Skip to main content

Constructing infinite families of low differential uniformity (nm)-functions with \(m>n/2\)

Abstract

Little theoretical work has been done on (nm)-functions when \(\frac{n}{2}<m<n\), even though these functions can be used in Feistel ciphers, and actually play an important role in several block ciphers. Nyberg has shown that the differential uniformity of such functions is bounded below by \(2^{n-m}+2\) if n is odd or if \(m>\frac{n}{2}\). In this paper, we first characterize the differential uniformity of those (nm)-functions of the form \(F(x,z)=\phi (z)I(x)\), where I(x) is the (mm)-inverse function and \(\phi (z)\) is an \((n-m,m)\)-function. Using this characterization, we construct an infinite family of differentially \(\Delta \)-uniform \((2m-1,m)\)-functions with \(m\ge 3\) achieving Nyberg’s bound with equality, which also have high nonlinearity and not too low algebraic degree. We then discuss an infinite family of differentially 4-uniform \((m+1,m)\)-functions in this form, which leads to many differentially 4-uniform permutations. We also present a method to construct infinite families of \((m+k,m)\)-functions with low differential uniformity and construct an infinite family of \((2m-2,m)\)-functions with \(\Delta \le 2^{m-1}-2^{m-6}+2\) for any \(m\ge 8\). The constructed functions in this paper may provide more choices for the design of Feistel ciphers.

This is a preview of subscription content, access via your institution.

References

  1. Adams C.M.: Constructing symmetric ciphers using the CAST design procedure. Des. Codes Cryptogr. 12, 283–316 (1997).

    MathSciNet  Article  MATH  Google Scholar 

  2. Anderson R., Biham E., Knudsen L.: Serpent: a proposal for the advanced encryption standard. NIST AES Propos. 174, 1–23 (1998).

    Google Scholar 

  3. Biham E., Anderson R., Knudsen L.: Serpent: a new block cipher proposal. In: International Workshop on Fast Software Encryption, vol. 1372. Springer, Berlin, pp. 222–238 (1998).

  4. Bogdanov A., Knudsen L.R., Leander G., Paar C., Poschmann A., Robshaw M.J.B., Seurin Y., Vikkelsoe C.: PRESENT: an ultra-lightweight block cipher. CHES 2007. Lect. Notes Comput. Sci. 4727, 450–466 (2007).

    Article  MATH  Google Scholar 

  5. Bosma W., Cannon J., Playoust C.: The magma algebra system I: the user language. J. Symb. Comput. 24, 235–265 (1997).

    MathSciNet  Article  MATH  Google Scholar 

  6. Carlet C.: Vectorial Boolean functions for cryptography. Chapter of the monography. In: Crama Y., Hammer P.L. (eds.) Boolean Models and Methods in Mathematics, Computer Science, and Engineering. Cambridge University Press, Cambridge (2010).

    Google Scholar 

  7. Carlet C.: Boolean and vectorial plateaued functions and APN functions. IEEE Trans. Inf. Theory 61(11), 6272–6289 (2015).

    MathSciNet  Article  MATH  Google Scholar 

  8. Carlet C.: Open questions on nonlinearity and on APN functions. In: International Workshop on the Arithmetic of Finite Fields, pp. 83–107 (2015).

  9. Carlet C., AlSalami Y.: A new construction of differentially \(4\)-uniform \((n, n-1)\)-functions. Adv. Math. Commun. 9(4), 541–565 (2015).

    MathSciNet  Article  MATH  Google Scholar 

  10. Carlet C., Tang D., Tang X.H., Liao Q.Y.: New construction of differentially 4-uniform bijections. Inf. Secur. Cryptol. 8567, 22–38 (2014).

    MathSciNet  Article  MATH  Google Scholar 

  11. Daemen J., Rijmen V.: The Design of Rijndael: AES: The Advanced Encryption Standard. Springer, Berlin (2002).

    MATH  Google Scholar 

  12. Dillon J.F.: Elementary Hadamard Difference Sets. University of Maryland, College Park (1974).

    MATH  Google Scholar 

  13. European Telecommunications Standards Institute, Technical Specification 135 202 V9.0.0: Universal mobile telecommunications system (UMTS); LTE; specification of the 3GPP confidentiality and integrity algorithms; Document 2: KASUMI specification (3GPP TS 35.202 V9.0.0 Release 9).

  14. Knudsen L.R., Robshaw M.: The Block Cipher Companion. Springer, Berlin (2011).

    Book  MATH  Google Scholar 

  15. Lidl R., Niederreiter H.: Finite fields: encyclopedia of mathematics and its applications. Comput. Math. Appl. 33(7), 136 (1997).

    Google Scholar 

  16. Macwilliams F.J., Sloane N.J.: The Theory of Error-Correcting Codes. North Holland, Amsterdam (1977).

    MATH  Google Scholar 

  17. Matsui M.: New block encryption algorithm MISTY. In: International Workshop on Fast Software Encryption, vol. 1267, pp. 54–68. Springer, Berlin (1997).

  18. National Institute of Standards and Technology: Data Encryption Standard (DES), Federal Information Processing Standards Publication 49-3. United States National Institute of Standards and Technology (NIST). Reaffirmed on October 25 (1999).

  19. National Institute of Standards and Technology: Advanced Encryption Standard (AES), Federal Information Processing Standards Publication 197. United States National Institute of Standards and Technology (NIST) (2001).

  20. Nyberg K.: Perfect non-linear S-boxes. In: Proceedings of EUROCRYPT’91, Lecture Notes in Computer Science, vol. 547, pp. 378–386 (1992).

  21. Nyberg K., Knudsen L.R.: Provable security against a differential attack. J. Cryptol. 8, 27–37 (1995).

    MathSciNet  Article  MATH  Google Scholar 

  22. Picek S., Mazumdar B., Mukhopadhyay D., Batina L.: Modified transparency order property: solution or just another attempt. Int. Conf. Secur. 9354, 210–227 (2015).

    Google Scholar 

  23. Piret G., Roche T., Carlet C.: PICARO—a block cipher allowing efficient higher-order side-channel resistance. In: International Conference on Applied Cryptography and Network Security, pp. 311–328 (2012).

  24. Williams K.: Note on cubics over \(GF(2^n)\) and \(GF(3^n)\). J. Number Theory 7, 361–365 (1975).

    MathSciNet  Article  MATH  Google Scholar 

  25. Zhang W.G., Xie C.L., Pasalic E.: Large sets of orthogonal sequences suitable for applications in CDMA systems. IEEE Trans. Inf. Theory 62(6), 3757–3767 (2016).

    MathSciNet  Article  MATH  Google Scholar 

Download references

Acknowledgements

We are indebted to the anonymous reviewers for their valuable comments. We would also like to thank Wolfgang Schmid and Tailin Niu for useful discussions for Proposition 4.7.

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Xi Chen.

Additional information

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

This work is supported by the National Science and Technology Major Project under Grant 2017YFB0802001 and the Nature Science Foundation of China (NSFC) under Grants 61722213, 11531002, 61572026.

Communicated by A. Pott.

Appendix A: Complete proof of Proposition 4.6

Appendix A: Complete proof of Proposition 4.6

Proposition 4.6

Let ml be positive integers and \(1\le k\le m-2\). Let \(U_i\)\((1\le i \le m-k-1)\) be disjoint sets in \({\mathbb {F}}_2^k\) satisfying \(\sum \nolimits _{i=1}^{m-k-1}\#U_i\le 2^{k-2}-l\) and such that, for any \(U_i\), any element in \({\mathbb {F}}_2^k\) appears at least 2l times in the multiset \(\{*\ z_1+z_2| (z_1,z_2)\in U_i\times U_i\ *\}\).

Consider the function \(F:{\mathbb {F}}_2^{m+k}\rightarrow {\mathbb {F}}_{2^m}\) in the form \(F(x,z)=\phi (z)I(x)\), where I(x) is the (mm)-inverse function and \(\phi :{\mathbb {F}}_2^k\rightarrow {\mathbb {F}}_{2^m}\) is defined as

$$\begin{aligned} \phi (z)=\left\{ \begin{array}{ll} L(z)+c_i, &{} \text{ when } z\in U_i, \\ L(z)+c_0, &{} \text{ when } z\in {\mathbb {F}}_2^k\setminus \bigcup \limits _{i=1}^{m-k-1} U_i, \end{array} \right. \end{aligned}$$
(9)

and satisfies \(Rank\{\phi (z)|z\in {\mathbb {F}}_2^k\}=m\), \(L:{\mathbb {F}}_2^k\rightarrow {\mathbb {F}}_{2^m}\) is linear and \(c_i\ (0\le i \le m-k-1)\) are constants in \({\mathbb {F}}_{2^m}\). Then F is a differentially \(\Delta \)-uniform function with \(\Delta \le 2^{k+1}-4l+2\).

Proof

Let \(U_0={\mathbb {F}}_2^k\setminus \bigcup \nolimits _{i=1}^{m-k-1} U_i\). According to the conditions on \(\phi (z)\) and the fact that \(\{L(z)|z\in {\mathbb {F}}_2^k\}\) is a vector space, we have

$$\begin{aligned} m= & {} \mathrm{Rank}\{\phi (z)|z\in {\mathbb {F}}_2^k\}\\= & {} \mathrm{Rank}\left( \bigcup \limits _{i=0}^{m-k-1} \{L(z)+c_i|z\in U_i\}\right) \\\le & {} \mathrm{Rank}\left( \bigcup \limits _{i=0}^{m-k-1} \{L(z)+c_i|z\in {\mathbb {F}}_2^k\}\right) \\\le & {} \mathrm{Rank}(\mathrm{Span}(\{L(z)|z\in {\mathbb {F}}_2^{k}\}\cup \{c_i|0\le i \le m-k-1\})). \end{aligned}$$

The last step holds since for any i, \(\{L(z)+c_i|z\in {\mathbb {F}}_2^k\}\subseteq \mathrm{Span}(\{L(z)|z\in {\mathbb {F}}_2^{k}\}\cup c_i)\). It is clear that the span of a set does not change its rank, then

$$\begin{aligned} m\le & {} \mathrm{Rank}(\mathrm{Span}(\{L(z)|z\in {\mathbb {F}}_2^{k}\}\cup \{c_i|0\le i \le m-k-1\}))\\= & {} \mathrm{Rank}(\{L(z)|z\in {\mathbb {F}}_2^{k}\}\cup \{c_i|0\le i \le m-k-1\})\\= & {} \mathrm{Rank}(\{L(z)|z\in {\mathbb {F}}_2^k\}\cup \mathrm{Span}\{c_i|0\le i \le m-k-1\})\\= & {} \mathrm{Rank}\{L(z)|z\in {\mathbb {F}}_2^k\}+\mathrm{Rank}(\mathrm{Span}\{c_i|0\le i \le m-k-1\})\\&- \,\mathrm{Rank}(\{L(z)|z\in {\mathbb {F}}_2^k\}\cap \mathrm{Span}\{c_i|0\le i \le m-k-1\})\\\le & {} k+(m-k)-0=m. \end{aligned}$$

Thus the last inequality is an equality, we have

$$\begin{aligned}&\mathrm{Rank}\{L(z)|z\in {\mathbb {F}}_2^k\}=k, \end{aligned}$$
(10)
$$\begin{aligned}&\mathrm{Rank}(\mathrm{Span}\{c_i|0\le i \le m-k-1\})=m-k, \end{aligned}$$
(11)

and

$$\begin{aligned} \mathrm{Rank}(\{L(z)|z\in {\mathbb {F}}_2^k\}\cap \mathrm{Span}\{c_i|0\le i \le m-k-1\})=0. \end{aligned}$$
(12)

For one thing, \(c_i\ne 0\) because of (11) for any \(0\le i \le m-k-1\). Moreover, according to (12), we have \(c_i\notin \{L(z)|z\in {\mathbb {F}}_2^k\}\) for any \(0\le i \le m-k-1\), which means \(\phi (z)\) does not vanish for any \(z\in {\mathbb {F}}_2^k\). For another, assume that there exists \(z_{i_1}\ne z_{i_2}\in {\mathbb {F}}_2^k\) such that \(\phi (z_{i_1})=\phi (z_{i_2})\), then \(L(z_{i_1})+c_{i_1}=L(z_{i_2})+c_{i_2}\). If \(c_{i_1}=c_{i_2}\), notice that L(z) is a linear injection according to (10), then \(z_{i_1}=z_{i_2}\), a contradiction. If \(c_{i_1}\ne c_{i_2}\), then \(0\ne c_{i_1}+c_{i_2}\in \{L(z)|z\in {\mathbb {F}}_2^k\}\). According to (12), then \(c_{i_1}+c_{i_2}\notin \mathrm{Span}\{c_i|0\le i \le m-k-1\}\), a contradiction. Thus \(\phi (z)\) is an injection. Then we only need to verify the last condition in Proposition 3.1, that is, for any \(d\in {\mathbb {F}}_2^k\), \(t\in {\mathbb {F}}^*_{2^m}\),

$$\begin{aligned} \begin{array}{ll}2^{k+1}-4l+2\ge 2^{k+1}-2\#\left\{ z\in {\mathbb {F}}_2^k\bigg |\mathrm{Tr}_m\left( \frac{\phi (z)t}{(t+\phi (z)+\phi (z+d))^2}\right) =1\right\} \\ \qquad - \, \#\{z\in {\mathbb {F}}_2^k|t=\phi (z)+\phi (z+d)\}+\#\{z\in {\mathbb {F}}_2^k|t=\phi (z)\}+\#\{z\in {\mathbb {F}}_2^k|t=\phi (z+d)\}.\end{array} \end{aligned}$$
(13)

Notice that \(U_i\)\((1\le i \le m-k-1)\) are disjoint sets satisfying \(\sum \nolimits _{i=1}^{m-k-1}\#U_i\le 2^{k-2}-l\), then \(\#U_0\ge 2^k-(2^{k-2}-l)= 3*2^{k-2}+l\), we have for any \(d\in {\mathbb {F}}_2^k\),

$$\begin{aligned} \#\{z|z,z+d\in U_0\}\ge 2^{k-1}+2l. \end{aligned}$$
(14)

The reason of (14) is

$$\begin{aligned}&\#\{z|z,z+d\in U_0\}\\&\quad =\#\left( \{z|z\in U_0\}\bigcap \{z|z+d\in U_0\}\right) \\&\quad =\#\{z|z\in U_0\}+\#\{z|z+d\in U_0\}-\#\left( \{z|z\in U_0\}\bigcup \{z|z+d\in U_0\}\right) \\&\quad \ge \#\{z|z\in U_0\}+\#\{z|z+d\in U_0\}-\#\{z|z\in {\mathbb {F}}_2^k\}\\&\quad = 2\#U_0-2^k\\&\quad \ge 2^{k-1}+2l. \end{aligned}$$

For any \(d\in {\mathbb {F}}_2^k\) and \(t\in {\mathbb {F}}^*_{2^m}\), if \(t+L(d)=0\), notice that \(\phi (z)=L(z)+c_0\) for any \(z\in U_0\), then we have

$$\begin{aligned}&\#\{z\in {\mathbb {F}}_2^k|t=\phi (z)+\phi (z+d)\}\\&\quad \ge \#\{z|z,z+d\in U_0,t=\phi (z)+\phi (z+d)\}\\&\quad =\#\{z|z,z+d\in U_0\}\\&\quad \ge 2^{k-1}+2l. \end{aligned}$$

Then (13) holds in this case since

$$\begin{aligned}&2^{k+1}-2\#\left\{ z\in {\mathbb {F}}_2^k\bigg |\mathrm{Tr}_m\left( \frac{\phi (z)t}{(t+\phi (z)+\phi (z+d))^2}\right) =1\right\} \\&\qquad - \, \#\{z\in {\mathbb {F}}_2^k|t=\phi (z)+\phi (z+d)\}+\#\{z\in {\mathbb {F}}_2^k|t=\phi (z)\}+\#\{z\in {\mathbb {F}}_2^k|t=\phi (z+d)\}\\&\quad \le 2^{k+1}-2\times 0-\#\{z\in {\mathbb {F}}_2^k|t=\phi (z)+\phi (z+d)\}+1+1\\&\quad \le 2^{k+1}-(2^{k-1}+2l)+2\\&\quad \le 2^{k+1}-4l+2, \end{aligned}$$

the last step follows from \(0\le \#U\le 2^{k-2}-l\). Thus we only need to consider the case \(d\in {\mathbb {F}}_2^k\), \(t\in {\mathbb {F}}^*_{2^m}\) satisfying \(t+L(d)\ne 0\).

Since \(\mathrm{Rank}\{\phi (z)|z\in {\mathbb {F}}_2^k\}=m\) leads to \(\mathrm{Span}\{\phi (z)|z\in {\mathbb {F}}_2^k\}^\perp =\{0\}\), we have \(\gamma \notin \mathrm{Span}\{\phi (z)|z\in {\mathbb {F}}_2^k\}^\perp \) for any \(\gamma \in {\mathbb {F}}^*_{2^m}\). Hence, for any \(\gamma \in {\mathbb {F}}^*_{2^m}\), there exists \(\beta \in \mathrm{Span}\{\phi (z)|z\in {\mathbb {F}}_2^k\}\) such that \(\mathrm{Tr}_m(\gamma \beta )=1\). That is, for any \(\gamma \in {\mathbb {F}}^*_{2^m}\), there exists \(z\in {\mathbb {F}}_2^k\) such that \(\mathrm{Tr}_m(\phi (z)\gamma )=1\).

For any \(d\in {\mathbb {F}}_2^k\) and \(t\in {\mathbb {F}}^*_{2^m}\) satisfying \(t+L(d)\ne 0\), \(\frac{t}{(t+L(d))^2}\) does not vanish and the mappings \(z\rightarrow \frac{(L(z)+c_i)t}{(t+L(d))^2}\) are affine functions since L(z) is linear, where \(0\le i \le m-k-1\). Let us apply the observation above with \(\gamma =\frac{t}{(t+L(d))^2}\). Then there exists \(z_0\in {\mathbb {F}}_2^k\) such that \(\mathrm{Tr}_m\left( \frac{\phi (z_0)t}{(t+L(d))^2}\right) =1\). The rest of the proof is divided into two cases \(z_0\in U_0\) and \(z_0\notin U_0\).

Case 1\(z_0\in U_0\).

Then \(\phi (z_0)=L(z_0)+c_0\). Since there exists \(z\in {\mathbb {F}}_2^k\) such that \(\mathrm{Tr}_m\left( \frac{(L(z)+c_0)t}{(t+L(d))^2}\right) =1\) and \(z\rightarrow \frac{(L(z)+c_0)t}{(t+L(d))^2}\) is an affine function, we can apply Fact 1 and we deduce:

$$\begin{aligned} \#\left\{ z\in {\mathbb {F}}_2^k\bigg |\mathrm{Tr}_m\left( \frac{(L(z)+c_0)t}{(t+L(d))^2}\right) =1\right\} \ge 2^{k-1}. \end{aligned}$$
(15)

In this case, we will only consider those z satisfying \(z,z+d\in U_0\). Then

$$\begin{aligned} \mathrm{Tr}_m\left( \frac{\phi (z)t}{(t+\phi (z)+\phi (z+d))^2}\right) =\mathrm{Tr}_m\left( \frac{(L(z)+c_0)t}{(t+L(d))^2}\right) \end{aligned}$$

for these z.

Further, for any \(d\in {\mathbb {F}}_2^k\) and \(t\in {\mathbb {F}}^*_{2^m}\) satisfying \(t+L(d)\ne 0\), we have

$$\begin{aligned}&2^{k+1}-2\#\left\{ z\in {\mathbb {F}}_2^k\bigg |\mathrm{Tr}_m\left( \frac{\phi (z)t}{(t+\phi (z)+\phi (z+d))^2}\right) =1\right\} \\&\qquad - \, \#\{z\in {\mathbb {F}}_2^k|t=\phi (z)+\phi (z+d)\}+\#\{z\in {\mathbb {F}}_2^k|t=\phi (z)\}+\#\{z\in {\mathbb {F}}_2^k|t=\phi (z+d)\}\\&\quad \le 2^{k+1}-2\#\left\{ z\bigg |z,z+d\in U_0,\mathrm{Tr}_m\left( \frac{\phi (z)t}{(t+\phi (z)+\phi (z+d))^2}\right) =1\right\} -0+1+1\\&\quad = 2^{k+1}-2\#\left\{ z\bigg |z,z+d\in U_0,\mathrm{Tr}_m\left( \frac{(L(z)+c_0)t}{(t+L(d))^2}\right) =1\right\} +2\\&\quad = 2^{k+1}-2\#\left( \{z|z,z+d\in U_0\}\bigcap \left\{ z\in {\mathbb {F}}_2^k\bigg |\mathrm{Tr}_m\left( \frac{(L(z)+c_0)t}{(t+L(d))^2}\right) =1\right\} \right) +2\\&\quad = 2^{k+1}-2\#\{z|z,z+d\in U_0\}-2\#\left\{ z\in {\mathbb {F}}_2^k\bigg |\mathrm{Tr}_m\left( \frac{(L(z)+c_0)t}{(t+L(d))^2}\right) =1\right\} \\&\qquad + \, 2\#\left( \{z|z,z+d\in U_0\}\bigcup \left\{ z\in {\mathbb {F}}_2^k\bigg |\mathrm{Tr}_m\left( \frac{(L(z)+c_0)t}{(t+L(d))^2}\right) =1\right\} \right) +2\\&\quad \le 2^{k+1}-2\#\{z|z,z+d\in U_0\}-2\#\left\{ z\in {\mathbb {F}}_2^k\bigg |\mathrm{Tr}_m\left( \frac{(L(z){+}c_0)t}{(t+L(d))^2}\right) {=}1\right\} + \, 2\#\{z\in {\mathbb {F}}_2^k\}+2\\&\quad \le 2^{k+1}-2(2^{k-1}+2l)-2^k+2^{k+1}+2\\&\quad = 2^{k+1}-4l+2. \end{aligned}$$

The last inequality follows from (14) and (15).

Case 2\(z_0\notin U_0\).

Then there exists \(1\le i \le m-k-1\) such that \(z_0\in U_i\). Thus \(\phi (z_0)=L(z_0)+c_i\), which means there exists \(z\in {\mathbb {F}}_2^k\) such that \(\mathrm{Tr}_m\left( \frac{(L(z)+c_i)t}{(t+L(d))^2}\right) =1\). Since \(z\rightarrow \frac{(L(z)+c_i)t}{(t+L(d))^2}\) is an affine function, we have

$$\begin{aligned} \#\left\{ z\in {\mathbb {F}}_2^k\bigg |\mathrm{Tr}_m\left( \frac{(L(z)+c_i)t}{(t+L(d))^2}\right) =1\right\} =2^{k-1}\ or\ 2^k, \end{aligned}$$

according to Fact 1. The rest of the proof is divided into two subcases.

Subcase 2.1\(\#\left\{ z\in {\mathbb {F}}_2^k\bigg |\mathrm{Tr}_m\left( \frac{(L(z)+c_i)t}{(t+L(d))^2}\right) =1\right\} =2^{k-1}\).

Then

$$\begin{aligned} \#\left\{ z\in {\mathbb {F}}_2^k\bigg |\mathrm{Tr}_m\left( \frac{(L(z)+c_i)t}{(t+L(d))^2}\right) =0\right\} =2^{k-1}. \end{aligned}$$

This means

$$\begin{aligned}&\#\left\{ z\in {\mathbb {F}}_2^k\bigg |\mathrm{Tr}_m\left( \frac{(L(z)+c_0)t}{(t+L(d))^2}\right) =1\right\} \\&\quad =\#\left\{ z\in {\mathbb {F}}_2^k\bigg |\mathrm{Tr}_m\left( \frac{(L(z)+c_i)t}{(t+L(d))^2}\right) =\mathrm{Tr}_m\left( \frac{(c_0+c_i)t}{(t+L(d))^2}\right) +1\right\} \\&\quad = 2^{k-1} \end{aligned}$$

no matter constant \(\mathrm{Tr}_m\left( \frac{(c_0+c_i)t}{(t+L(d))^2}\right) +1\) equals 0 or 1.

Notice that both (14) and (15) also hold in this subcase, similar to Case 1, we only consider those z satisfying \(z,z+d\in U_0\). Then

$$\begin{aligned} \mathrm{Tr}_m\left( \frac{\phi (z)t}{(t+\phi (z)+\phi (z+d))^2}\right) =\mathrm{Tr}_m\left( \frac{(L(z)+c_0)t}{(t+L(d))^2}\right) \end{aligned}$$

for these z.

Thus for any \(d\in {\mathbb {F}}_2^{k}\) and \(t\in {\mathbb {F}}^*_{2^m}\) satisfying \(t+L(d)\ne 0\),

$$\begin{aligned}&2^{k+1}-2\#\left\{ z\in {\mathbb {F}}_2^k\bigg |\mathrm{Tr}_m\left( \frac{\phi (z)t}{(t+\phi (z)+\phi (z+d))^2}\right) =1\right\} \\&\qquad - \, \#\{z\in {\mathbb {F}}_2^k|t=\phi (z)+\phi (z+d)\}+\#\{z\in {\mathbb {F}}_2^k|t=\phi (z)\}+\#\{z\in {\mathbb {F}}_2^k|t=\phi (z+d)\}\\&\quad \le 2^{k+1}-4l+2 \end{aligned}$$

for the same reason as in Case 1.

Subcase 2.2\(\#\left\{ z\in {\mathbb {F}}_2^k\bigg |\mathrm{Tr}_m\left( \frac{(L(z)+c_i)t}{(t+L(d))^2}\right) =1\right\} =2^k\).

Then for any \(z\in {\mathbb {F}}_2^k\), \(\mathrm{Tr}_m\left( \frac{(L(z)+c_i)t}{(t+L(d))^2}\right) =1\). In this subcase, we will only consider those z satisfying \(z,z+d\in U_i\), then for these z, we have

$$\begin{aligned} \mathrm{Tr}_m\left( \frac{\phi (z)t}{(t+\phi (z)+\phi (z+d))^2}\right) =\mathrm{Tr}_m\left( \frac{(L(z)+c_i)t}{(t+L(d))^2}\right) . \end{aligned}$$

Since for any \(d\in {\mathbb {F}}_2^k\) appears at least 2l times in the multiset \(\{*\ z_1+z_2| (z_1,z_2)\in U_i\times U_i\ *\}\) for any \(U_i\), then there are at least 2l different \(z_1\in U_i\) such that \(z_2=z_1+d\in U_i\). This means for any \(d\in {\mathbb {F}}_2^k\),

$$\begin{aligned} \#\{z|z,z+d\in U_i\}\ge 2l. \end{aligned}$$

Thus for any \(d\in {\mathbb {F}}_2^k\) and \(t\in {\mathbb {F}}^*_{2^m}\) satisfying \(t+L(d)\ne 0\), we have

$$\begin{aligned}&2^{k+1}-2\#\left\{ z\in {\mathbb {F}}_2^k\bigg |\mathrm{Tr}_m\left( \frac{\phi (z)t}{(t+\phi (z)+\phi (z+d))^2}\right) =1\right\} \\&\qquad - \, \#\{z\in {\mathbb {F}}_2^k|t=\phi (z)+\phi (z+d)\}+\#\{z\in {\mathbb {F}}_2^k|t=\phi (z)\}+\#\{z\in {\mathbb {F}}_2^k|t=\phi (z+d)\}\\&\quad \le 2^{k+1}-2\#\left\{ z\bigg |z,z+d\in U_i,\mathrm{Tr}_m\left( \frac{\phi (z)t}{(t+\phi (z)+\phi (z+d))^2}\right) =1\right\} -0+2\\&\quad = 2^{k+1}-2\#\left\{ z\bigg |z,z+d\in U_i,\mathrm{Tr}_m\left( \frac{(L(z)+c_i)t}{(t+L(d))^2}\right) =1\right\} +2\\&\quad = 2^{k+1}-2\#\{z|z,z+d\in U_i\}+2\\&\quad \le 2^{k+1}-4l+2. \end{aligned}$$

All in all, \(\Delta \le 2^{k+1}-4l+2\) according to Proposition 3.1. \(\square \)

Appendix B: \((2m - 2,m)\)-functions with low differential uniformity in the form \(F(x,z) = \phi (z)I(x)\) when m = 5,6,7

A differentially 14-uniform (8, 5)-function: Let \(F_{8,5}(x,z)=\phi (z)I(x)\), where I(x) is the inverse function on \({\mathbb {F}}_{2^5}\) and \(\phi :{\mathbb {F}}_2^3\rightarrow {\mathbb {F}}_{2^5}\) is presented by Table 1:

Table 1 Differentially 14-uniform (8, 5)-function

where \(\alpha \) is a defining element of \({\mathbb {F}}_{2^5}\).

A differentially 30-uniform (10, 6)-function: Let \(F_{10,6}(x,z)=\phi (z)I(x)\), where I(x) is the inverse function on \({\mathbb {F}}_{2^6}\) and \(\phi :{\mathbb {F}}_2^4\rightarrow {\mathbb {F}}_{2^6}\) is presented by Table 2:

Table 2 Differentially 30-uniform (10, 6)-function

where \(\alpha \) is a defining element of \({\mathbb {F}}_{2^6}\).

A differentially 58-uniform (12, 7)-function: Let \(F_{12,7}(x,z)=\phi (z)I(x)\), where I(x) is the inverse function on \({\mathbb {F}}_{2^7}\) and \(\phi :{\mathbb {F}}_2^5\rightarrow {\mathbb {F}}_{2^7}\) is presented by Table 3:

Table 3 Differentially 58-uniform (12, 7)-function

where \(\alpha \) is a defining element of \({\mathbb {F}}_{2^7}\).

Rights and permissions

Reprints and Permissions

About this article

Verify currency and authenticity via CrossMark

Cite this article

Carlet, C., Chen, X. & Qu, L. Constructing infinite families of low differential uniformity (nm)-functions with \(m>n/2\). Des. Codes Cryptogr. 87, 1577–1599 (2019). https://doi.org/10.1007/s10623-018-0553-7

Download citation

  • Received:

  • Revised:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s10623-018-0553-7

Keywords

  • APN function
  • Differential uniformity
  • Nyberg’s bound
  • Substitution boxes
  • Semi-bent function

Mathematics Subject Classification

  • 06E30
  • 11T60
  • 94A60