Recently, the design of s-plateaued functions over Fn2, also known as 3-valued Walsh spectra functions (taking the values from the set {0,±2n+s/2 }), has been considered using an algorithmic approach (for example, IEEE Trans. Inf. Theory, vol. 70, no. 2, pp. 1408–1421, 2024) for the purpose of specifying balanced plateaued functions of maximal algebraic degree (called optimal). In this article, we identify these optimal plateaued functions within the Generalized Maiorana-McFarland (GMM) class and provide sufficient conditions that these functions do not admit nonzero linear structures. Moreover, we apply a similar technique to the one C. Carlet used for modifying bent functions in the Maiorana-McFarland (M) class (deriving the so-calledCandDclasses), and we obtain new classes of plateaued functions from theGMMclass. However, when the function ϕ in the definition off(x, y)=x·ϕ(y)+δ0(x) is injective, then we cannot derive the subclassD0as in the case of bent functions. We show that this is still possible when ϕ is not injective even though the sufficient conditions become more complicated compared to the bent case. Moreover, to ensure plateauedness within theCclass, we were forced to impose certain conditions on the dual of a plateaued function, which is harder to handle compared to the bent case since the dual is defined on a subset/subspace of the ambient space. In general, using indicator functions of the form 1E1(x)1E2(y), where the subspacesE1⊆ Fk2andE2⊆ Fn−k2are suitably chosen, we show that it is possible to modify the functiong(x, y)=x· ϕ(y) ∈GMMnkwhile preserving plateauedness, so thatf(x, y)=x· ϕ(y) + 1E1(x)1E2(y) is outside theGMMnkclass.

Integral cryptanalysis based on division property is a powerful cryptanalytic method whose range of successful applications was recently extended through the use of Mixed-Integer Linear Programming (MILP). Although this technique was demonstrated to be efficient in specifying distinguishers of reduced round versions of several families of lightweight block ciphers (such as SIMON, PRESENT, and few others), we show that this method provides distinguishers for a full-round block cipher SAT_Jo. SAT_Jo cipher is very similar to the well-known PRESENT block cipher, which has successfully withstood the known cryptanalytic methods. The main difference compared to PRESENT, which turns out to induce severe weaknesses of SAT_Jo algorithm, is its different choice of substitution boxes (S-boxes) and the bit-permutation layer for the reasons of making the cipher highly resource-efficient. Even though the designers provided a security analysis of this scheme against some major generic cryptanalytic methods, an application of the bit-division property in combination with MILP was not considered. By specifying integral distinguishers for the full-round SAT_Jo algorithm using this method, we essentially disapprove its use in intended applications. Using a 30-round distinguisher, we also describe a subkey recovery attack on the SAT_Jo algorithm whose time complexity is about 2 66 encryptions (noting that SAT_Jo is designed to provide 80 bits of security). Moreover, it seems that the choice of bit-permutation induces weak division properties since replacing the original bit-permutation of SAT_Jo by the one used in PRESENT immediately renders integral distinguishers inefficient.

The first and the third authors recently introduced a spectral construction of plateaued and of 5-value spectrum functions. In particular, the design of the latter class requires a specification of integers$\{W(u):u\in \mathbb {F}^{n}_{2}\}$, where$W(u)\in \left\{{0, \pm 2^{\frac {n+s_{1}}{2}}, \pm 2^{\frac {n+s_{2}}{2}}}\right\}$, so that the sequence$\{W(u):u\in \mathbb {F}^{n}_{2}\}$is a valid spectrum of a Boolean function (recovered using the inverse Walsh transform). Technically, this is done by allocating a suitable Walsh support$S=S^{[{1}]}\cup S^{[{2}]}\subset \mathbb {F}^{n}_{2}$, where$S^{[i]}$corresponds to those$u \in \mathbb {F} _{2}^{n}$for which$W(u)=\pm 2^{\frac {n+s_{i}}{2}}$. In addition, twodualfunctions$g_{[i]}:S^{[i]}\rightarrow \mathbb {F}_{2}$(with$\#S^{[i]}=2^{\lambda _{i}}$) are employed to specify the signs through$W(u)=2^{\frac {n+s_{i}}{2}}(-1)^{g_{[i]}(u)}$for$u\in S^{[i]}$whereas$W(u)=0$for$u\not \in S$. In this work, two closely related problems are considered. Firstly, the specification of plateaued functions (duals)$g_{[i]}$, which additionally satisfy the so-called totally disjoint spectra property, is fully characterized (so that$W(u)$is a spectrum of a Boolean function) when the Walsh support$S$is given as a union of two disjoint affine subspaces$S^{[i]}$. Especially, when plateaued dual functions$g_{[i]}$themselves have affine Walsh supports, an efficient spectral design that utilizes arbitrary bent functions (as duals of$g_{[i]}$) on the corresponding ambient spaces is given. The problem of specifying affine inequivalent 5-value spectra functions is also addressed and an efficient construction method that ensures the inequivalence property is derived (sufficient condition being a selection of affine inequivalent duals). In the second part of this work, we investigate duals of plateaued functions with affine Walsh supports. For a given such plateaued function, we show that different orderings of its Walsh support which are employing the Sylvester-Hadamard recursion actually induce bent duals which are affine equivalent.

Non‐linear filtering generators, as a well‐known family of stream ciphers, employ a filtering function to process the secret state bits and thus outputs binary keystream blocks of length m . In this study, the authors extend the framework of a generic cryptanalytic method applicable to non‐linear filtering generators called generalised filter state guessing attacks (GFSGA), introduced as a generalisation of the filter state guessing attack method, by applying a variable sampling of the keystream bits in order to retrieve as much information about the secret state bits as possible. Two different modes that use a variable sampling of keystream blocks are presented and it is shown that in many cases these modes may outperform the standard GFSGA mode. They also demonstrate the possibility of employing GFSGA‐like attacks to other design strategies such as non‐linear feedback shift register‐based ciphers (Grain family for instance). It is also indicated that the tap positions of Grain‐128 are not chosen optimally with respect to this generic cryptanalytic method and provide a better selection of taps that gives higher resistance to GFSGA‐like attacks.

The design of plateaued functions over GF(2)n, also known as 3-valued Walsh spectra functions (taking the values from the set {0, ±2Γ(n+s/2)1}), has been commonly approached by specifying a suitable algebraic normal form which then induces this particular Walsh spectral characterization. In this paper, we consider the reversed design method which specifies these functions in the spectral domain by specifying a suitable allocation of the nonzero spectral values and their signs. We analyze the properties of trivial and nontrivial plateaued functions (as affine inequivalent distinct subclasses), which are distinguished by their Walsh support Sf (the subset of GF(2)n having the nonzero spectral values) in terms of whether it is an affine subspace or not. The former class exactly corresponds to partially bent functions and admits linear structures, whereas the latter class may contain functions without linear structures. A simple sufficient condition on Sf , which ensures the nonexistence of linear structures, is derived and some generic design methods of nontrivial plateaued functions without linear structures are given. The extended affine equivalence of plateaued functions is also addressed using the concept of dual of plateaued functions. Furthermore, we solve the problem of specifying disjoint spectra (non)trivial plateaued functions of maximal cardinality whose concatenation can be used to construct bent functions in a generic manner. This approach may lead to new classes of bent functions due to large variety of possibilities to select underlying duals that define these disjoint spectra plateaued functions. An additional method of specifying affine in equivalent plateaued functions, obtained by applying a nonlinear transform to their input domain, is also given.

Whereas the design and properties of bent and plateaued functions have been frequently addressed during the past few decades, there are only a few design methods of the so-called five-valued spectra Boolean functions whose Walsh spectra take the values in {0, ±2λ1, ±2λ2}. Moreover, these design methods mainly regard the specification of these functions in their algebraic normal form (ANF) domain. In this paper, we give a precise characterization of this class of functions in their spectral domain using the concept of a dual of plateaued functions. Both necessary and sufficient conditions on the Walsh support of these functions are given, which then connects their design (in the spectral domain) to a family of the so-called totally (non-overlap) disjoint spectra plateaued functions. We identify some suitable families of plateaued functions having this property, thus providing some generic methods in the spectral domain. Furthermore, we also provide an extensive analysis of their constructions in the ANF domain and provide several generic design methods. The importance of this class of functions is manifolded, where apart from being suitable for some cryptographic applications, we emphasize their property of being constituent functions in the so-called four-bent decomposition.

A natural generalization of bent functions is a class of functions from F2nto Z(2k) which is known as generalized bent (gbent) functions. The construction and characterization of gbent functions are commonly described in terms of the Walsh transforms of the associated Boolean functions. Using similar approach, we first determine the dual of a gbent function when n is even. Then, depending on the parity of n, it is shown that the Gray image of a gbent function is (k - 1) or (k - 2) plateaued, which generalizes previous results for k = 2,3, and 4. We then completely characterize gbent functions as algebraic objects. More precisely, again depending on the parity of n, a gbent function is a (k - 1)-dimensional affine space of bent functions or semi-bent functions with certain interesting additional properties, which we completely describe. Finally, we also consider a subclass of functions from F2nto Z(2k), called Zq-bent functions (which are necessarily gbent), which essentially gives rise to relative difference sets similarly to standard bent functions. Two examples of this class of functions are provided and it is demonstrated that many gbent functions are not Zq-bent.