Relationships Among Nonlinearity Criteria

An important question in designing cryptographic functions including substitution boxes S boxes is the relationships among the various nonlinearity criteria each of which indicates the strength or weakness of a cryptographic function against a particular type of cryptanalytic attacks In this paper we reveal for the rst time interesting connections among the strict avalanche characteristics di erential charac teristics linear structures and nonlinearity of quadratic S boxes In addition we show that our proof techniques allow us to treat in a uni ed fashion all quadratic permutations namely quadratic S boxes that form permutations regardless of the underlying construction methods This greatly simpli es the proofs for a number of known results on the nonlinearity characteristics of quadratic permutation As a by product we solve an open problem regarding the existence of di erentially uniform quadratic per mutations on an even dimensional vector space Another contribution of this paper is the identi cation of an error in a paper presented by Beth and Ding at EUROCRYPT Nonlinearity Criteria This section introduces basic notions and de nitions of several nonlinearity criteria for cryptographic functions Denote by Vn the vector space of n tuples of elements from GF Let a an and b bn be two vectors in Vn The scalar product of and denoted by h i is de ned by h i a b anbn where multiplication and addition are over GF In this paper we consider functions from Vn to GF or simply functions on Vn We are particularly interested in functions whose algebraic degrees are also called quadratic functions Let f be a function on Vn The sequence de ned by f f f n is called the sequence of f and the sequence de ned by f f f n is called the truth table of f where n f is said balanced if its truth table has n zeros ones An a ne function f on Vn is a function that takes the form of f a x anxn c where aj c GF j n Furthermore f is called a linear function if c The sequence of an a ne or linear function is called an a ne or linear sequence The Hamming weight of a vector Vn denoted by W is the number of ones in the vector Now we introduce bent functions an important combinatorial concept introduced by Rothaus in the mid s although his pioneering work was not published until some ten years later De nition A function f on Vn is said to be bent if n X