Skip to main content

Tools in Analyzing Linear Approximation for Boolean Functions Related to FLIP

Part of the Lecture Notes in Computer Science book series (LNSC,volume 11356)

Abstract

For cryptographic purposes, we generally study the characteristics of a Boolean function in n-variables with the inherent assumption that each of the n-bit inputs take the value 0 or 1, independently and randomly with probability 1 / 2. However, in the context of the FLIP stream cipher proposed by Méaux et al. (Eurocrypt 2016), this type of analysis warrants a different approach. To this end, Carlet et al. (IACR Trans. Symm. Crypto. 2018) recently presented a detailed analysis of Boolean functions with restricted inputs (mostly considering inputs with weight \(\frac{n}{2}\)) and provided certain bounds on linear approximation, which are related to restricted nonlinearity. The Boolean function used in the FLIP cipher reveals that it is actually a direct sum of several Boolean functions on a small number of inputs. Thus, with a different approach, we start a study in order to understand how the inputs to the composite function are distributed on the smaller functions. In this direction, we obtain several results that summarize the exact biases related to such Boolean functions. Finally, for the nonlinear filter function of FLIP, we obtain the lower bound on the restricted Walsh–Hadamard transform (i.e., upper bound on restricted nonlinearity). Our techniques provide a general theoretical framework to study such functions and better than previously published estimations of the biases, which is directly linked to the security parameters of the stream cipher.

Keywords

  • Bias
  • Boolean function
  • FLIP
  • Homomorphic encryption
  • Restricted domain
  • Stream cipher

This is a preview of subscription content, access via your institution.

Buying options

Chapter
USD   29.95
Price excludes VAT (USA)
  • DOI: 10.1007/978-3-030-05378-9_16
  • Chapter length: 22 pages
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
eBook
USD   59.99
Price excludes VAT (USA)
  • ISBN: 978-3-030-05378-9
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
Softcover Book
USD   79.99
Price excludes VAT (USA)
Fig. 1.
Fig. 2.

References

  1. Canteaut, A., et al.: Stream ciphers: a practical solution for efficient homomorphic-ciphertext compression. In: Peyrin, T. (ed.) FSE 2016. LNCS, vol. 9783, pp. 313–333. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-52993-5_16

    CrossRef  Google Scholar 

  2. Carlet, C., Méaux, P., Rotella, Y.: Boolean functions with restricted input and their robustness, application to the FLIP cipher. IACR Trans. Symmetric Cryptology 3, 192–227 (2017). (presented at FSE 2018)

    Google Scholar 

  3. Duval, S., Lallemand, V., Rotella, Y.: Cryptanalysis of the FLIP family of stream ciphers. In: Robshaw, M., Katz, J. (eds.) CRYPTO 2016. LNCS, vol. 9814, pp. 457–475. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-53018-4_17

    CrossRef  Google Scholar 

  4. Gangopadhyay, S., Gangopadhyay, A.K., Pollatos, S., Stănică, P.: Cryptographic Boolean functions with biased inputs. Crypt. Commun. 9(2), 301–314 (2017)

    MathSciNet  CrossRef  Google Scholar 

  5. Méaux, P.: Symmetric Encryption Scheme adapted to Fully Homomorphic Encryption Scheme. In: Journées Codage et Cryptographie - JC2 2015–12éme édition des Journées Codage et Cryptographie du GT C2, 5 au 9 octobre 2015, La Londeles-Maures, France (2015). http://imath.univ-tln.fr/C2/

  6. Méaux, P., Journault, A., Standaert, F.-X., Carlet, C.: Towards stream ciphers for efficient FHE with low-noise ciphertexts. In: Fischlin, M., Coron, J.-S. (eds.) EUROCRYPT 2016. LNCS, vol. 9665, pp. 311–343. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-49890-3_13

    CrossRef  Google Scholar 

  7. Mesnager, S., Zhou, Z., Ding, C.: On the nonlinearity of Boolean functions with restricted input. Crypt. Commun. (2018). https://doi.org/10.1007/s12095-018-0293-6

Download references

Acknowledgments

We would like to thank the anonymous reviewers of Indocrypt 2018 for their valuable suggestions and comments, which considerably improved the quality of our paper. The work of T.M. and P.S. started during an enjoyable visit to ISI-Kolkata in March 2018. They would like to thank the hosts and the institution for the excellent working conditions. T.M. also acknowledges support from the Omar Nelson Bradley foundation officer research fellowship in mathematics.

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Dibyendu Roy .

Editor information

Editors and Affiliations

Appendices

A Biases for 12-variable Function

In our example, the function \(F=x_0+x_1+x_2x_3+x_4x_5+x_6+x_7x_8 +x_9x_{10}x_{11}\) takes input from \(E_{12,6}\). The bias of the function F in this restricted domain is \(\approx 0.264069\). It is worth noticing that in the uniform domain (i.e., the function takes input from \(\mathbb {F}_2^{12}\) instead of \(E_{12,6}\)) the bias between the original function F and the linear function \(l_1=l_{\mathbf{{a}}_1,0}=x_0+x_1+x_6\) is high, as the monomial of the form \(x_ix_j\) or \(x_ix_jx_k\) is always 0 unless all variables involved in the monomials are 1. It can be observed that, the bias between F and \(l_1\) in the domain \(\mathbb {F}_2^{12}\) and \(E_{12,6}\) are \(|\mathcal {W}_F(\mathbf{{a}}_1)|=0.09375\) and \(|\mathcal {W}_F^{(6)}(\mathbf{{a}}_1)|=0.099567\), respectively.

The situation is different when the domain of the function F is \(E_{12,6}\) (restricted domain). In this domain, the bias between the original function F and a linear function is highest for \(l_2=l_{\mathbf{{a}}_2,0}=x_0+x_1+x_2+x_3+x_4+x_5+x_6\) instead of \(l_1=x_0+x_1+x_6\). The bias between F and \(l_2\) in restricted domain \(E_{12,6}\) is \(|\mathcal {W}_F^{(6)}(\mathbf{{a}}_2)|=0.264069\), but the bias between F and \(l_1\) in the restricted domain \(E_{12,6}\) is \(|\mathcal {W}_F^{(6)}(\mathbf{{a}}_1)|=0.099567\). All the linear function for which the bias is high in the restricted domain \(E_{12,6}\) are provided below:

  1. 1.

    \(l_{\mathbf{{a}}_2,0}=l_2=x_0+x_1+x_2+x_3+x_4+x_5+x_6\): \(|\mathcal {W}_F^{(6)}(\mathbf{{a}}_2)|=0.264069\), \(|\mathcal {W}_F(\mathbf{{a}}_2)|=0.09375\).

  2. 2.

    \(l_{\mathbf{{a}}_3,0}=l_3=x_0+x_1+x_2+x_3+x_6+x_7+x_8\): \(|\mathcal {W}_F^{(6)}(\mathbf{{a}}_3)|=0.264069\), \(|\mathcal {W}_F(\mathbf{{a}}_3)|=0.09375\).

  3. 3.

    \(l_{\mathbf{{a}}_4,0}=l_4=x_0+x_1+x_4+x_5+x_6+x_7+x_8\): \(|\mathcal {W}_F^{(6)}(\mathbf{{a}}_4)|=0.264069\), \(|\mathcal {W}_F(\mathbf{{a}}_4)|=0.09375\).

  4. 4.

    \(l_{\mathbf{{a}}_5,0}=l_5=x_2+x_3+x_9+x_{10}+x_{11}\): \(|\mathcal {W}_F^{(6)}(\mathbf{{a}}_5)|=0.264069\), \(|\mathcal {W}_F(\mathbf{{a}}_5)|=0\).

  5. 5.

    \(l_{\mathbf{{a}}_6,0}=l_6=x_4+x_5+x_9+x_{10}+x_{11}\): \(|\mathcal {W}_F^{(6)}(\mathbf{{a}}_6)|=0.264069\), \(|\mathcal {W}_F(\mathbf{{a}}_6)|=0\).

  6. 6.

    \(l_{\mathbf{{a}}_7,0}=l_7=x_7+x_8+x_9+x_{10}+x_{11}\): \(|\mathcal {W}_F^{(6)}(\mathbf{{a}}_7)|=0.264069\), \(|\mathcal {W}_F(\mathbf{{a}}_7)|=0\).

B Existence of a Point \(\mathbf{b}\) Referred to in Sect. 4.2

This appendix describes the existence of a point \(\mathbf{b}\) for each function \(f_j\) at which \(\displaystyle \sum _{\mathbf{x}\in E_{n,i}}(-1)^{f_j(\mathbf{x})+\mathbf{b}\cdot \mathbf{x}}\) attains \(\displaystyle \max _{\mathbf{{a}}}\left| \sum _{\mathbf{x}\in E_{n,i}}(-1)^{f_j(\mathbf{x})+\mathbf{{a}}\cdot \mathbf{x}} \right| \) for all weight i.

  1. 1.

    First, let \(f_1=x_0+x_1+x_2+x_3+x_4+x_5+x_6+x_7+x_8+x_9\). The existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight ten is given below (points are provided in integer form): 0, 1023, 0, 1023, 0, 1023, 0, 1023, 0, 1023, 0.

  2. 2.

    For \(f_2=x_0x_1+x_2x_3+x_4x_5+x_6x_7\), the existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight eight is mentioned below (points are provided in integer form): 0, 0, 0, 63, 15, 3, 0, 255, 0.

  3. 3.

    For \(f_3=x_0x_1x_2\), the existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight three is provided below (points are provided in integer form): 0, 0, 0, 1.

  4. 4.

    For \(f_4=x_0x_1x_2x_3\), the existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight four is mentioned below (points are provided in integer form): 0, 0, 0, 0, 1.

  5. 5.

    For \(f_5=x_0x_1x_2x_3x_4\), the existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight five is given below (points are provided in integer form): 0, 0, 0, 0, 0, 1.

  6. 6.

    For \(f_6=x_0x_1x_2x_3x_4x_5\), the existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight six is provided below (points are provided in integer form): 0, 0, 0, 0, 0, 0, 1.

  7. 7.

    For \(f_7=x_0x_1x_2x_3x_4x_5x_6\), the existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight seven is mentioned below (points are provided in integer form): 0, 0, 0, 0, 0, 0, 0, 1.

  8. 8.

    For \(f_8=x_0x_1x_2x_3x_4x_5x_6x_7\), the existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight eight is given below (points are provided in integer form): 0, 0, 0, 0, 0, 0, 0, 0, 1.

  9. 9.

    For \(f_9=x_0x_1x_2x_3x_4x_5x_6x_7x_8\), the existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight nine is mentioned below (points are provided in integer form): 0, 0, 0, 0, 0, 0, 0, 0, 0, 1.

Rights and permissions

Reprints and Permissions

Copyright information

© 2018 Springer Nature Switzerland AG

About this paper

Verify currency and authenticity via CrossMark

Cite this paper

Maitra, S., Mandal, B., Martinsen, T., Roy, D., Stănică, P. (2018). Tools in Analyzing Linear Approximation for Boolean Functions Related to FLIP. In: Chakraborty, D., Iwata, T. (eds) Progress in Cryptology – INDOCRYPT 2018. INDOCRYPT 2018. Lecture Notes in Computer Science(), vol 11356. Springer, Cham. https://doi.org/10.1007/978-3-030-05378-9_16

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-05378-9_16

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-05377-2

  • Online ISBN: 978-3-030-05378-9

  • eBook Packages: Computer ScienceComputer Science (R0)