The Explicit values of the UBCT, the LBCT and the DBCT of the inverse function
Yuying Man, Nian Li, Zhen Liu, Xiangyong Zeng
TL;DR
The paper addresses evaluating the explicit UBCT, LBCT, and DBCT entries for the inverse function $F(x)=x^{2^n-2}$ over ${\mathbb{F}}_{2^n}$ to assess resistance to boomerang attacks in S-boxes. It develops techniques to compute UBCT and LBCT without relying on $F^{-1}$, then derives complete DBCT values that depend on the parity of $n$ and involve traces and the Kloosterman sum $K(1)$, additionally establishing that $F$ is hard when $n$ is odd and determining the double boomerang uniformity $\beta_d(F)$. The contributions include exact entries for UBCT/LBCT, a full DBCT characterization, and precise element-counts corresponding to each entry, all of which enhance the evaluation of boomerang resistance for the inverse S-box. The results have practical impact in cryptographic design by providing rigorous metrics for boomerang-based security analyses and can guide the use of the inverse function in block cipher S-box design, especially through the lens of $K(1)$ and trace-based criteria.
Abstract
Substitution boxes (S-boxes) play a significant role in ensuring the resistance of block ciphers against various attacks. The Upper Boomerang Connectivity Table (UBCT), the Lower Boomerang Connectivity Table (LBCT) and the Double Boomerang Connectivity Table (DBCT) of a given S-box are crucial tools to analyze its security concerning specific attacks. However, there are currently no related results for this research. The inverse function is crucial for constructing S-boxes of block ciphers with good cryptographic properties in symmetric cryptography. Therefore, extensive research has been conducted on the inverse function, exploring various properties related to standard attacks. Thanks to the recent advancements in boomerang cryptanalysis, particularly the introduction of concepts such as UBCT, LBCT, and DBCT, this paper aims to further investigate the properties of the inverse function $F(x)=x^{2^n-2}$ over $\gf_{2^n}$ for arbitrary $n$. As a consequence, by carrying out certain finer manipulations of solving specific equations over $\gf_{2^n}$, we give all entries of the UBCT, LBCT of $F(x)$ over $\gf_{2^n}$ for arbitrary $n$. Besides, based on the results of the UBCT and LBCT for the inverse function, we determine that $F(x)$ is hard when $n$ is odd. Furthermore, we completely compute all entries of the DBCT of $F(x)$ over $\gf_{2^n}$ for arbitrary $n$. Additionally, we provide the precise number of elements with a given entry by means of the values of some Kloosterman sums. Further, we determine the double boomerang uniformity of $F(x)$ over $\gf_{2^n}$ for arbitrary $n$. Our in-depth analysis of the DBCT of $F(x)$ contributes to a better evaluation of the S-box's resistance against boomerang attacks.