2.1 to ${\bf v}g$, obtaining its representation in $(V,\circ^{\prime})$. This leads us to obtain the representation of ${\bf v}$ in $(V,\circ)$ with respect to the basis $\{{\bf e}_{1}g^{-1},...,{\bf e}_{N}g^{-1}\}$ of $(V,\circ)$. In particular, the map $g$ is an isomorphism of vector space between $(V,\circ)$ and $(V,\circ^{\prime})$.

From this, the authors proved that a hidden sum trapdoor is practical, whenever $\Gamma_{\infty}\subseteq\mbox{\rm AGL}(V,\circ)$ and $T_{\circ}\subseteq\mbox{\rm AGL}(V,+)$.

A class of these practical hidden sums is used in [13] to weaken the non-linearity of some APN S-boxes. In addition, in [13] a differential attack with respect to hidden sums is presented.

An upper bound on the number of some hidden sums is given in [1] and reported below.

Let $n\geq 2$ and $d\geq 1$. According to Theorem 2.7, denote the matrix $\kappa_{{\bf e}_{i}}$ by

[TABLE]

for each $1\leq i\leq n$.

Theorem 2.9** (Theorem 5.5 [1]).**

Let $N=n+d$ and $V=({\mathbb{F}}_{2})^{N}$, with $n\geq 2$ and $d\geq 1$. The number of elementary abelian regular subgroups $T_{\circ}\subseteq\mbox{\rm AGL}(V,+)$ such that $\mbox{\rm dim}(U(T_{\circ}))=d$ and $T_{+}\subseteq\mbox{\rm AGL}(V,\circ)$ is

[TABLE]

where $\mathcal{V}(\mathcal{I}_{n,d})$ is the variety of the ideal $\mathcal{I}_{n,d}\subset{\mathbb{F}}_{2}\left[b^{(s)}_{i,j}\mid{1\leq i,s\leq n,\,1\leq j\leq d}\right]$ generated by

[TABLE]

with

[TABLE]

and ${N\brack d}_{q}=\prod_{i=0}^{d-1}\frac{q^{N-i}-1}{q^{d-i}-1}$ is the Gaussian Binomial.

Proposition 2.10** (Proposition 5.6 [1]).**

Let $\mathcal{I}_{n,d}$ defined as in Theorem 2.9, then

[TABLE]

3 New lower bounds and asymptotic estimates

In this section we will provide a lower bound on the cardinality of the variety $\mathcal{V}(\mathcal{I}_{n,d})$. Moreover we will show that the ratio between the upper bound and lower bound is less than $e^{\frac{2^{d}+1}{2^{d}(2^{d}-1)}}$.

From Theorem 2.7 and from Remark 2.8, we have that a group $T_{\circ}$ with $U(T_{\circ})={\rm{Span}}\{{\bf e}_{n+1},\dots,{\bf e}_{n+d}\}$ is determined by the maps $\kappa_{{\bf e}_{i}}$’s, and in particular by $B_{{\bf e}_{1}},\dots,B_{{\bf e}_{n}}$ ($B_{{\bf e}_{i}}=0$ for $n+1\leq i\leq n+d$). Thus, we need to construct the matrices $B_{{\bf e}_{1}},\dots,B_{{\bf e}_{n}}$ so that:

• i)

$\mbox{\rm dim}(U(T_{\circ}))=d$. Then for any ${\bf v}\in{\rm{Span}}\{{\bf e}_{1},\dots,{\bf e}_{n}\}$, $B_{\bf v}\neq 0$. Indeed, ${\bf v}\in U(T_{\circ})$ if and only if $B_{\bf v}=0$. Moreover, for any ${\bf v}=(v_{1},\dots,v_{n+d})\in V$ we have

[TABLE]

and so we get that $B_{\bf v}=\sum_{i=1}^{n}v_{i}B_{{\bf e}_{i}}$ (see Lemma 5.4 in [1]).

This implies that every non-null linear combination of $B_{{\bf e}_{1}},\dots,B_{{\bf e}_{n}}$ is non-zero. Note that, in Theorem 2.9, this condition is given by $\mathcal{S}_{1}$.

• ii)

$T_{\circ}$ is abelian. This happens if and only if the $i$th row of $B_{{\bf e}_{j}}$ is equal to the $j$th row of $B_{{\bf e}_{i}}$, obtaining the set $\mathcal{S}_{2}$.

• iii)

$T_{\circ}$ is elementary, that is, $\tau_{\bf v}^{2}=1_{V}$ for all ${\bf v}$. Then $\kappa_{\bf v}$ fixes ${\bf v}$ and, in particular, $\kappa_{{\bf e}_{i}}$ fixes ${\bf e}_{i}$. This is equivalent to having the $i$th row of $B_{{\bf e}_{i}}$ equals to [math], which is expressed by $\mathcal{S}_{3}$.

Consider now any matrix $B_{{\bf e}_{i}}$. Its size is $n\times d$, thus any row of $B_{{\bf e}_{i}}$ can be written as an element of ${\mathbb{F}}_{2^{d}}$. Let us define the matrix $\mathfrak{B}_{\circ}=[B_{{\bf e}_{1}}\dots B_{{\bf e}_{n}}]\in({\mathbb{F}}_{2^{d}})^{n\times n}$. From Condition i), ii) and iii), above, we have the following properties for $\mathfrak{B}_{\circ}$:

• (I)

$\mathfrak{B}_{\circ}$ is full rank over ${\mathbb{F}}_{2}$, when seen as an element of $({\mathbb{F}}_{2})^{n\times nd}$. This guarantees that $\mbox{\rm dim}(U(T_{\circ}))=d$.

• (II)

$\mathfrak{B}_{\circ}$ is symmetric. Since the $i$th row of $B_{{\bf e}_{j}}$ is equal to the $j$th row of $B_{{\bf e}_{i}}$ we have that the entry $(i,j)$ of $\mathfrak{B}_{\circ}$ is equal to the entry $(j,i)$.

• (III)

$\mathfrak{B}_{\circ}$ is zero-diagonal, as the $i$th row of $B_{{\bf e}_{i}}$ is zero for all $i$.

Example 3.1**.**

Let $N=5$ and $d=2$ and consider the operation $\circ$ defined by the following $B_{{\bf e}_{i}}$’s:

[TABLE]

*Since we have $n=N-d=3$, we just need to focus on $B_{{\bf e}_{1}}$, $B_{{\bf e}_{2}}$ and $B_{{\bf e}_{3}}$.

Representing the rows of the matrices as elements of $\mathbb{F}_{2^{2}}=\{0,1,\alpha,\alpha+1\}$, where $\alpha^{2}=\alpha+1$, we can rewrite the matrices as*

[TABLE]

and so we can rewrite $\mathfrak{B}_{\circ}$ as

[TABLE]

In Theorem 2.9 we have a one-to-one correspondence between the matrices $B_{{\bf e}_{i}}$’s and the points of $\mathcal{V}(\mathcal{I}_{n,d})$. Thanks to the $\mathfrak{B}_{\circ}$ construction, we have a one-to-one correspondence between the matrices $\mathfrak{B}_{\circ}\in({\mathbb{F}}_{2^{d}})^{n\times n}$ having the above characteristics (I), (II), (III) and the groups $T_{\circ}$ with $U(T_{\circ})$ generated by ${\bf e}_{n+1},\dots,{\bf e}_{n+d}$. That is, defining

[TABLE]

we have $|\mathcal{M}_{n,d}|=|\mathcal{V}(\mathcal{I}_{n,d})|$. Thus, we aim to estimate $|\mathcal{M}_{n,d}|$.

We recall the following result given in [15].

Proposition 3.2**.**

Let $q$ be a power of $2$. The number of $n\times n$ symmetric invertible matrices over ${\mathbb{F}}_{q}$ with zero diagonal is

[TABLE]

Proposition 3.3**.**

Let $N=n+d$ and $V=(\mathbb{F}_{2})^{N}$, with $n\geq 2$ and $d\geq 1$. Let $q=2^{d}$. Then we can define a lower bound $\nu(n,d)\leq|\mathcal{M}_{n,d}|$ by

[TABLE]

Proof.

We require that $\mathfrak{B}_{\circ}$ is full rank over ${\mathbb{F}}_{2}$, thus if it is invertible this condition is satisfied. Then the value given in Proposition 3.2 is a lower bound on the number of all acceptable matrices $\mathfrak{B}_{\circ}$. However, if $n$ is odd from Proposition 3.2 we would have only [math] as lower bound.

To tackle the $n$-odd case, we want to reduce it to the $n$-even case. We show how it is possible to construct a matrix $\mathfrak{B}_{\circ}$ for fixed values $n$ and $d$ starting from a given $\mathfrak{B}_{\circ}^{\prime}$ defined for values $n^{\prime}=n-1$, where $n-1$ is even, and $d^{\prime}=d$. Indeed, let $\mathfrak{B}_{\circ}^{\prime}\in({\mathbb{F}}_{2^{d}})^{n-1\times n-1}$ be such that it is full rank over ${\mathbb{F}}_{2}$, symmetric and zero-diagonal. We need to construct the first row (the first column is the transpose of this) of $\mathfrak{B}_{\circ}$, setting all the others equal to the rows of $\mathfrak{B}^{\prime}_{\circ}$. That is,

[TABLE]

Then, we need to verify how many possible $\mathfrak{B}_{\circ}$ we can construct starting from $\mathfrak{B}_{\circ}^{\prime}$, or equivalently how many vectors ${\bf b}\in({\mathbb{F}}_{2^{d}})^{n-1}$ we can use, in order to enforce $\mathfrak{B}_{\circ}\in\mathcal{M}_{n,d}$.

As $\mathfrak{B}_{\circ}^{\prime}$ is full rank over ${\mathbb{F}}_{2}$, summing the rows of this matrix we can create $2^{n-1}-1$ non-zero vectors. Thus, we can choose $2^{d(n-1)}-2^{n-1}$ different vectors ${\bf b}$ of $({\mathbb{F}}_{2^{d}})^{n-1}$ to construct $\mathfrak{B}_{\circ}$. Hence, for any $n$ we have $(2^{d(n-1)}-2^{n-1})|\mathcal{M}_{n-1,d}|\leq|\mathcal{M}_{n,d}|$ and, in particular, for $n$ odd we have at least $(2^{d(n-1)}-2^{n-1})\nu(n-1,d)$ possible matrices $\mathfrak{B}_{\circ}$. ∎

Proposition 3.4**.**

Let $N=n+d$ and $V=(\mathbb{F}_{2})^{N}$. Then

[TABLE]

Proof.

The cases $n=2$ and $n=3$ were already proved in [1]. We restate here the proof using symmetric matrices, obtaining a shorter and clearer proof.

If $n=2$ then

[TABLE]

with ${\bf x}\in\mathbb{F}_{2^{d}}$. Of course the only vector that we have to avoid is the zero vector. Thus we can use $2^{d}-1$ vectors ${\bf x}$ to construct $\mathfrak{B}_{\circ}$.

If $n=3$ then

[TABLE]

with ${\bf x},{\bf y},{\bf z}\in\mathbb{F}_{2^{d}}$ such that $\mathfrak{B}_{\circ}\in\mathcal{M}_{n,d}$.

We need to find all the triples $({\bf x},{\bf y},{\bf z})$ such that the matrix $\mathfrak{B}_{\circ}$ is full rank over ${\mathbb{F}}_{2}$, that is, summing any rows of it we do not obtain the zero vector. Let us consider the different cases:

${\bf x}\neq 0$ : $2^{d}-1$ possible values for ${\bf x}$,

• (a)

${\bf y}=0$ : so ${\bf z}\notin\{0,{\bf x}\}$ and so we get $2^{d}-2$ possible values

• (b)

${\bf y}={\bf x}$ : so ${\bf z}\notin\{0,{\bf x}\}$ and so we get $2^{d}-2$ possible values

• (c)

${\bf y}\neq{\bf x}$ : so ${\bf z}$ can be any element, ${\bf y}\notin\{0,{\bf x}\}$. So $2^{d}(2^{d}-2)$ possible pairs $({\bf y},{\bf z})$.

• 2.

${\bf x}=0$ : we have ${\bf y}\neq 0$ and $z\notin\{0,y\}$ and so we get $(2^{d}-1)(2^{d}-2)$ possible pairs $({\bf y},{\bf z})$.

Summing all the possible triple $({\bf x},{\bf y},{\bf z})$, we get

[TABLE]

Now, let $n\geq 2$ and fix $d=1$. As we consider $\mathbb{F}_{2^{d}}=\mathbb{F}_{2}$, we have that $\mathcal{M}_{n,d}$ is the set of symmetric matrices having all zeros on the diagonal and invertible. From Proposition 3.2 we have our claim. ∎

Let us compare the upper bound and the lower bound on the cardinality of $\mathcal{M}_{n,d}$. We recall a theorem on the infinite product convergence criteria, corollary of the monotone convergence theorem (more details can be found in [16]).

Lemma 3.5**.**

*Let $\{a_{j}\}_{j\in\mathbb{N}}\subseteq\mathbb{R}_{+}$. Then $\displaystyle\prod_{j=1}^{\infty}a_{j}$ converges if and only if $\displaystyle\sum_{j=1}^{\infty}\ln(a_{j})$ converges.

Moreover, assume $a_{j}\geq 1$, and denote $a_{j}=1+p_{j}$. Then*

[TABLE]

that is, the infinite product converges if and only if the infinite sum of the $p_{j}$ converges.

Proposition 3.6**.**

Let $\mu(n,d)$ be the bound given in Proposition 2.10 and let $\nu(n,d)$ be the bound given in Proposition 3.3. Let $q=2^{d}$ and $d\geq 2$. If $n$ is even, then

[TABLE]

if $n$ is odd, then

[TABLE]

Proof.

We have

[TABLE]

Consider the case $n$ even

[TABLE]

since we can write

[TABLE]

Defining

[TABLE]

we trivially have that $p_{n}\geq 0$ and

[TABLE]

We have for any $j\geq 2$

[TABLE]

From this, we get

[TABLE]

and so

[TABLE]

Now let $n$ be odd,

[TABLE]

Since $\binom{j}{i}=\binom{j-1}{i-1}+\binom{j-1}{i}$, $n\geq 2$ and $d\geq 2$ we have

[TABLE]

∎

Note that in Proposition 3.6, the comparison for the case $d=1$ is avoided as the lower bound is the exact value of $|\mathcal{M}_{n,d}|$.

Corollary 3.7**.**

For all possible values of $n\geq 2$ and $d\geq 2$ we have

[TABLE]

and

[TABLE]

Proof.

Consider the case $n$ odd, then

[TABLE]

Consider

[TABLE]

This implies that the limit of (3), as $n$ approaches infinity, is [math] and then the limit

[TABLE]

The case $n$ even is similar.

Moreover, from the proof of Proposition 3.6 we have

[TABLE]

and immediately we have that

[TABLE]

∎

Remark 3.8**.**

From the results obtained in this section we can see that if we would tackle Problem 3. given in Section 2, then it is not possible to search among all the possible practical hidden sums of a given space $V$. Indeed, it will be computationally hard, given the huge amount of these operations, also in small dimensions.

4 On hidden sums for linear maps

In this section we investigate Problem 3 given in Section 2 page 3. In particular we want to see if, for a given $\lambda\in\mbox{\rm GL}(V,+)$, it is possible to individuate an alternative sum $\circ$ such that $\lambda\in\mbox{\rm GL}(V,\circ)$.

Proposition 4.1**.**

Let $T_{\circ}\subseteq\mbox{\rm AGL}(V,+)$ and $\lambda\in\mbox{\rm GL}(V,+)\cap\mbox{\rm GL}(V,\circ)$ then $U(T_{\circ})$ is invariant under the action of $\lambda$, i.e. $U(T_{\circ})\lambda=U(T_{\circ})$.

Proof.

Recall that $\lambda$ is linear with respect to both $+$ and $\circ$. Let ${\bf y}\in U(T_{\circ})$, and so $\mathbf{x}\circ{\bf y}={\bf x}+{\bf y}$ for any ${\bf x}$. Thus, for all ${\bf x}$ we have

[TABLE]

That implies ${\bf y}\lambda\in U(T_{\circ})$, and so $U(T_{\circ})\lambda\subseteq U(T_{\circ})$. ∎

Proposition 4.2**.**

Let $T_{\circ}\subseteq\mbox{\rm AGL}(V,+)$ and $\lambda\in\mbox{\rm GL}(V,+)$. Then $\lambda$ is in $\mbox{\rm GL}(V,+)\cap\mbox{\rm GL}(V,\circ)$ if and only if for all ${\bf x}\in V$ we have

[TABLE]

where $\tau_{\bf x}=\kappa_{\bf x}\sigma_{\bf x}$.

Proof.

Let ${\bf y}$ be fixed. Then for all ${\bf x}$ we have

[TABLE]

where

[TABLE]

and

[TABLE]

Imposing the equality we get

[TABLE]

Vice versa let ${\bf x},{\bf y}\in V$

[TABLE]

∎

Now we will characterize the linear maps which are also linear for an operation $\circ$, such that $U(T_{\circ})$ is generated by the last elements of the canonical basis.

Proposition 4.3**.**

Let $V=({\mathbb{F}}_{2})^{N}$, with $N=n+d$, $n\geq 2$ and $d\geq 1$. Let $T_{\circ}\subseteq\mbox{\rm AGL}(V,+)$ with $U(T_{\circ})={\rm{Span}}\{{\bf e}_{n+1},...,{\bf e}_{n+d}\}$. Let $\lambda\in\mbox{\rm GL}(V,+)$. Then $\lambda\in\mbox{\rm GL}(V,+)\cap\mbox{\rm GL}(V,\circ)$ if and only if

[TABLE]

with $\Lambda_{1}\in\mbox{\rm GL}(({\mathbb{F}}_{2})^{n})$, $\Lambda_{3}\in\mbox{\rm GL}(({\mathbb{F}}_{2})^{d})$, $\Lambda_{2}$ any matrix in $({\mathbb{F}}_{2})^{n\times d}$ and for all ${\bf x}\in V$ $B_{\bf x}\Lambda_{3}=\Lambda_{1}B_{{\bf x}\lambda}$ (see Theorem 2.7 for the notation of $B_{\bf x}$).

Proof.

Let

[TABLE]

$\Lambda_{1}\in({\mathbb{F}}_{2})^{n\times n}$, $\Lambda_{3}\in({\mathbb{F}}_{2})^{d\times d}$, $\Lambda_{2}\in({\mathbb{F}}_{2})^{n\times d}$ and $\Lambda_{4}\in({\mathbb{F}}_{2})^{d\times n}$

From Proposition 4.1 we have that $\Lambda_{4}=0$ as $U(T_{\circ})$ is $\lambda$-invariant. Thus, as $\lambda$ is invertible $\Lambda_{1}\in\mbox{\rm GL}(({\mathbb{F}}_{2})^{n})$ and $\Lambda_{3}\in\mbox{\rm GL}(({\mathbb{F}}_{2})^{d})$.

By standard matrix multiplication it can be verified that (4) and $B_{\bf x}\Lambda_{3}=\Lambda_{1}B_{{\bf x}\lambda}$ are equivalent. Then, we need to show that this condition does not depend on the matrix $\Lambda_{2}$. Indeed, let ${\bf x}=(x_{1},...,x_{n},x_{n+1},...,x_{n+d})\in V$, and define $\bar{\bf x}=(x_{1},...,x_{n})$ and ${\bf x}^{\prime}=(x_{n+1},...,x_{n+d})$, i.e. ${\bf x}=(\bar{\bf x},{\bf x}^{\prime})$. As reported in Section 3 page i), we have $\kappa_{\bf x}=\kappa_{(\bar{\bf x},0)}$, which implies $B_{\bf x}=B_{(\bar{\bf x},0)}$, for all ${\bf x}\in V$. Then, $B_{\bf x}\Lambda_{3}=\Lambda_{1}B_{{\bf x}\lambda}$ for all ${\bf x}\in V$ if and only if $B_{(\bar{\bf x},0)}\Lambda_{3}=\Lambda_{1}B_{(\bar{\bf x}\Lambda_{1},0)}$ for all $\bar{\bf x}=(x_{1},...,x_{n})$. So we have

[TABLE]

for any $\Lambda_{2}$. ∎

In the following, as $\Lambda_{2}$ in Proposition 4.3 could be any matrix, we will consider linear maps of type

[TABLE]

with $\Lambda_{1}\in\mbox{\rm GL}(({\mathbb{F}}_{2})^{n})$, $\Lambda_{3}\in\mbox{\rm GL}(({\mathbb{F}}_{2})^{d})$ and $*$ denotes for any matrix of size $n\times d$.

Remark 4.4**.**

From the propositions above, if we want to find an operation $\circ$ that linearizes a linear map $\lambda\in\mbox{\rm GL}(V,+)$, i.e. we want to enforce

[TABLE]

then we have to construct some matrices $B_{\bf x}$’s such that $B_{\bf x}\Lambda_{3}=\Lambda_{1}B_{{\bf x}\lambda}$ for all ${\bf x}$. Moreover, as the standard vectors ${\bf e}_{i}$’s form a basis for the operation $\circ$, then we need to individuate only the matrices $B_{{\bf e}_{i}}$, so that $B_{{\bf e}_{i}}\Lambda_{3}=\Lambda_{1}B_{{\bf e}_{i}\lambda}$, and in particular that

[TABLE]

where $c_{1},\dots,c_{n}$ are the first components of the vector ${\bf e}_{i}\lambda$.

Algorithm 4.1**.**

INPUT:

[TABLE]

*with $\Lambda_{1}\in\mbox{\rm GL}(({\mathbb{F}}_{2})^{n})$, $\Lambda_{3}\in\mbox{\rm GL}(({\mathbb{F}}_{2})^{d})$

OUTPUT: all practical hidden sums (with $\kappa_{{\bf e}_{i}}$ as in (1)) such that:*

$T_{\circ}\subseteq\mbox{\rm AGL}(V,+)$, $T_{+}\subseteq\mbox{\rm AGL}(V,\circ)$,

• 2.

$U(T_{\circ})$* contains ${\bf e}_{n+1},...,{\bf e}_{n+d}$,*

• 3.

$\lambda\in\mbox{\rm GL}(V,\circ)$.

*ALGORITHM STEPS:

• I)

Consider the canonical basis ${\bf e}_{1},...,{\bf e}_{n+d}$ and compute ${\bf e}_{1}\lambda,...,{\bf e}_{n}\lambda$

• II)

Solve the linear system given by the equations:

1. (a)

for all $i=1,...,n$

[TABLE]

(where $c_{1},...,c_{n}$ are the first components of the vector ${\bf e}_{i}\lambda$). 2. (b)

for all $i=n+1,...,n+d$

[TABLE] 3. (c)

for all $i=1,...,n$

[TABLE]

(here $\bar{\bf e}_{i}$ is the truncation of ${\bf e}_{i}$ with respect to the first $n$ coordinates) 4. (d)

for all $i,j=1,...,n$

[TABLE]

• III)

return the solutions $\{B_{{\bf e}_{i}}\}_{i=1,...,n+d}$.

*Correctness of Algorithm 4.1:

*Note that thanks to the form of the maps $\kappa_{{\bf e}_{i}}$ given in Theorem 2.7, we always have $\kappa_{{\bf e}_{i}}^{2}=1_{V}$, whatever the matrix $B_{{\bf e}_{i}}$ is. This property, with condition $3$ in the algorithm, implies $\tau_{{\bf e}_{i}}^{2}=1_{V}$, so $T_{\circ}=\langle\tau_{{\bf e}_{1}},...,\tau_{{\bf e}_{n+d}}\rangle$ is elementary.

Condition $4$ guarantees that $T_{\circ}$ is abelian. Then, $T_{\circ}$ is also regular (see Corollary 3.8 in [1] for more details). This implies that $T_{\circ}=\langle\tau_{{\bf e}_{1}},...,\tau_{{\bf e}_{n+d}}\rangle$ is a practical hidden sum.

The first condition, as seen in Proposition 4.3, is equivalent to having $\kappa_{{\bf e}_{i}}\lambda=\lambda\kappa_{{{\bf e}_{i}}\lambda}$ for all ${\bf e}_{i}$, and for Remark 4.4, we have also $\kappa_{{\bf x}}\lambda=\lambda\kappa_{{{\bf x}}\lambda}$ for any ${\bf x}$. Then, from Proposition 4.2 we have $\lambda\in\mbox{\rm GL}(V,\circ)$. To conclude, condition $2$ implies that $U(T_{\circ})$ contains ${\bf e}_{n+1},...,{\bf e}_{n+d}$.

Viceversa, consider $T_{\circ}$ a practical hidden sums (with $\kappa_{{\bf e}_{i}}$ as in (1)) such that:

$T_{\circ}\subseteq\mbox{\rm AGL}(V,+)$, $T_{+}\subseteq\mbox{\rm AGL}(V,\circ)$,

• 2.

$U(T_{\circ})$ contains ${\bf e}_{n+1},...,{\bf e}_{n+d}$,

• 3.

$\lambda\in\mbox{\rm GL}(V,\circ)$.

We need to check that $T_{\circ}$ is an output of the algorithm. Equivalently, we need to check that the matrices $B_{{\bf e}_{i}}$ associated to this group satisfies the condition of the system in Algorithm 4.1.

Since $T_{\circ}$ is elementary and abelian, conditions $3$ and $4$ are satisfied. Also, condition $2$ holds because $U(T_{\circ})$ contains ${\bf e}_{n+1},...,{\bf e}_{n+d}$. For the first condition, since $\lambda\in\mbox{\rm GL}(V,\circ)$ we have $\kappa_{{\bf x}}\lambda=\lambda\kappa_{{{\bf x}}\lambda}$ for any ${\bf x}$, which is equivalent to $B_{\bf x}\Lambda_{3}=\Lambda_{1}B_{{\bf x}\lambda}$ for all ${\bf x}$, and in particular for all ${\bf e}_{i}$.

Note that, from Algorithm 4.1 we obtain operations $\circ$ such that

$\{{\bf e}_{n+1},\dots\bf e_{n+d}\}\subseteq U(T_{\circ})$. Indeed, we required that for $n+1\leq i\leq n+d$, $B_{{\bf e}_{i}}=0$, but we did not require that the combinations of $B_{{\bf e}_{1}},...,B_{{\bf e}_{n}}$ are non-zero. So, if we want to construct hidden sums with $\mbox{\rm dim}(U(T_{\circ}))=d$, we just process the solution of Algorithm 4.1 and discharge the $\mathfrak{B}_{\circ}$’s such that $\mathrm{rank}_{{\mathbb{F}}_{2}}(\mathfrak{B}_{\circ})<n$.

4.1 Complexity of our search algorithm

To solve the linear system in our algorithm, we represent the matrices as vectors:

[TABLE]

From $i=1,...,n$, $\sum_{j}c_{j}\Lambda_{1}B_{{\bf e}_{j}}=B_{{\bf e}_{i}}\Lambda_{3}$ we have $n^{2}d$ linear equation in $n^{2}d$ variables.

• 2.

From $\bar{\bf e}_{i}B_{{\bf e}_{i}}=0$ and $\bar{\bf e}_{i}B_{{\bf e}_{j}}=\bar{\bf e}_{j}B_{{\bf e}_{i}}$ we obtain $\binom{n+1}{2}d$ linear equations, in the same variables.

So, we only need to find a solution of a binary linear system of size

[TABLE]

Therefore, we have immediately the following result

Proposition 4.5**.**

The time complexity of Algorithm 4.1 is $\mathcal{O}\left(n^{6}d^{3}\right)$ and the space complexity is $\mathcal{O}\left(l\cdot 2^{d-1}n^{2}\right)$ where $l$ is the dimension of the solution subspace.

In Table 1 we report some timings for different dimensions of the message space $V$, fixing the value of $d$ equal to $2$.

5 Hidden sums for PRESENT’s mixing layer

Here we report our results on the search for a hidden sum suitable for the mixing layer of PRESENT, $\lambda_{P}$, which is defined by the permutation reported in Table 2.

Algorithm 4.1 requires in input a linear function in the block form:

[TABLE]

with $\Lambda_{1}\in\mbox{\rm GL}(({\mathbb{F}}_{2})^{n})$ and $\Lambda_{3}\in\mbox{\rm GL}(({\mathbb{F}}_{2})^{d})$ for some integers $n$ and $d$.

Note that a matrix as in (5) is such that the space $U^{\prime}={\rm{Span}}\{{\bf e}_{n+1},\dots,{\bf e}_{n+d}\}$ is $\lambda^{\prime}$-invariant. So, in order to transform a mixing layer $\lambda$ into one as in (5), it is necessary to individuate a subspace $U$ such that $U\lambda=U$. Then, by conjugating $\lambda$ by a linear map $\pi$ such that $U\pi={\rm{Span}}\{{\bf e}_{n+1},\dots,{\bf e}_{n+d}\}$, we will have $\pi\lambda\pi^{-1}$ as in (5). From a group $T_{\circ}$ obtained from Algorithm 4.1 for the map $\pi\lambda\pi^{-1}$ we will obtain a hidden sum for $\lambda$, that is, $\pi^{-1}T_{\circ}\pi$.

For this reason we consider the matrix given by the permutation

[TABLE]

so that

[TABLE]

We can now apply Algorithm 4.1 and obtain all the possible operations that linearize $\hat{\lambda}_{P}$. The operation space will be denoted by $O$.

The time required to compute the operation space $O$ is $\sim 10.420$ seconds and it is generated by $2360$ $60$-tuples of $60\times 4$ matrices. So the number of operations that linearize $\hat{\lambda}_{P}$, in the form described in Theorem 2.7, is $|O|=2^{2360}$.

We take a random operation $\circ$ (Table 3) obtained by our algorithm. The operation has $\mathrm{rank}_{{\mathbb{F}}_{2}}(\mathfrak{B}_{\circ})=60=n$ and so the operation is such that $\mbox{\rm dim}(U(T_{\circ}))=4=d$. To compress the table, we represent every row of $B_{e_{i}}$ as a number in $\{0,...,(2^{4}-1)\}$, and, as we did in Remark 4.1, row $i$ represents the matrix $B_{{\bf e}_{i}}$.

6 Conclusions

Continuing the study of [1], here we focused on the class of hidden sums such that $T_{\circ}\subseteq\mbox{\rm AGL}(V,+)$ and $T_{+}\subseteq\mbox{\rm AGL}(V,\circ)$, which we called practical hidden sums, as these could be used to exploit new attacks on block ciphers.

We gave a lower bound on the number of the practical hidden sums. Then we compared this lower bound with the upper bound given in [1].

In the second part, we dealt with the problem of individuating possible practical hidden sums for a given linear map, providing Algorithm 4.1 and showing an example on the case of the PRESENT’s mixing layer.

A dual approach is under investigation in [14] (some of the results are reported in [13]), where the author takes into consideration some S-boxes, which would be strong according to classical cryptanalysis, and identify some practical hidden sums that weaken significantly the non-linearity properties of the S-Boxes. Once the candidate hidden sums have been found, some (linear) mixing layers are constructed such that they are linear with respect to a hidden sum and the resulting cipher turns out to be attackable by the clever attacker.

Acknowledgements

The authors would like to thank the anonymous referees for their stimulating suggestions, and several people for interesting discussions: R. Civino and R. Aragona.

Part of the results in this paper are from the first’s author Master thesis, supervised by the last author. They have been presented partially at WCC 2017.

This research was partially funded by the Italian Ministry of Education, Universities and Research, with the project PRIN 2015TW9LSR “Group theory and applications”.