Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

A new class of S-boxes with optimal Feistel boomerang uniformity

Yuxuan Lu, Sihem Mesnager, Nian Li, Lisha Wang, Xiangyong Zeng

TL;DR

This work determines the FBCT for the power function $F(x)=x^{2^{n-2}-1}$ over ${\mathbb F}_{2^n}$ ($n>6$), deriving explicit FBCT entries via refined finite-field equation solving and binary Kloosterman sums. It establishes that ${\rm FBCT}_F(a,b)$ takes values in $\{2^n,0,4\}$ when $3\nmid n$ and in $\{2^n,0,4,8\}$ when $3|n$, and provides the complete Feistel boomerang spectrum expressed through the Kloosterman sum $K_n(1)$, showing the uniformity is $4$ (or $8$ if $3|n$). The results identify a fifth known class of functions with explicit FBCT values and demonstrate minimal Feistel boomerang uniformity among non-APN functions for $3\nmid n$. The findings have practical implications for designing Feistel-based S-boxes with tight resistance to boomerang-type attacks by exploiting this function’s provable FBCT structure.

Abstract

The Feistel Boomerang Connectivity Table ($\rm{FBCT}$), which is the Feistel version of the Boomerang Connectivity Table ($\rm{BCT}$), plays a vital role in analyzing block ciphers' ability to withstand strong attacks, such as boomerang attacks. However, as of now, only four classes of power functions are known to have explicit values for all entries in their $\rm{FBCT}$. In this paper, we focus on studying the FBCT of the power function $F(x)=x^{2^{n-2}-1}$ over $\mathbb{F}_{2^n}$, where $n$ is a positive integer. Through certain refined manipulations to solve specific equations over $\mathbb{F}_{2^n}$ and employing binary Kloosterman sums, we determine explicit values for all entries in the $\rm{FBCT}$ of $F(x)$ and further analyze its Feistel boomerang spectrum. Finally, we demonstrate that this power function exhibits the lowest Feistel boomerang uniformity.

A new class of S-boxes with optimal Feistel boomerang uniformity

TL;DR

This work determines the FBCT for the power function over (), deriving explicit FBCT entries via refined finite-field equation solving and binary Kloosterman sums. It establishes that takes values in when and in when , and provides the complete Feistel boomerang spectrum expressed through the Kloosterman sum , showing the uniformity is (or if ). The results identify a fifth known class of functions with explicit FBCT values and demonstrate minimal Feistel boomerang uniformity among non-APN functions for . The findings have practical implications for designing Feistel-based S-boxes with tight resistance to boomerang-type attacks by exploiting this function’s provable FBCT structure.

Abstract

The Feistel Boomerang Connectivity Table (), which is the Feistel version of the Boomerang Connectivity Table (), plays a vital role in analyzing block ciphers' ability to withstand strong attacks, such as boomerang attacks. However, as of now, only four classes of power functions are known to have explicit values for all entries in their . In this paper, we focus on studying the FBCT of the power function over , where is a positive integer. Through certain refined manipulations to solve specific equations over and employing binary Kloosterman sums, we determine explicit values for all entries in the of and further analyze its Feistel boomerang spectrum. Finally, we demonstrate that this power function exhibits the lowest Feistel boomerang uniformity.
Paper Structure (8 sections, 4 theorems, 38 equations, 1 table)

This paper contains 8 sections, 4 theorems, 38 equations, 1 table.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Statement of the main result
  4. Proof of part (A) of Theorem \ref{['main-thm']}
  5. Proof of part (B) of Theorem \ref{['main-thm']}
  6. Some auxiliaries results
  7. Proof of part (B) of Theorem \ref{['main-thm']}
  8. Conclusion

Key Result

Theorem 1

Let $F$ be the power function defined over ${\mathbb F}_{2^n}$ by $F(x)=x^{2^{n-2}-1}$ ($n>6$). The two following results hold. where $K_n(1)$ is the value of the Kloosterman sum at point 1 that is determined in Carlitz.1969 as follows (on the assumption that $\frac{1}{0}:=0$):

Theorems & Definitions (7)

  • Definition 1
  • Theorem 1
  • Remark 1
  • Lemma 1
  • Lemma 2
  • Lemma 3
  • proof