1 On CCZ-equivalence of the inverse function Lukas K¨olsch −1 Abstract—The inverse function x 7→ x on F2n is one of the graph of F , denoted by G = (x, F (x)): x F n , to 1 F1 { 1 ∈ 2 } most studied functions in cryptography due to its widespread the graph of F2. use as an S-box in block ciphers like AES. In this paper, we show that, if n ≥ 5, every function that is CCZ-equivalent It is obvious that two functions that are affine equivalent are to the inverse function is already EA-equivalent to it. This also EA-equivalent. Furthermore, two EA-equivalent func- confirms a conjecture by Budaghyan, Calderini and Villa. We tions are also CCZ-equivalent. In general, the concepts of also prove that every permutation that is CCZ-equivalent to the inverse function is already affine equivalent to it. The majority CCZ-equivalence and EA equivalence do differ, for example of the paper is devoted to proving that there is no permutation a bijective function is always CCZ-equivalent to its compo- −1 polynomial of the form L1(x )+ L2(x) over F2n if n ≥ 5, sitional inverse, which is not the case for EA-equivalence. where L1, L2 are nonzero linear functions. In the proof, we Note also that the size of the image set is invariant under combine Kloosterman sums, quadratic forms and tools from affine equivalence, which is generally not the case for the additive combinatorics. other two more general notions. Index Terms —Inverse function, CCZ-equivalence, EA- Particularly well studied are APN monomials, a list of all equivalence, S-boxes, permutation polynomials. known infinite families is given in Table I. The table is generally believed to be complete. We want to note that, I. INTRODUCTION while the inverse function is not APN in even dimension, its Vectorial Boolean functions play a big role in the design differential uniformity is in this case 4, which is the lowest of symmetric cryptosystems as building blocks of block known differential uniformity for a bijection known as of ciphers [4]. To resist differential attacks, a vectorial Boolean writing this paper in all even dimensions larger than 6. function should have low differential uniformity. Exponent Conditions r Definition 1. A function F : F2n F2n has differential Gold 2 + 1 gcd(r, n) = 1 [12] → 2r r uniformity d, if Kasami 2 − 2 + 1 gcd(r, n) = 1 [17] Welch 2t + 3 n = 2t + 1 [9] t t d =∗ max x: F (x)+ F (x + a)= b . Niho 2 − 2 2 − 1 n = 2t + 1, t even [10] a∈F ,b∈F n 2n 2 |{ }| t 3t+1 2 − 2 2 − 1 n = 2t + 1, t odd A function with differential uniformity 2 is called almost Inverse 2n − 2 n odd [23] Dobbertin 4r 3r 2r r − n r [11] perfect nonlinear (APN) on F2n . 2 + 2 + 2 + 2 1 = 5 F As the differential uniformity is always even, APN functions TABLE I: List of known APN exponents over 2n up to CCZ-equivalence. yield the best resistance against differential attacks. The differential uniformity and in particular the APN prop- Especially the concept of CCZ-equivalence has been exten- erty is preserved by certain transformations, which define sively studied in the past years since it is a powerful tool for equivalence relations on the set of vectorial Boolean func- constructing and studying cryptological functions. arXiv:2008.08398v2 [cs.IT] 7 Mar 2021 tions. The most widely used notions of equivalence are Let us denote by the EA-class of F the set of all func- affine equivalence, extended affine equivalence and CCZ- tions EA-equivalent to a vectorial Boolean function F , and equivalence. similarly by CCZ-class of F the set of all functions CCZ- equivalent to F . Since EA-equivalence is a special case of Definition 2. Two functions F , F : F n F n are called 1 2 2 2 CCZ-equivalence, we can partition a CCZ-class into EA- extended affine equivalent (EA-equivalent)→if there are affine classes. Experimental results show that for many functions permutations A1, A2 and an affine mapping A3 from F2n to F : F n F n the CCZ-class of F coincides with its EA- itself such that 2 2 class if F→is not a permutation. If F is a permutation, then A1(F1(A2(x))) + A3(x)= F2(x). (1) its CCZ class often consists of precisely 2 EA-classes, with F and F −1 being representatives for the two EA-classes. Of F1 and F2 are called affine equivalent if they are EA- course, it is possible to have more than two EA-classes in one equivalent and it is possible to choose A3 =0 in Eq. (1). CCZ-class, this is for example the case for Gold functions Moreover, F1 and F2 are called CCZ-equivalent if there is in odd dimension [3, Theorem 1]. Additionally, it is possible an affine, bijective mapping A on F n F n that maps the 2 × 2 that a permutation and its inverse are in the same EA-class, Lukas K¨olsch is with Department of Mathematics, University of Rostock, this happens for example naturally for involutions like the 2n−2 Germany. Email: [email protected] inverse function x x over F n . 7→ 2 2 Since CCZ-equivalence is a much more difficult concept permutations with good cryptographic properties is to look than EA-equivalence, it is desirable to understand when the for a permutation in the CCZ-class of a non-permutation CCZ-class of F can be described entirely by combining EA- with good cryptographic properties, since CCZ-equivalence equivalence and the inverse transformation (in the case that preserves many important properties. This is precisely the F is invertible). This is a problem that is open even for technique that was used to find the only known APN per- most of the APN monomials in Table I. As noted earlier, mutation in even dimension [1]. Thus it is a very interesting the CCZ-class of Gold functions in odd dimension contains question to classify all permutations that are in the CCZ- more than 2 EA-classes and thus cannot be described with class of an APN function. Treating this problem for infinite EA-equivalence and the inverse transformation alone. For families is however very difficult. To the authors knowledge, all other monomials, this question is still open. Budaghyan, the only result in this direction is found in a recent paper [14], Calderini and Villa conjectured the following based on a where it was shown that there is no permutation in the CCZ- computer search for small values of n: class of the APN Gold functions over F2n with n even and that there is no permutation in the CCZ-class of APN Kasami Conjecture 1 ([2, Conjecture 4.14]). Let F (x) = xd be a functions over F n if is divisible by . The proof technique F 2 n 4 non-Gold APN monomial or the inverse function over 2n . used in [14] relies on a careful analysis of the bent component Then, every function that is CCZ-equivalent to F is EA- functions of the Gold and Kasami functions. equivalent to or to −1 (if it exists). F F In this paper, we will also classify all permutations in the In this paper we are going to confirm this conjecture in the CCZ-class of the inverse function (both in odd and even case of the inverse function, i.e. we show that the CCZ-class dimension). We show that (excluding some sporadic cases in 2n−2 of the function x x on F2n coincides with its low dimension) the only permutations in the CCZ-class are EA-class. This is to our7→ knowledge the first theoretical result the “trivial” ones, i.e. the ones that are affine equivalent to the of this kind. Note that, in many ways, the inverse function is inverse function. Of course, since the inverse function does actually the most interesting case because of its widespread not have any bent components, the approach is necessarily use in cryptography, most famously as the S-box in AES. different from the approach in [14]. Instead, we are going to use the following proposition which connects both of the In [25], [7] it was shown that two power functions x xk problems we mentioned to a special type of permutation l 7→ polynomial. The proof of the proposition can be found and x x on F2n are CCZ-equivalent if and only if k 2il7→(mod 2n 1) or kl 2i (mod 2n 1) for some in [13], co-written by the author of this paper, that deals with i ≡ N. Our result− can then≡ be seen as a− generalization the same questions as this paper but only achieved partial of∈ this result for the specific case k = 2n 2 since the results. only power functions that are EA-equivalent− to the inverse Proposition 1 ([13]). (a) Let F : F2n F2n and assume i n function are the power functions with l 2 (2 2) no permutation of the form F (x)+→L(x) exists where (mod 2n 1). Our approach in this paper is≡ very different− − L is a non-zero linear function. Then every permutation from the one used in [25], [7], which relies on sophisticated that is EA-equivalent to F is already affine equivalent tools exploiting the structure of the automorphism groups to it. of power functions. It seems difficult to use these group (b) Let F : F2n F2n and assume no permutation of theoretical tools to settle the complete relationship of EA- → the form L1(F (x)) + L2(x) exists where L1,L2 are and CCZ-equivalence between (APN) power functions and non-zero linear functions.