Abstract
For cryptographic purposes, we generally study the characteristics of a Boolean function in nvariables with the inherent assumption that each of the nbit inputs take the value 0 or 1, independently and randomly with probability 1 / 2. However, in the context of the FLIP stream cipher proposed by Méaux et al. (Eurocrypt 2016), this type of analysis warrants a different approach. To this end, Carlet et al. (IACR Trans. Symm. Crypto. 2018) recently presented a detailed analysis of Boolean functions with restricted inputs (mostly considering inputs with weight \(\frac{n}{2}\)) and provided certain bounds on linear approximation, which are related to restricted nonlinearity. The Boolean function used in the FLIP cipher reveals that it is actually a direct sum of several Boolean functions on a small number of inputs. Thus, with a different approach, we start a study in order to understand how the inputs to the composite function are distributed on the smaller functions. In this direction, we obtain several results that summarize the exact biases related to such Boolean functions. Finally, for the nonlinear filter function of FLIP, we obtain the lower bound on the restricted Walsh–Hadamard transform (i.e., upper bound on restricted nonlinearity). Our techniques provide a general theoretical framework to study such functions and better than previously published estimations of the biases, which is directly linked to the security parameters of the stream cipher.
Keywords
 Bias
 Boolean function
 FLIP
 Homomorphic encryption
 Restricted domain
 Stream cipher
This is a preview of subscription content, access via your institution.
Buying options
References
Canteaut, A., et al.: Stream ciphers: a practical solution for efficient homomorphicciphertext compression. In: Peyrin, T. (ed.) FSE 2016. LNCS, vol. 9783, pp. 313–333. Springer, Heidelberg (2016). https://doi.org/10.1007/9783662529935_16
Carlet, C., Méaux, P., Rotella, Y.: Boolean functions with restricted input and their robustness, application to the FLIP cipher. IACR Trans. Symmetric Cryptology 3, 192–227 (2017). (presented at FSE 2018)
Duval, S., Lallemand, V., Rotella, Y.: Cryptanalysis of the FLIP family of stream ciphers. In: Robshaw, M., Katz, J. (eds.) CRYPTO 2016. LNCS, vol. 9814, pp. 457–475. Springer, Heidelberg (2016). https://doi.org/10.1007/9783662530184_17
Gangopadhyay, S., Gangopadhyay, A.K., Pollatos, S., Stănică, P.: Cryptographic Boolean functions with biased inputs. Crypt. Commun. 9(2), 301–314 (2017)
Méaux, P.: Symmetric Encryption Scheme adapted to Fully Homomorphic Encryption Scheme. In: Journées Codage et Cryptographie  JC2 2015–12éme édition des Journées Codage et Cryptographie du GT C2, 5 au 9 octobre 2015, La LondelesMaures, France (2015). http://imath.univtln.fr/C2/
Méaux, P., Journault, A., Standaert, F.X., Carlet, C.: Towards stream ciphers for efficient FHE with lownoise ciphertexts. In: Fischlin, M., Coron, J.S. (eds.) EUROCRYPT 2016. LNCS, vol. 9665, pp. 311–343. Springer, Heidelberg (2016). https://doi.org/10.1007/9783662498903_13
Mesnager, S., Zhou, Z., Ding, C.: On the nonlinearity of Boolean functions with restricted input. Crypt. Commun. (2018). https://doi.org/10.1007/s1209501802936
Acknowledgments
We would like to thank the anonymous reviewers of Indocrypt 2018 for their valuable suggestions and comments, which considerably improved the quality of our paper. The work of T.M. and P.S. started during an enjoyable visit to ISIKolkata in March 2018. They would like to thank the hosts and the institution for the excellent working conditions. T.M. also acknowledges support from the Omar Nelson Bradley foundation officer research fellowship in mathematics.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Appendices
A Biases for 12variable Function
In our example, the function \(F=x_0+x_1+x_2x_3+x_4x_5+x_6+x_7x_8 +x_9x_{10}x_{11}\) takes input from \(E_{12,6}\). The bias of the function F in this restricted domain is \(\approx 0.264069\). It is worth noticing that in the uniform domain (i.e., the function takes input from \(\mathbb {F}_2^{12}\) instead of \(E_{12,6}\)) the bias between the original function F and the linear function \(l_1=l_{\mathbf{{a}}_1,0}=x_0+x_1+x_6\) is high, as the monomial of the form \(x_ix_j\) or \(x_ix_jx_k\) is always 0 unless all variables involved in the monomials are 1. It can be observed that, the bias between F and \(l_1\) in the domain \(\mathbb {F}_2^{12}\) and \(E_{12,6}\) are \(\mathcal {W}_F(\mathbf{{a}}_1)=0.09375\) and \(\mathcal {W}_F^{(6)}(\mathbf{{a}}_1)=0.099567\), respectively.
The situation is different when the domain of the function F is \(E_{12,6}\) (restricted domain). In this domain, the bias between the original function F and a linear function is highest for \(l_2=l_{\mathbf{{a}}_2,0}=x_0+x_1+x_2+x_3+x_4+x_5+x_6\) instead of \(l_1=x_0+x_1+x_6\). The bias between F and \(l_2\) in restricted domain \(E_{12,6}\) is \(\mathcal {W}_F^{(6)}(\mathbf{{a}}_2)=0.264069\), but the bias between F and \(l_1\) in the restricted domain \(E_{12,6}\) is \(\mathcal {W}_F^{(6)}(\mathbf{{a}}_1)=0.099567\). All the linear function for which the bias is high in the restricted domain \(E_{12,6}\) are provided below:

1.
\(l_{\mathbf{{a}}_2,0}=l_2=x_0+x_1+x_2+x_3+x_4+x_5+x_6\): \(\mathcal {W}_F^{(6)}(\mathbf{{a}}_2)=0.264069\), \(\mathcal {W}_F(\mathbf{{a}}_2)=0.09375\).

2.
\(l_{\mathbf{{a}}_3,0}=l_3=x_0+x_1+x_2+x_3+x_6+x_7+x_8\): \(\mathcal {W}_F^{(6)}(\mathbf{{a}}_3)=0.264069\), \(\mathcal {W}_F(\mathbf{{a}}_3)=0.09375\).

3.
\(l_{\mathbf{{a}}_4,0}=l_4=x_0+x_1+x_4+x_5+x_6+x_7+x_8\): \(\mathcal {W}_F^{(6)}(\mathbf{{a}}_4)=0.264069\), \(\mathcal {W}_F(\mathbf{{a}}_4)=0.09375\).

4.
\(l_{\mathbf{{a}}_5,0}=l_5=x_2+x_3+x_9+x_{10}+x_{11}\): \(\mathcal {W}_F^{(6)}(\mathbf{{a}}_5)=0.264069\), \(\mathcal {W}_F(\mathbf{{a}}_5)=0\).

5.
\(l_{\mathbf{{a}}_6,0}=l_6=x_4+x_5+x_9+x_{10}+x_{11}\): \(\mathcal {W}_F^{(6)}(\mathbf{{a}}_6)=0.264069\), \(\mathcal {W}_F(\mathbf{{a}}_6)=0\).

6.
\(l_{\mathbf{{a}}_7,0}=l_7=x_7+x_8+x_9+x_{10}+x_{11}\): \(\mathcal {W}_F^{(6)}(\mathbf{{a}}_7)=0.264069\), \(\mathcal {W}_F(\mathbf{{a}}_7)=0\).
B Existence of a Point \(\mathbf{b}\) Referred to in Sect. 4.2
This appendix describes the existence of a point \(\mathbf{b}\) for each function \(f_j\) at which \(\displaystyle \sum _{\mathbf{x}\in E_{n,i}}(1)^{f_j(\mathbf{x})+\mathbf{b}\cdot \mathbf{x}}\) attains \(\displaystyle \max _{\mathbf{{a}}}\left \sum _{\mathbf{x}\in E_{n,i}}(1)^{f_j(\mathbf{x})+\mathbf{{a}}\cdot \mathbf{x}} \right \) for all weight i.

1.
First, let \(f_1=x_0+x_1+x_2+x_3+x_4+x_5+x_6+x_7+x_8+x_9\). The existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight ten is given below (points are provided in integer form): 0, 1023, 0, 1023, 0, 1023, 0, 1023, 0, 1023, 0.

2.
For \(f_2=x_0x_1+x_2x_3+x_4x_5+x_6x_7\), the existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight eight is mentioned below (points are provided in integer form): 0, 0, 0, 63, 15, 3, 0, 255, 0.

3.
For \(f_3=x_0x_1x_2\), the existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight three is provided below (points are provided in integer form): 0, 0, 0, 1.

4.
For \(f_4=x_0x_1x_2x_3\), the existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight four is mentioned below (points are provided in integer form): 0, 0, 0, 0, 1.

5.
For \(f_5=x_0x_1x_2x_3x_4\), the existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight five is given below (points are provided in integer form): 0, 0, 0, 0, 0, 1.

6.
For \(f_6=x_0x_1x_2x_3x_4x_5\), the existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight six is provided below (points are provided in integer form): 0, 0, 0, 0, 0, 0, 1.

7.
For \(f_7=x_0x_1x_2x_3x_4x_5x_6\), the existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight seven is mentioned below (points are provided in integer form): 0, 0, 0, 0, 0, 0, 0, 1.

8.
For \(f_8=x_0x_1x_2x_3x_4x_5x_6x_7\), the existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight eight is given below (points are provided in integer form): 0, 0, 0, 0, 0, 0, 0, 0, 1.

9.
For \(f_9=x_0x_1x_2x_3x_4x_5x_6x_7x_8\), the existence of a point \(\mathbf{b}\) corresponding to each weight starting from weight zero to weight nine is mentioned below (points are provided in integer form): 0, 0, 0, 0, 0, 0, 0, 0, 0, 1.
Rights and permissions
Copyright information
© 2018 Springer Nature Switzerland AG
About this paper
Cite this paper
Maitra, S., Mandal, B., Martinsen, T., Roy, D., Stănică, P. (2018). Tools in Analyzing Linear Approximation for Boolean Functions Related to FLIP. In: Chakraborty, D., Iwata, T. (eds) Progress in Cryptology – INDOCRYPT 2018. INDOCRYPT 2018. Lecture Notes in Computer Science(), vol 11356. Springer, Cham. https://doi.org/10.1007/9783030053789_16
Download citation
DOI: https://doi.org/10.1007/9783030053789_16
Published:
Publisher Name: Springer, Cham
Print ISBN: 9783030053772
Online ISBN: 9783030053789
eBook Packages: Computer ScienceComputer Science (R0)