On CCZ-equivalence of the inverse function

TL;DR

This paper proves that for finite fields of size 2^n with n≥5, functions CCZ-equivalent to the inverse are essentially EA- or affine-equivalent, confirming a conjecture and analyzing permutation polynomials.

Contribution

It confirms that CCZ-equivalence to the inverse function implies EA- or affine-equivalence for n≥5, and rules out certain permutation polynomials over these fields.

Findings

CCZ-equivalence implies EA- or affine-equivalence for the inverse function when n≥5.

No permutation polynomials of the form L_1(x^{-1})+L_2(x) exist over ^n for n.

The proof uses Kloosterman sums, quadratic forms, and additive combinatorics.

Abstract

The inverse function $x \mapsto x^{-1}$ on $\mathbb{F}_{2^n}$ is one of the most studied functions in cryptography due to its widespread use as an S-box in block ciphers like AES. In this paper, we show that, if $n\geq 5$, every function that is CCZ-equivalent to the inverse function is already EA-equivalent to it. This confirms a conjecture by Budaghyan, Calderini and Villa. We also prove that every permutation that is CCZ-equivalent to the inverse function is already affine equivalent to it. The majority of the paper is devoted to proving that there are no permutation polynomials of the form $L_1(x^{-1})+L_2(x)$ over $\mathbb{F}_{2^n}$ if $n\geq 5$, where $L_1,L_2$ are nonzero linear functions. In the proof, we combine Kloosterman sums, quadratic forms and tools from additive combinatorics.