New non-linearity parameters of Boolean functions

TL;DR

This paper introduces multidimensional non-linearity parameters for Boolean functions, extending classical measures and exploring their implications for cryptanalysis and optimal function design.

Contribution

It defines new multidimensional non-linearity parameters for Boolean functions and investigates their properties and relevance to cryptographic attacks and optimality.

Findings

Classical non-linearity is a special case of the new parameters.

Optimal vectorial Boolean functions correspond to perfect nonlinear functions for certain parameters.

Computer search suggests the property extends to some higher dimensions, posing open problems.

Abstract

The study of non-linearity (linearity) of Boolean function was initiated by Rothaus in 1976. The classical non-linearity of a Boolean function is the minimum Hamming distance of its truth table to that of affine functions. In this note we introduce new "multidimensional" non-linearity parameters $(N_f,H_f)$ for conventional and vectorial Boolean functions $f$ with $m$ coordinates in $n$ variables. The classical non-linearity may be treated as a 1-dimensional parameter in the new definition. $r$-dimensional parameters for $r\geq 2$ are relevant to possible multidimensional extensions of the Fast Correlation Attack in stream ciphers and Linear Cryptanalysis in block ciphers. Besides we introduce a notion of optimal vectorial Boolean functions relevant to the new parameters. For $r=1$ and even $n\geq 2m$ optimal Boolean functions are exactly perfect nonlinear functions (generalizations of Rothaus' bent functions) defined by Nyberg in 1991. By a computer search we find that this property holds for $r=2, m=1, n=4$ too. That is an open problem for larger $n,m$ and $r\geq 2$. The definitions may be easily extended to $q$-ary functions.

Tables

Table 1. Table 1: r 𝑟 r -dimensional non-linearity parameters of f 𝑓 f

$r$	$u$	$c$	$U_q$	$q$	$N_f$	$H_f$	$T_q$
$1$	31	2	$x_4+x_5$	$\frac{3}{8},\frac{5}{8}$	0	$0.95441$	$16$
$2$	155	5	$x_3+x_5$	$\frac{5}{16},\frac{5}{16},\frac{5}{16},\frac{1}{16}$	0	$1.82320$	$8$
			$x_4+x_5$
$3$	155	7	$x_2$		1	$2.65563$	$12$
			$x_3+x_5$	$\frac{1}{16},\frac{1}{16},\frac{3}{16},\frac{3}{16},0,\frac{1}{4},\frac{1}{8},\frac{1}{8}$
			$x_4+x_5$
$4$	31	3	$x_1$		6	$3.2500$	$1$
			$x_2$	$\frac{1}{16},\frac{1}{16},\frac{1}{16},\frac{1}{16},0,\frac{1}{8},\frac{1}{8},0$
			$x_3+x_5$
			$x_4+x_5$	$0,0,\frac{1}{8},\frac{1}{8},0,\frac{1}{8},0,\frac{1}{8}$

Table 2. Table 2: r 𝑟 r -dimensional non-linearity parameters of the vectorial f 𝑓 f

$r$	$u$	$c$	$U_q$	$q$	$N_f$	$H_f$	$T_q$
$1$	255	3	$x_1+x_2+x_3+y_1$	$\frac{3}{4},\frac{1}{4}$	0	$0.8112$	$30$
$2$	10795	12	$x_1+x_3+x_4+y_4,$	$\frac{1}{2},\frac{1}{4},0,\frac{1}{4}$	1	$1.5$	$135$
			$x_2$
$3$	97155	35	$x_1+y_1,$		3	$2$	$15$
			$x_2+y_1+y_2,$	$\frac{1}{2},0,0,0,\frac{1}{8},\frac{1}{8},\frac{1}{8},\frac{1}{8}$
			$x_3+y_1+y_3$
$4$	200787	49	$x_1+y_2+y_3,$		10	$2.4056$	$3$
			$x_2+y_1+y_2+y_4,$	$\frac{3}{8},0,\frac{1}{8},\frac{1}{8},0,0,0,\frac{1}{8}$
			$x_3+y_3+y_4,$
			$x_4+y_2$	$0,0,0,\frac{1}{8},0,\frac{1}{8},0,0$
$5$	97155	21	$x_1+y_2+y_3,$	$\frac{1}{4},0,0,0,\frac{1}{16},0,\frac{1}{16},0$	23	$3$	$30$
			$x_2+y_2+y_4,$	$0,\frac{1}{8},0,0,0,\frac{1}{16},\frac{1}{8},\frac{1}{16}$
			$x_3+y_3+y_4,$	$0,0,0,\frac{1}{8},0,0,0,0$
			$x_4+y_2$	$0,0,0,0,0,0,0,\frac{1}{8}$
			$y_1$
$6$	10795	9	$x_1+y_3,x_2,x_3,$	$\frac{3}{16},0,0,\frac{1}{16},0,\dots ,0$	52	$3.4528$	$90$
			$x_4+y_3+y_4,y_1,y_2$
$7$	255	3	$x_1,x_2,x_3,$	$\frac{1}{8},0,0,,\dots ,\frac{1}{16},0,0,0$	114	$3.75$	$15$
			$x_4+y_4,y_1,y_2,y_3$

Equations

$$\mathbf{Pr}(Ux=f(x))$$

$$q_0-q_1$$

$$d_f=\underset{a}{\min }(v_a,2^n-v_a)=2^{n-1}(1-\underset{a}{\max }|W_a|).$$

$$f(x_1,x_2,x_3,x_4,x_5)=x_1{x}_2{x}_3+x_1{x}_2{x}_4+x_1{x}_2{x}_5+x_1{x}_4+x_2{x}_5+x_3+x_4+x_5$$

$$q_0-q_1=\sum _{x,y}{p}_{x,y}(-1{)}^{ax+by}.$$

$$q_0-q_1=\sum _{x,y}{p}_{x,y}(-1{)}^{ax+y}=\frac{1}{2^n}\sum _x(-1{)}^{ax+f(x)}=W_a.$$

$$(x_1{\alpha }^3+x_2{\alpha }^2+x_3\alpha +x_4{)}^{-1}=(y_1{\alpha }^3+y_2{\alpha }^2+y_3\alpha +y_4)mod{\alpha }^4+\alpha +1$$

Full text

1 Conventional Boolean Functions

Let $f(x)=f(x_{1},\ldots,x_{n})$ be a Boolean function (takes $0,1$-values) in $n$ Boolean variables $x=(x_{1},\ldots,x_{n})$. Let $v$ denote its weight (the number of values $1$ in the truth table). One constructs a probability distribution $p$ on binary $n$-strings, such that $p_{x}=1/v$ if $f(x)=1$ and $p_{x}=0$ otherwise.

Let $r$ be a fixed number $1\leq r\leq n$ and $U$ an $r\times n$ binary matrix of rank $r$. The matrix defines a linear transform from the space of $n$-bit strings to the space of $r$-bit strings. That induces a probability distribution $q$ on binary $r$-strings. Namely, $q_{y}=\sum_{y=Ux}p_{x}$, where the sum is over $x$ such that $y=Ux$. The distribution $q$ depends on $U$. For $r=n$ the distribution $q$ is a permuted distribution $p$ with a linear permutation defined by $U$.

For $r=1$ the distributions (in a slightly different form) are used in Correlation and Fast Correlation Attacks in stream ciphers, see [1]. The efficiency of Correlation Attacks, e.g., for a Filter Generator with a filtering function $f$, depends on the probability $\mathbf{Pr}(Ux=f(x)).$ By the definition of $q=(q_{0},q_{1})$, one gets $\mathbf{Pr}(Ux=1,f(x)=1)=vq_{1}/2^{n}$ and $\mathbf{Pr}(Ux=0,f(x)=0)=1/2-vq_{0}/2^{n}$. So

[TABLE]

For $r\geq 2$ the distribution $q$ may potentially be used in multidimensional extensions of Correlation Attacks.

In cryptanalysis one may want to distinguish non-uniform distributions from uniform. The number of zero values of $q_{y}$ denoted $N_{q}$ and the entropy of $q$ on its support denoted $H_{q}$ are relevant parameters. For a fixed $r$ the distributions $q$ may be partitioned into classes by equivalence, where $q_{1}$ and $q_{2}$ are equivalent if $N_{q_{1}}=N_{q_{2}}$ and $H_{q_{1}}=H_{q_{2}}$. Obviously, the number of zero values provides with a stronger distinguisher than the entropy. So we define an order on classes $\{q\}$ induced by the relation $\{q_{1}\}>\{q_{2}\}$ which holds if $N_{q_{1}}>N_{q_{2}}$ or if $N_{q_{1}}=N_{q_{2}}$ and $H_{q_{1}}<H_{q_{2}}$. The parameters $(N_{q},H_{q})$ of the largest (according to $>$) class we call $r$-dimensional non-linearity of $f$. They are denoted $(N_{f},H_{f})$. Let, for instance, $r=n$ then $(N_{f},H_{f})=(2^{n}-v,\ln(v))$. It is easy to see that $r$-dimensional non-linearity of $f$ is invariant under affine change of variables in $f$.

Let $r=1$, then $Ux$ is a non-zero linear function and

[TABLE]

The numbers $W_{a}=\frac{1}{2^{n}}\sum_{x}(-1)^{f(x)+ax}$, where $a$ are encoded by binary $n$-strings, may be called Walsh-Hadamard spectrum of $f$. Also $(-1)^{f(x)}=\sum_{a}W_{a}\,(-1)^{ax}$.

It is well known and easy to prove that $W_{a}=\frac{v_{a}-2^{n-1}}{2^{n-1}}$, where $v_{a}$ is the number of $x$ such that $f(x)=ax$. Minimum distance of $f$ to affine functions (classical non-linearity of $f$) is defined by

[TABLE]

To construct $U$, where the distribution $q_{0},q_{1}$ has the smallest entropy (largest bias $|q_{0}-q_{1}|$), one computes Walsh-Hadamard spectrum of $f$ and chooses $U$ such that $W_{U}$ is the largest in absolute value. The computation takes $n2^{n}$ integer additions and subtractions. So the largest Walsh-Hadamard spectrum value $|W_{a}|,a\neq 0$ is a $1$-dimensional parameter of the Boolean function $f$. For balanced Boolean functions $W_{0}=0$. So $1$-dimensional non-linearity parameter for a balanced Boolean function is also defined by the classical non-linearity of $f$.

In order to find $r$-dimensional parameters for $r\geq 2$ one can brute force all matrices $U$ (up to an equivalence by row operations), calculate the distribution $q$, its entropy and the number of its zero values. The number of inequivalent matrices grows fast with $r$, so the calculation is infeasible even for moderate $n$.

We consider an example. For the Boolean function

[TABLE]

$r$-dimensional parameters are shown in Table 1 for $r=1,2,3,4$, where $u$ is the number of $r\times n$-matrices $U$ up to a row equivalence, $c$ is the number of classes of equivalent distributions. Also the table contains a representative $q$ of the largest (according to the order above) class of the distributions, a matrix $U_{q}$ and the number $T_{q}$ of the distributions in that class, and the parameters $N_{f},H_{f}$. The linear transform $U$ is represented by its coordinate linear functions.

2 Vectorial Boolean Functions

A variation of the above definition may be extended to vectorial Boolean functions. Let $y=(y_{1},\ldots,y_{m})=f(x_{1},\ldots,x_{n})$ be a vectorial Boolean function in $n$ variables $x=(x_{1},\ldots,x_{n})$. One defines a probability distribution on $(n+m)$-binary vectors $p_{x,y}=1/2^{n}$ if $y=f(x)$ and $p_{x,y}=0$ otherwise. Let $U$ be an $r\times(n+m)$ binary matrix of rank $r$. That matrix defines a probability distribution $q$ on binary $r$-strings as $q_{z}=\sum_{z=U(x,y)}p_{x,y}$, where the sum is computed over $x,y$ such that $z=U(x,y)$, and $(x,y)$ is a column vector of length $n+m$. How to find efficiently $U$ such that the distribution $q$ is far away from the uniform? For $r=1$ the distribution is $q=(q_{0},q_{1})$ and the function $U(x,y)=ax+by$ is a conventional linear approximation used in Matsui’s Linear Cryptanalysis of block ciphers, see [4]. The best $ax+by$ is found after applying Walsh-Hadamard transform to the distribution $p$ as

[TABLE]

The computation takes $(n+m)2^{n+m}$ arithmetic operations. Let $r=m=1$. We set $b=1$, otherwise the distribution $q$ is uniform. Then

[TABLE]

One takes $a$ with the largest $|W_{a}|$ and constructs the distribution $q$ with the smallest entropy by using $U(x,y)=ax+y$.

Similar to Section 1, we define $r$-dimensional non-linearity parameters $(N_{f},H_{f})$ for $f$. in case $r\geq 2$ efficient method to compute those parameters is unknown. However for small $n$ one can brute force all matrices $U$. For instance, let $n=m=4$ and $f(x_{1},x_{2},x_{3},x_{4})=(y_{1},y_{2},y_{3},y_{4})$, where

[TABLE]

if $(x_{1},x_{2},x_{3},x_{4})\neq(0,0,0,0)$ and $f(0,0,0,0)=(0,0,0,0).$ $r$-dimensional non-linearity parameters for $f$ for $r=1,\ldots,7$ are in Table 2.

One can construct an extension to the Linear Cryptanalysis based on $r$-dimensional parameters for $r\geq 2$.

3 Optimal Boolean Functions

Let $y=f(x_{1},\ldots,x_{n})$ be a vectorial Boolean function with $m$ coordinates and in $n$ variables and let $1\leq r\leq n$. One can split Boolean functions with the same $n,m$ into classes of equivalence and define an order on the equivalence classes.

Let $f^{\prime}$ be another Boolean function with the same parameters $n,m$. One says $f,f^{\prime}$ are equivalent (belong to the same class denoted $\{f\}$) if $(N_{f},H_{f})=(N_{f^{\prime}},H_{f^{\prime}})$. One now defines an order on the classes by $\{f\}<\{f^{\prime}\}$ if $N_{f}<N_{f^{\prime}}$ or if $N_{f}=N_{f^{\prime}}$, then $H_{f}>H_{f^{\prime}}$. Boolean functions from the smallest (according to $<$) class are called optimal.

Then it is easy to show that for $r=1,m=1$ and even $n$ optimal Boolean functions are exactly Boolean bent functions introduced by Rothaus in [3]. For $m\geq 1$ and even $n\geq 2m$ optimal Boolean functions are perfect nonlinear according to [2] and vice versa. By a computer search we find that the property holds for $r=2,m=1,n=4$. For larger $n,m$ and $r\geq 2$ this is an open problem.