Functions with good cryptographic properties which are used as S-boxes in the design of block ciphers have a fundamental importance to the security of these ciphers since they determine the resistance to various kinds of cryptanalytic attacks. Almost Perfect Nonlinear (APN) functions provide the best possible resistance to differential cryptanalysis, which is one of the most efficient cryptographic attacks against block ciphers known to date. Furthermore, APN permutations are of particular interest in practice since many cipher designs require the S-box to be a permutation. In this paper, we present a low-complexity hardware architecture for the TU-decomposition of APN permutations, showing how Dillon’s APN permutation can be decomposed in this way as a practically relevant example. The TU-decomposition of an m-bit permutation is based on the use of two$m/2$-bit keyed permutations (T and U) to reduce the complexity of the original permutation. Dillon’s permutation on 6 bits is the only known APN permutation on an even number of bits, so its study is of fundamental interest. We present hardware theoretical complexities and experimental results obtained from FPGA and ASIC implementations for the proposed TU-decomposition hardware architecture. These complexities and results are compared with other hardware architectures given in the literature for the same function. From the comparisons, it can be observed that the TU-decomposition architecture presented here greatly outperforms other hardware approaches with respect to area, delay and area$\times $delay complexities.

We present two infinite families of APN functions in trivariate form over finite fields of the form${\mathbb F}_{2^{3m}}$. We show that the functions from both families are permutations when$m$is odd, and are 3-to-1 functions when$m$is even. In particular, our functions are AB permutations for$m$odd. Furthermore, we observe that for$m = 3$, i.e. for${\mathbb F}_{2^{9}}$, the functions from our families are CCZ-equivalent to the two bijective sporadic APN instances discovered by Beierle and Leander. We thus generalize these sporadic instances into an infinite family of APN functions. We also perform an exhaustive computational search for quadratic APN functions with binary coefficients in trivariate form over${\mathbb F}_{2^{3m}}$with$m \le 5$and report on the results.

The six infinite families of power APN functions are among the oldest known instances of APN functions, and it has been conjectured in 2000 that they exhaust all possible power APN functions. Another long-standing open problem is that of the Walsh spectrum of the Dobbertin power family, which is still unknown. Those of Kasami, Niho and Welch functions are known, but not the precise values of their Walsh transform, with rare exceptions. One promising approach that could lead to the resolution of these problems is to consider alternative representations of the functions in questions. We derive alternative representations for the infinite APN monomial families. We show how the Niho, Welch, and Dobbertin functions can be represented as the composition$x^{i} \circ x^{1/j}$of two power functions, and prove that our representations are optimal, i.e. no two power functions of lesser algebraic degree can be used to represent the functions in this way. We investigate compositions$x^{i} \circ L \circ x^{1/j}$for a linear polynomial$L$, show how the Kasami functions in odd dimension can be expressed in this way with$i=j$being a Gold exponent and compute all APN functions of this form for$n \le 9$and for$L$with binary coefficients, thereby showing that our theoretical constructions exhaust all possible cases. We present observations and data on power functions with exponent$\sum _{i = 1}^{k-1} 2^{2ni} - 1$which generalize the inverse and Dobbertin families. We present data on the Walsh spectrum of the Dobbertin function for$n \le 35$, and conjecture its exact form. As an application of our results, we determine the exact values of the Walsh transform of the Kasami function at all points of a special form. Computations performed for$n\leq 21$show that these points cover about 2/3 of the field.

We investigate the differential properties of a vectorial Boolean function G obtained by modifying an APN function F . This generalizes previous constructions where a function is modified at a few points. We characterize the APN-ness of G via the derivatives of F, and deduce an algorithm for searching for APN functions whose values differ from those of F only on a given set U ⊆ F2n. We introduce a value ΠFassociated with any F, which is invariant under CCZ-equivalence. We express a lower bound on the distance between a given APN function F and the closest APN function in terms of ΠF. We show how ΠFcan be computed efficiently for F quadratic. We compute ΠFfor all known APN functions over F2n. up to n ≤ 8. his is the first new CCZ-invariant for APN functions to be introduced within the last ten years. We derive a mathematical formula for this lower bound for the Gold function F (x) = x3, and observe that it tends to infinity with n. Finally, we describe how to efficiently find all sets U such that, taking G(x) = F (x) + v for x ∈ U and G(x) = F (x) for x ∉ U,G(x) is APN.

The binomial B(x) = x3+βx36(where β is primitive in F22) over F210 is the first known example of an Almost Perfect Nonlinear (APN) function that is not CCZ-equivalent to a power function, and has remained unclassified into any infinite family of APN functions since its discovery in 2006. We generalize this binomial to an infinite family of APN quadrinomials of the form x3+a(x2i+1)2k+bx3·2m+c(x2i+m+2m)2kfrom which B(x) can be obtained by setting a = β, b = c = 0, i = 3, k = 2. We show that for any dimension n = 2m with m odd and 3 + m,setting(a, b, c)=(β, β2, 1) and i =m -2 or i = (m - 2)-1mod n yields an APN function, and verify that for n = 10 the quadrinomials obtained in this way for i = m - 2 and i = (m - 2)-1mod n are CCZ-inequivalent to each other, to B(x), and to any other known APN function over F210.