Recently, the design of s-plateaued functions over Fn2, also known as 3-valued Walsh spectra functions (taking the values from the set {0,±2n+s/2 }), has been considered using an algorithmic approach (for example, IEEE Trans. Inf. Theory, vol. 70, no. 2, pp. 1408–1421, 2024) for the purpose of specifying balanced plateaued functions of maximal algebraic degree (called optimal). In this article, we identify these optimal plateaued functions within the Generalized Maiorana-McFarland (GMM) class and provide sufficient conditions that these functions do not admit nonzero linear structures. Moreover, we apply a similar technique to the one C. Carlet used for modifying bent functions in the Maiorana-McFarland (M) class (deriving the so-calledCandDclasses), and we obtain new classes of plateaued functions from theGMMclass. However, when the function ϕ in the definition off(x, y)=x·ϕ(y)+δ0(x) is injective, then we cannot derive the subclassD0as in the case of bent functions. We show that this is still possible when ϕ is not injective even though the sufficient conditions become more complicated compared to the bent case. Moreover, to ensure plateauedness within theCclass, we were forced to impose certain conditions on the dual of a plateaued function, which is harder to handle compared to the bent case since the dual is defined on a subset/subspace of the ambient space. In general, using indicator functions of the form 1E1(x)1E2(y), where the subspacesE1⊆ Fk2andE2⊆ Fn−k2are suitably chosen, we show that it is possible to modify the functiong(x, y)=x· ϕ(y) ∈GMMnkwhile preserving plateauedness, so thatf(x, y)=x· ϕ(y) + 1E1(x)1E2(y) is outside theGMMnkclass.

Rotation-symmetric (RS) bent functions, which are invariant under the action of the cyclic group, have attracted significant attention over the past three decades due to their importance in cryptographic applications. For the last three decades of research on these objects, most known RS bent functions have been obtained by applying extended-affine equivalence to specific Maiorana-McFarland bent functions, in a way that ensures the resulting function retains invariance under the cyclic group action. Due to the intrinsic difficulty of characterizing RS bent functions that do not belong to the completed Maiorana-McFarland classM#, there has been no evidence for the existence of such functions until now. In this paper, we provide, for the first time, a solution to this problem. First, we perform a computational classification of RS cubic bent functions in ten variables under extended-affine equivalence and demonstrate that one of the resulting classes is outside theM#class. Next, we prove that an infinite family of RS bent functions on Fn2of maximum algebraic degreen/2 (Su, Adv. Math. Commun. 13(2): 253–265, 2019) does not belong toM#, for alln≥ 8. Finally, we show that a family of quartic RS bent functions on Fn2(Carlet, Gao, and Liu, J. Comb. Theory Ser. A 127: 161–175, 2014), does not belong to theM#class for infinitely manyn.

Whereas the design and properties of single-output almost optimal five-valued spectra (AOFVS) Boolean functions on Fn2, whose Walsh spectra take the values in {0,±2⌊n/2⌋,±2⌊n/2⌋+1}, have been considered in several works, to the best of our knowledge the design of their vectorial counterpartF: Fn2→ Fm2has not been addressed so far. Based on a special kind of partitioning the vector space Fn2into disjoint linear codes (not all of them having the same dimension), for the first time we were able to specify vectorial AOFVS functionsF: Fn2→ Fn/2+12, for evenn. This has been achieved by identifying certain properties of the dual codes in the partition of Fn2. Moreover, for the first time, we could specify suitable quadruples (f1,...,f4) of AOFVS functions in a generic manner, whose concatenation f =f1||f2||f3||f4is bent. Due to a particular specification of the constituent functionsfi, we could also establish their exclusion from the completed Maiorana-McFarland (M#) class. Lastly, we introduce theD0class of AOFVS functions (similarly to the Carlet’sD0class of bent functions) and specify again suitable quadruples within this class, whose concatenation is provably bent and outside theM#class. Most notably, by doubly modifying functions in the generalized Maiorana-McFarland (GMM) class, we obtain AOFVS quadruples (f1,...,f4) for which we can fully specify the so-calledM-subspaces of eachfi. This allows us to determine their linearity index (the maximal dimension of any subspaceVfor whichDaDbfi= 0, for alla, b∈V), which is shown to be at most two, for any suchfi∈B2k+2andk≥ 3. Consequently, we deduce thatf=f1||f2||f3||f4∉M#, and additionally these bent functions have the lowest possible linearity index in certain cases, so thatDaDbf≢ 0 for any linearly independentaandb.

Abstract In Pasalic et al. (IEEE Trans Inf Theory 69:2702–2712, 2023), and in Anbar and Meidl (Cryptogr Commun 10:235–249, 2018), two different vectorial negabent and vectorial bent-negabent concepts are introduced, which leads to seemingly contradictory results. One of the main motivations for this article is to clarify the differences and similarities between these two concepts. Moreover, the negabent concept is extended to generalized Boolean functions from $${\mathbb {F}}_2^n$$ F 2 n to the cyclic group $${\mathbb {Z}}_{2^k}$$ Z 2 k . It is shown how to obtain nega- $${\mathbb {Z}}_{2^k}$$ Z 2 k -bent functions from $${\mathbb {Z}}_{2^k}$$ Z 2 k -bent functions, or equivalently, corresponding non-splitting relative difference sets from the splitting relative difference sets. This generalizes the shifting results for Boolean bent and negabent functions. We finally point to constructions of $${\mathbb {Z}}_8$$ Z 8 -bent functions employing permutations with the $$({\mathcal {A}}_m)$$ ( A m ) property, and more generally we show that the inverse permutation gives rise to $${\mathbb {Z}}_{2^k}$$ Z 2 k -bent functions.

Low-latency has been an important criterion in the design of block ciphers, especially in lightweight cryptography for IoT (Internet of Things) constrained devices to ensure secure real-time data transmission with limited resources. However, the design of most low-latency block ciphers today employ the so-called SPN (Substitution Permutation Network) structure with a few exceptions such as the SCARF cipher. In this article, by adopting the ideas of parallel execution for bridging the gap in latency between the standard Feistel and SPN structures, we propose a new low-latency cipher that uses the standard Feistel structure named as LLBC (Low Latency Block Cipher). It has a 128-bit block length with 128-bit (or 256-bit) key length. For the purpose of minimizing the latency and implementation costs, we were able to specify two 4-bit S-boxes, which not only have good cryptographic properties but are also excellent in terms of their hardware performance. More specifically, these S-boxes require only 18.5 GEs (Gate Equivalents) and have depth 3, which to the best of our knowledge are currently the best performing low-latency 4-bit S-boxes. Using these S-boxes in the design of LLBC, we achieve a significant reduction in both latency and implementation cost compared to Midori and QARMA. For instance, implementation of LLBC on the NanGate 45 nm open cell library achieves delay of about 2.79 ns which can be compared to the delay of PRINCE, Midori and QARMA being 4.06 ns, 4.94 ns, and 4.02 ns, respectively. Moreover, a standard security analysis shows that LLBC has enough security margin against various known attacks.

Every Boolean bent function f can be written either as a concatenation f = f1|| f2 of two complementary semi-bent functions f1, f2

Every Boolean bent function$f$can be written either as a concatenation$f=f_{1}\Vert f_{2}$of two complementary semi-bent functions$f_{1}, f_{2}$; or as a concatenation$f=f_{1}\Vert f_{2}\Vert f_{3}\Vert f_{4}$of four Boolean functions$f_{1}, f_{2}, f_{3}, f_{A}$, all of which are simultaneously bent, semi-bent, or 5-valued spectra-functions. In this context, it is essential to ask: When does a bent concatenation$f$(not) belong to the completed Maiorana-McFarland class${\mathcal{M}}^{\# }{?}$In this article, we answer this question completely by providing a full characterization of the structure of$\mathcal{M}$-subspaces for the concatenation of the form$f=f_{1}\Vert f_{2}$and$f=f1\Vert f2\Vert f\mathrm{s}\Vert f4$, which allows us to specify the necessary and sufficient conditions so that$f$is outside$\mathcal{M} \neq$. Based on these conditions, we propose several explicit design methods of specifying bent functions outside$\mathcal{M}^{\#}$in the special case when$f=g\Vert h\Vert g\Vert (h+1)$, where$g$and$h$are bent functions.

Abstract Recently, several interesting constructions of vectorial Boolean functions with the maximum number of bent components (MNBC functions, for short) were proposed. However, many of them have component functions from the completed Maiorana-McFarland class $${\mathcal {M}}^{\#}$$ M # . Moreover, no examples of MNBC functions containing component functions provably outside $${\mathcal {M}}^{\#}$$ M # are known. In this paper, we classify all MNBC functions in six variables. Based on the analysis of the obtained equivalence classes, we propose several infinite families of MNBC functions with component functions outside the $${\mathcal {M}}^{\#}$$ M # class. In particular, two of our new constructions are solutions to the open problem [Bapić et al (eds) Proceedings of the twelfth international workshop on coding and cryptography, 2022, Item 1., p. 9].

Abstract In this article, we identify certain instances of bent functions, constructed using the so-called $$P_\tau $$ P τ property, that are provably outside the completed Maiorana–McFarland ( $${\mathcal{M}\mathcal{M}}^\#$$ M M # ) class. This also partially answers an open problem in posed by Kan et al. (IEEE Trans Inf Theory, https://doi.org/10.1109/TIT.2022.3140180 , 2022). We show that this design framework (using the $$P_\tau $$ P τ property), can provide instances of bent functions that are outside the known classes of bent functions, including the classes $${\mathcal{M}\mathcal{M}}^\#$$ M M # , $${{\mathcal {C}}},{{\mathcal {D}}}$$ C , D and $${{\mathcal {D}}}_0$$ D 0 , where the latter three were introduced by Carlet in the early nineties. We provide two generic methods for identifying such instances, where most notably one of these methods uses permutations that may admit linear structures. For the first time, a set of sufficient conditions for the functions of the form $$h(y,z)=Tr(y\pi (z)) + G_1(Tr_1^m(\alpha _1y),\ldots ,Tr_1^m(\alpha _ky))G_2(Tr_1^m(\beta _{k+1}z),\ldots ,Tr_1^m(\beta _{\tau }z))+ G_3(Tr_1^m(\alpha _1y),\ldots ,Tr_1^m(\alpha _ky))$$ h ( y , z ) = T r ( y π ( z ) ) + G 1 ( T r 1 m ( α 1 y ) , … , T r 1 m ( α k y ) ) G 2 ( T r 1 m ( β k + 1 z ) , … , T r 1 m ( β τ z ) ) + G 3 ( T r 1 m ( α 1 y ) , … , T r 1 m ( α k y ) ) to be bent and outside $${\mathcal{M}\mathcal{M}}^\#$$

Threshold Implementation (TI) is a well-known Boolean masking technique that provides provable security against side-channel attacks. In the presence of glitches, the probing model was replaced by the so-called glitch-extended probing model which specifies a broader security framework. In CHES 2021, Shahmirzadi et al. introduced a general search method for finding first-order 2-share TI schemes without fresh randomness (under the presence of glitches) for a given encryption algorithm. Although it handles well single-output Boolean functions, this method has to store output shares in registers when extended to vector Boolean functions, which results in more chip area and increased latency. Therefore, the design of TI schemes that have low implementation cost under the glitch-extended probing model appears to be an important research challenge. In this paper, we propose an approach to design the first-order glitch-extended probing secure TI schemes when quadratic functions are employed in the substitution layer. This method only requires a small amount of fresh random bits and a single clock cycle for its implementation. In particular, the random bits in our approach are reusable and compatible with the changing of the guards technique. Our dedicated TI scheme for the AES cipher gives 20.23% smaller implementation area and 4.2% faster encryption compared to the TI scheme of AES (without using fresh randomness) proposed in CHES 2021. Additionally, we propose a parallel implementation of two S-boxes that further reduces latency (about 39.83%) at the expense of increasing the chip area by 9%. We have positively confirmed the security of AES under the glitch-extended probing model using the verification tool -SILVER and the side-channel leakage assessment method -TVLA.

An optimized implementation of S-boxes has a significant impact on the performance of cryptographic primitives. SAT-based methods can find optimal implementations for moderately sized S-boxes but their efficiency decreases when handling complex S-boxes. To improve the efficiency of the implementations, we propose two different methods, namely OR-encoding and IF-encoding, to encode the implementations of S-boxes. Furthermore, we also simplify the encoding of the outputs of logic gates and introduce new SAT-based search methods to optimize the implementations of S-boxes. Finally, to get a better trade-off between the search results (optimized implementations of S-boxes) and the search efficiency (in terms of time complexity), an encoding scheme using local solutions is proposed. Compared to the previous methods, our algorithms are relatively simple and more efficient. For instance, when a serial software implementation is considered, then the S-boxes of Sycon, ASCON, and the$\chi $function in Xoodyak, require 6, 1, and 2 fewer programming instructions, respectively, than the best known methods. Similar improvements are obtained for hardware implementations of S-boxes in some cryptographic primitives (e.g. LBlock, RECTANGLE, PRESENT/PHOTON-Beetle, TWINE, and ASCON), with the saving of gate equivalent (GE) that range from 1.67GE to 5.34GE compared to the current best implementations. Furthermore, our model can be applied to 6-bit, 7-bit, and 8-bit S-boxes, when the considered S-boxes are of low complexity.

In this article, we provide the first systematic analysis of bent functions f on Fn2 in the Maiorana-McFarland class M regarding the origin and cardinality of their M-subspaces, i.e., vector subspaces such that for any two elements a, b from this subspace, the second-order derivative DaDbf is the zero function on Fn2. By imposing restrictions on permutations π of Fn/2 2, we specify the conditions so that Maiorana-McFarland bent functions f(x, y) = x · π(y) + h(y) admit a unique M-subspace of dimension n/2. On the other hand, we show that permutations π with linear structures give rise to Maiorana-McFarland bent functions that do not have this property. In this way, we contribute to the classification of Maiorana-McFarland bent functions, since the number of M-subspaces of a fixed dimension is invariant under equivalence. Additionally, we give several generic methods of specifying permutations π so that f ∈ M admits a unique M-subspace. Most notably, using the knowledge about M-subspaces, we show that using the bent 4-concatenation of four suitably chosen Maiorana-McFarland bent functions on Fn−2 2, one can in a generic manner generate bent functions on Fn2 outside the completed Maiorana-McFarland class M# for any even n ≥ 8. Remarkably, with our construction methods, it is possible to obtain inequivalent bent functions on F82 not stemming from the two primary classes, the partial spread class PS and M. In this way, we contribute to a better understanding of the origin of bent functions in eight variables, since only a small fraction of about 276 bent functions stems from PS and M, whereas their total number on F82 is approximately 2106.

In this article, we propose several generic methods for constructing minimal linear codes over the prime field Fp. The first construction uses the direct sum of an arbitrary functionf: Fpr→ Fpand a bent functiong: Fps→ Fpto induce minimal codes with parameters [pr+s- 1,r+s+ 1] and minimum distance larger thanpr(p- 1)(ps-1-ps/2-1). For the first time, we provide a general construction of linear codes from a subclass of non-weakly regular plateaued functions, which partially answers an open problem posed by Li and Mesnager. The second construction deals with a bent functiong: Fpm→ Fpand a suitable subspace of derivatives ofg, i.e., functions of the formg(y+a) -g(y) for somea∈ F*pm. We also provide a sound generalization of the recently introduced concept of non-covering permutations. Some important structural properties of this class of permutations are derived in this context. The most remarkable observation is that the class of non-covering permutations includes all APN power permutations (characterized by having two-to-one derivatives). Finally, the last construction combines the previous two methods (direct sum, non-covering permutations and subspaces of derivatives), using a bent function in the Maiorana-McFarland class, to construct minimal codes (even those violating the Ashikhmin-Barg bound) with larger dimensions. This last method proves to be highly flexible since it can lead to several non-equivalent codes, depending to a great extent on the choice of the underlying non-covering permutation.

Abstract During the last five decades, many different secondary constructions of bent functions were proposed in the literature. Nevertheless, apart from a few works, the question about the class inclusion of bent functions generated using these methods is rarely addressed. Especially, if such a “new” family belongs to the completed Maiorana–McFarland ( $${{{\mathcal {M}}}{{\mathcal {M}}}}^\#$$ M M # ) class then there is no proper contribution to the theory of bent functions. In this article, we provide some fundamental results related to the inclusion in $${{{\mathcal {M}}}{{\mathcal {M}}}}^\#$$ M M # and eventually we obtain many infinite families of bent functions that are provably outside $${{{\mathcal {M}}}{{\mathcal {M}}}}^\#$$ M M # . The fact that a bent function f is in/outside $${{{\mathcal {M}}}{{\mathcal {M}}}}^\#$$ M M # if and only if its dual is in/outside $${{{\mathcal {M}}}{{\mathcal {M}}}}^\#$$ M M # is employed in the so-called 4-decomposition of a bent function on $${\mathbb {F}}_2^n$$ F 2 n , which was originally considered by Canteaut and Charpin (IEEE Trans Inf Theory 49(8):2004–2019, 2003) in terms of the second-order derivatives and later reformulated in (Hodžić et al. in IEEE Trans Inf Theory 65(11):7554–7565, 2019) in terms of the duals of its restrictions to the cosets of an $$(n-2)$$ ( n - 2 ) -dimensional subspace V. For each of the three possible cases of this 4-decomposition of a bent function (all four restrictions being bent, semi-bent, or 5-valued spectra functions), we provide generic methods for designing bent functions provably outside $${{{\mathcal {M}}}{{\mathcal {M}}}}^\#$$ M M # . For instance, for the elementary case of defining a bent function $$h(\textbf{x},y_1,y_2)=f(\textbf{x}) \oplus y_1y_2$$ h ( x , y 1 , y 2 ) = f ( x ) ⊕ y 1 y 2 on $${\mathbb {F}}_2^{n+2}$$ F 2 n + 2 using a bent function f on $${\mathbb {F}}_2^n$$ F 2 n , we show that h is outside $${{{\mathcal {M}}}{{\mathcal {M}}}}^\#$$ M M # if and only if f is outside $${{{\mathcal {M}}}{{\mathcal {M}}}}^\#$$ M M # . This approach is then generalized to the case when two bent functions are used. More precisely, the concatenation $$f_1||f_1||f_2||(1\oplus f_2)$$ f 1 | | f 1 | | f 2 | |

Since their introduction in early 2000, CPA (correlation power analysis), as a cryptographic tool, has been widely used in the cryptanalysis of cryptographic algorithms (being applicable to both symmetric key ciphers as well as to public key encryption schemes). An application of the classical CPA method, along with its variants, to cryptographic algorithms that use parallel implementation of its substitution boxes (S‐boxes) commonly requires more power traces to extract the secret key compared to the case when serial implementation of S‐boxes is employed. To reduce the amount of power traces in this scenario, we propose a modification of the standard CPA approaches and demonstrate practically that our method performs better than the existing ones in this respect. To verify the efficiency of our improved CPA method, we apply it to the public databases of DPA Contest V2. In particular, the experimental results show that only 495 power traces are required to recover the secret key of AES. We also compare the performance of our attack to the relevant methods whose parameters are available at DPA Contest V2. The results show that compared to the best nonprofiling side‐channel attack (SCA) attack, our method reduces the number of power traces required to recover the secret key by 6,566. Also, our new method performs almost similarly as the best profiling SCA attack of Benoit Gerard (in terms of the required number of power traces), thus reducing the gap in the performance of profiling and nonprofiling SCA attacks.

Boolean bent functions which at the same time have a flat nega-Hadamard transform are called bent-negabent functions. The known families of these functions mostly stem from the Maiorana-McFarland class of bent functions and their vectorial counterparts have not been considered in the literature. In this article, we introduce the notion ofvectorial bent-negabentfunctions and show that in general for a vectorial bent-negabent function$F\colon {\mathbb {F}} _{2}^{2m} \rightarrow {\mathbb {F}} _{2}^{k}$we necessarily have that$k \leq m-1$. We specify a class of vectorial bent-negabent functions of maximal output dimension$m-1$by using a set of linear complete mappings. On the other hand, we propose several methods (one of which is generic) of specifying vector spaces of nonlinear complete mappings which then induce vectorial bent-negabent functions (whose dimension is not maximal) having a certain number of component functions outside the completed Maiorana-McFarland class. Finally, we derive an upper bound on the maximum number of bent-negabent components for mappings$F\colon {\mathbb {F}} _{2}^{2m} \rightarrow {\mathbb {F}} _{2}^{k}$, where$m \leq k \leq 2m$, and identify some families of these functions reaching this upper bound.

Two new classes of bent functions derived from the Maiorana–McFarland (M) class, so-called C and D, were introduced by Carlet (1993) almost three decades ago. In Zhang (2020) sufficient conditions for specifying bent functions in C and D which are outside the completed M class, denoted by M#, were given. Furthermore in Pasalic et al. (2021) the notion of vectorial bent functions which are weakly or strongly outside M#, referring respectively to the case whether some or all nonzero linear combinations (called components) of its coordinate functions are in class C (or D) but provably outside M#, was introduced. In this article we continue the work of finding new instances of vectorial bent functions weakly/strongly outside M# using a different approach. Namely, a generic method for the construction of vectorial bent (n,t)-functions of the form F(x,y)=G(x,y)+H(x,y), n=2m,t|m, was recently proposed in Bapić (2021), where G is a given bent (n,t)-function satisfying certain properties and H is an arbitrary (t,t)-function having certain form. We introduce a new superclass of bent functions SC which contains the classes D0 and C and whose members are provably outside M#. Most notably, using indicators of the form 1L⊥(x,y)+δ0(x) to define members of this class leads for the first time to modifications of the M class performed on sets rather than on affine subspaces. We also show that for suitable choices of H, the function F is a vectorial bent function weakly/strongly outside the class M#. In this context, a new concept of being almost strongly outside M# is introduced and some families of vectorial bent functions with this property are given. Furthermore, we provide two new families of vectorial bent functions strongly outside M# (considered to be an intrinsically hard problem) whose output dimension is greater than 2, thus giving first examples of such functions in the literature.

Integral cryptanalysis based on division property is a powerful cryptanalytic method whose range of successful applications was recently extended through the use of Mixed-Integer Linear Programming (MILP). Although this technique was demonstrated to be efficient in specifying distinguishers of reduced round versions of several families of lightweight block ciphers (such as SIMON, PRESENT, and few others), we show that this method provides distinguishers for a full-round block cipher SAT_Jo. SAT_Jo cipher is very similar to the well-known PRESENT block cipher, which has successfully withstood the known cryptanalytic methods. The main difference compared to PRESENT, which turns out to induce severe weaknesses of SAT_Jo algorithm, is its different choice of substitution boxes (S-boxes) and the bit-permutation layer for the reasons of making the cipher highly resource-efficient. Even though the designers provided a security analysis of this scheme against some major generic cryptanalytic methods, an application of the bit-division property in combination with MILP was not considered. By specifying integral distinguishers for the full-round SAT_Jo algorithm using this method, we essentially disapprove its use in intended applications. Using a 30-round distinguisher, we also describe a subkey recovery attack on the SAT_Jo algorithm whose time complexity is about 2 66 encryptions (noting that SAT_Jo is designed to provide 80 bits of security). Moreover, it seems that the choice of bit-permutation induces weak division properties since replacing the original bit-permutation of SAT_Jo by the one used in PRESENT immediately renders integral distinguishers inefficient.

The first and the third authors recently introduced a spectral construction of plateaued and of 5-value spectrum functions. In particular, the design of the latter class requires a specification of integers$\{W(u):u\in \mathbb {F}^{n}_{2}\}$, where$W(u)\in \left\{{0, \pm 2^{\frac {n+s_{1}}{2}}, \pm 2^{\frac {n+s_{2}}{2}}}\right\}$, so that the sequence$\{W(u):u\in \mathbb {F}^{n}_{2}\}$is a valid spectrum of a Boolean function (recovered using the inverse Walsh transform). Technically, this is done by allocating a suitable Walsh support$S=S^{[{1}]}\cup S^{[{2}]}\subset \mathbb {F}^{n}_{2}$, where$S^{[i]}$corresponds to those$u \in \mathbb {F} _{2}^{n}$for which$W(u)=\pm 2^{\frac {n+s_{i}}{2}}$. In addition, twodualfunctions$g_{[i]}:S^{[i]}\rightarrow \mathbb {F}_{2}$(with$\#S^{[i]}=2^{\lambda _{i}}$) are employed to specify the signs through$W(u)=2^{\frac {n+s_{i}}{2}}(-1)^{g_{[i]}(u)}$for$u\in S^{[i]}$whereas$W(u)=0$for$u\not \in S$. In this work, two closely related problems are considered. Firstly, the specification of plateaued functions (duals)$g_{[i]}$, which additionally satisfy the so-called totally disjoint spectra property, is fully characterized (so that$W(u)$is a spectrum of a Boolean function) when the Walsh support$S$is given as a union of two disjoint affine subspaces$S^{[i]}$. Especially, when plateaued dual functions$g_{[i]}$themselves have affine Walsh supports, an efficient spectral design that utilizes arbitrary bent functions (as duals of$g_{[i]}$) on the corresponding ambient spaces is given. The problem of specifying affine inequivalent 5-value spectra functions is also addressed and an efficient construction method that ensures the inequivalence property is derived (sufficient condition being a selection of affine inequivalent duals). In the second part of this work, we investigate duals of plateaued functions with affine Walsh supports. For a given such plateaued function, we show that different orderings of its Walsh support which are employing the Sylvester-Hadamard recursion actually induce bent duals which are affine equivalent.

In the mid‐sixties, Rothaus introduced the notion of bent function and later presented a secondary construction of bent functions (building new bent functions from already defined ones), called Rothaus’ construction. In Zhang et al. 2017 (‘Constructing bent functions outside the Maiorana–Mcfarland class using a general form of Rothaus,’ IEEE Transactions on Information Theory , 2017, vol. 63, no. 8, pp. 5336–5349.’) provided two constructions of bent functions using a general form of Rothaus and showed that the obtained classes lie outside the completed Maiorana–McFarland ( ) class. In this study, the authors propose two similar methods for constructing bent functions outside the completed class but with significantly simplified sufficient conditions compared to those in Zhang et al. 2017. These simplified conditions do not induce any serious restrictions on the choice of permutations used in the construction apart from a simple requirement on their algebraic degree and the request that the component functions of one permutation do not admit linear structures. This enables us to generate a huge class of bent functions lying outside the completed class. Even more importantly, they prove that the new classes of bent functions are affine inequivalent to the bent functions in Zhang et al. 2017.

Non‐linear filtering generators, as a well‐known family of stream ciphers, employ a filtering function to process the secret state bits and thus outputs binary keystream blocks of length m . In this study, the authors extend the framework of a generic cryptanalytic method applicable to non‐linear filtering generators called generalised filter state guessing attacks (GFSGA), introduced as a generalisation of the filter state guessing attack method, by applying a variable sampling of the keystream bits in order to retrieve as much information about the secret state bits as possible. Two different modes that use a variable sampling of keystream blocks are presented and it is shown that in many cases these modes may outperform the standard GFSGA mode. They also demonstrate the possibility of employing GFSGA‐like attacks to other design strategies such as non‐linear feedback shift register‐based ciphers (Grain family for instance). It is also indicated that the tap positions of Grain‐128 are not chosen optimally with respect to this generic cryptanalytic method and provide a better selection of taps that gives higher resistance to GFSGA‐like attacks.

In this work, the authors propose some alternative hardware efficient masking schemes dedicated to protect the Advanced Encryption Standard (AES) against higher order differential power analysis (DPA). In general, the existing masking schemes all have in common an intrinsic trade‐off between the two main parameters of interest, namely the generation of fresh random masking values and the cost of hardware implementation. The design of efficient masking schemes which are non‐expensive in both aspects appears to be a difficult task. In this study, the authors propose a second‐order threshold implementation of AES, which is characterised by a beneficial trade‐off between the two parameters. More precisely, compared to the masking scheme of De Cnudde et al . at CHES 2016, which currently attains the best practical trade‐off, the proposed masking scheme requires 28.4% less random masking bits, whereas the implementation cost is slightly increased for about 13.7% (thus the chip area is 1.4 kGE larger). This masking scheme has been used to implement AES on an field‐programmable gate array (FPGA) platform and its resistance against the second‐order DPA in a simulated attack environment has been confirmed.

The design of plateaued functions over GF(2)n, also known as 3-valued Walsh spectra functions (taking the values from the set {0, ±2Γ(n+s/2)1}), has been commonly approached by specifying a suitable algebraic normal form which then induces this particular Walsh spectral characterization. In this paper, we consider the reversed design method which specifies these functions in the spectral domain by specifying a suitable allocation of the nonzero spectral values and their signs. We analyze the properties of trivial and nontrivial plateaued functions (as affine inequivalent distinct subclasses), which are distinguished by their Walsh support Sf (the subset of GF(2)n having the nonzero spectral values) in terms of whether it is an affine subspace or not. The former class exactly corresponds to partially bent functions and admits linear structures, whereas the latter class may contain functions without linear structures. A simple sufficient condition on Sf , which ensures the nonexistence of linear structures, is derived and some generic design methods of nontrivial plateaued functions without linear structures are given. The extended affine equivalence of plateaued functions is also addressed using the concept of dual of plateaued functions. Furthermore, we solve the problem of specifying disjoint spectra (non)trivial plateaued functions of maximal cardinality whose concatenation can be used to construct bent functions in a generic manner. This approach may lead to new classes of bent functions due to large variety of possibilities to select underlying duals that define these disjoint spectra plateaued functions. An additional method of specifying affine in equivalent plateaued functions, obtained by applying a nonlinear transform to their input domain, is also given.

Whereas the design and properties of bent and plateaued functions have been frequently addressed during the past few decades, there are only a few design methods of the so-called five-valued spectra Boolean functions whose Walsh spectra take the values in {0, ±2λ1, ±2λ2}. Moreover, these design methods mainly regard the specification of these functions in their algebraic normal form (ANF) domain. In this paper, we give a precise characterization of this class of functions in their spectral domain using the concept of a dual of plateaued functions. Both necessary and sufficient conditions on the Walsh support of these functions are given, which then connects their design (in the spectral domain) to a family of the so-called totally (non-overlap) disjoint spectra plateaued functions. We identify some suitable families of plateaued functions having this property, thus providing some generic methods in the spectral domain. Furthermore, we also provide an extensive analysis of their constructions in the ANF domain and provide several generic design methods. The importance of this class of functions is manifolded, where apart from being suitable for some cryptographic applications, we emphasize their property of being constituent functions in the so-called four-bent decomposition.

In[1], at the end of page 3761, the following table should be inserted after “so that”.

A natural generalization of bent functions is a class of functions from F2nto Z(2k) which is known as generalized bent (gbent) functions. The construction and characterization of gbent functions are commonly described in terms of the Walsh transforms of the associated Boolean functions. Using similar approach, we first determine the dual of a gbent function when n is even. Then, depending on the parity of n, it is shown that the Gray image of a gbent function is (k - 1) or (k - 2) plateaued, which generalizes previous results for k = 2,3, and 4. We then completely characterize gbent functions as algebraic objects. More precisely, again depending on the parity of n, a gbent function is a (k - 1)-dimensional affine space of bent functions or semi-bent functions with certain interesting additional properties, which we completely describe. Finally, we also consider a subclass of functions from F2nto Z(2k), called Zq-bent functions (which are necessarily gbent), which essentially gives rise to relative difference sets similarly to standard bent functions. Two examples of this class of functions are provided and it is demonstrated that many gbent functions are not Zq-bent.

In this paper, we show that the maximum number of bent component functions of a vectorial function F : GF(2)n→ GF(2)nis 2n- 2n/2. We also show that it is very easy to construct such functions. However, it is a much more challenging task to find such functions in polynomial form F ∈ GF(2n)[x], where F has only a few terms. The only known power functions having such a large number of bent components are xd, where d = 2n/2+ 1. In this paper, we show that the binomials Fi(x) = x2i(x + x(2n/2)) also have such a large number of bent components, and these binomials are inequivalent to the monomials x(2n/2+1) if 0n/2+1). We also determine the complete Walsh spectrum of our functions when n/2 is odd and gcd(i, n/2) = 1.

In this paper, we give an efficient method for constructing a large set of disjoint spectra functions without linear structures, which are not equivalent to partially linear functions. This positively answers the open problem [“how to construct a large set of disjoint spectra functions which are not (linearly equivalent to) partially linear functions” raised by Zhang and Xiao]. At the same time, this significantly extends a recent result of Zhang, where a method of specifying four disjoint spectra functions was given. It is demonstrated that such sets can be utilized in the design of highly nonlinear resilient functions. In the second part, based on a generalization of the indirect sum method, we give an alternative approach for designing sets of disjoint spectra functions of even larger cardinality than already given ones, but these functions then admit linear structures. In addition, it is shown that using suitable initial functions in the generalized indirect sum method we can specify highly nonlinear resilient Boolean functions (in odd number of input variables n) whose nonlinearity in many cases exceeds the current best known values. Moreover, we design some balanced functions (for odd n) that also achieve the highest nonlinearity known.

Resilient substitution boxes (S‐boxes) with high non‐linearity are important cryptographic primitives in the design of certain encryption algorithms. There are several trade‐offs between the most important cryptographic parameters and their simultaneous optimisation is regarded as a difficult task. In this study, the authors provide a construction technique to obtain resilient S‐boxes with so‐called strictly almost optimal non‐linearity for a larger number of output bits m than previously known. This is the first time that the non‐linearity bound 2 n −1 − 2 n /2 of resilient ( n , m ) S‐boxes, where n and m denote the number of the input and output bits, respectively, has been exceeded for m >⌊ n /4⌋. Thus, resilient S‐boxes with extremely high non‐linearity and a larger output space compared with other design methods have been obtained.

In the mid 1960s, Rothaus proposed the so-called “most general form” of constructing new bent functions by using three (initial) bent functions whose sum is again bent. In this paper, we utilize a special case of Rothaus construction when two of these three bent functions differ by a suitably chosen characteristic function of an n/2-dimensional subspace. This simplification allows us to treat the induced bent conditions more easily, also implying the possibility to specify the initial functions in the partial spread class and most notably to identify several instances of the so-called non-normal bent functions. Affine inequivalent bent functions within this class are then identified using a suitable selection of initial bent functions within the partial spread class (stemming from the complete Desarguesian spread). It is also shown that when the initial bent functions belong to the class D, then, under certain conditions, the constructed functions provably do not belong to the completed Maiorana-McFarland class. We conjecture that our method potentially generates an infinite class of non-normal bent functions (all tested ten-variable functions are non-normal but unfortunately they are weakly normal) though there are no efficient computational tools for confirming this.

Two (so-called 𝒞, D) classes of permutation-based bent Boolean functions were introduced by Carlet [4] two decades ago, but without specifying some explicit construction methods for their construction (apart from the subclass 𝒟 0 ). In this article, we look in more detail at the 𝒞 class, and derive some existence and nonexistence results concerning the bent functions in the 𝒞 class for many of the known classes of permutations over 𝔽 2 n . Most importantly, the existence results induce generic methods of constructing bent functions in class 𝒞 which possibly do not belong to the completed Maiorana-McFarland class. The question whether the specific permutations and related subspaces we identify in this article indeed give bent functions outside the completed Maiorana-McFarland class remains open.

In this paper, we employ the so-called semi-bent functions to achieve significant improvements over currently known methods, regarding the number of orthogonal sequences per cell that can be assigned to a regular tessellation of hexagonal cells, typical for certain code-division multiple-access systems. Our initial design method generates a large family of orthogonal sets of sequences derived from vectorial semi-bent functions. A modification of the original approach is proposed to avoid a hard combinatorial problem of allocating several such orthogonal sets to a single cell of a regular hexagonal network, while preserving the orthogonality to adjacent cells. This modification increases the number of users per cell by starting from shorter codewords and then extending the length of these codewords to the desired length. The specification and assignment of these orthogonal sets to a regular tessellation of hexagonal cells have been solved, regardless of the parity and size of m (where 2mis the length of the codewords). In particular, when the re-use distance is D = 4, the number of users per cell is 2m-2for almost all m, which is twice as many as can be obtained by the best known methods.

Abstract In this paper, several methods for constructing substitution boxes (S‐boxes) with good cross‐correlation properties are proposed. We firstly analyze the cross‐correlation properties of bent functions and derive a sufficient condition that the absolute indicator Δf,gof two bent functionsfandgachieve its lowest possible value 2n ∕ 2. More precisely, it is sufficient thatf + gis also a bent function, which then implies that the absolute indicator of vectorial bent functions equals to 2n ∕ 2. This indicates an erroneous conclusion in by Zhouet al., claiming that iffis bent, then Δf,g = 2n ∕ 2if and only ifgis an affine function, which is not true. Furthermore, because of a strong relationship between the cross‐correlation properties and disjoint spectra semi‐bent functions, two classes of highly nonlinear vectorial semi‐bent functions with very good cross‐correlation properties are proposed. In particular, the first class of vectorial semi‐bent functions introduced here compares favorably to other methods in terms of the cross‐correlation properties of its component functions. In addition, A sufficient condition that the absolute indicator of two bent functions achieves its lowest value is derived. A construction of S‐boxes with good auto‐correlation properties from vectorial bent functions is given. Two classes of nonlinear vectorial semi‐bent functions with good auto‐correlation properties are proposed. Copyright © 2014 John Wiley & Sons, Ltd.

The problem of constructing bent-negabent functions that do not belong to the completed Maiorana-McFarland class emerges implicitly through a series of construction methods proposed recently. These approaches manage to optimize the algebraic degree of bent-negabent functions, but all of the constructed bent-negabent functions belong to the completed Maiorana-McFarland class. In this paper, we use the indirect sum construction (proposed by Carlet in 2004) for constructing the bent-negabent functions that are not provably contained in this class, which is the first significant attempt in this direction. To achieve this, we first provide a class of bent functions with certain desirable properties that does not belong to this class and demonstrate the existence of the class members. Then, embedding these functions in the framework of the indirect sum construction, we are able to specify sufficient conditions for bent-negabent functions not being contained in the completed Maiorana-McFarland class.

In this paper, we provide necessary and sufficient conditions for a function of the form F(x)=Trk2k(Σi=1taixri(2k-1)) to be bent. Three equivalent statements, all of them providing both the necessary and sufficient conditions, are derived. In particular, one characterization provides an interesting link between the bentness and the evaluation of F on the cyclic group of the (2k+1)th primitive roots of unity in GF(22k). More precisely, for this group of cardinality 2k+1 given by U={u ∈ GF(22k):u2k+1=1}, it is shown that the property of being vectorial bent implies that Im(F)=GF(2k)∪{0}, if F is evaluated on U, that is, F(u) takes all possible values of GF(2k)* exactly once and the zero value is taken twice when u ranges over U. This condition is then reformulated in terms of the evaluation of certain elementary symmetric polynomials related to F, which in turn gives some necessary conditions on the coefficients ai (for binomial trace functions) that can be stated explicitly. Finally, we show that a bent trace monomial of Dillon's type Trk2k(λxr(2k-1)) is never a vectorial bent function.

To identify and specify trace bent functions of the form Tr(P(x)), where P(x) ∈ F(2n)[x], has been an important research topic lately. We characterize a class of vectorial (hyper)bent functions of the form F(x) = Trkn(Σi=0(2k) aixi((2k)-1)), where n = 2k, in terms of finding an explicit expression for the coefficients aiso that F is vectorial hyperbent. These coefficients only depend on the choice of the interpolating polynomial used in the Lagrange interpolation of the elements of U and some prespecified outputs, where U is the cyclic group of (2n/2+ 1)th roots of unity in F(2n). We show that these interpolation polynomials can be chosen in exactly (2k+ 1)!2k-1ways and this is the exact number of vectorial hyperbent functions of the form Trkn(Σi=02kaixi((2k)-1)). Furthermore, a simple optimization method is proposed for selecting the interpolation polynomials that give rise to trace polynomials with a few nonzero coefficients.

In this paper, a novel approach of finding disjoint linear codes is presented. The cardinality of a set of [u, m, t+1] disjoint linear codes largely exceeds all the previous best known methods used for the same purpose. Using such sets of disjoint linear codes, not necessarily of the same length, we have been able to provide a construction technique of t-resilient S-boxes F:F2n→2m( n even, ) with strictly almost optimal nonlinearity . This is the first time that the bound 2n-1-2n/2has been exceeded by multiple output resilient functions. Actually, the nonlinearity of our functions is in many cases equal to the best known nonlinearity of balanced Boolean functions. A large class of previously unknown cryptographic resilient S-boxes is obtained, and several improvements of the original approach are proposed. Some other relevant cryptographic properties are also briefly discussed. It is shown that these functions may reach Siegenthaler's bound n-t-1, and can be either of optimal algebraic immunity or of slightly suboptimal algebraic immunity, which was confirmed by simulations.

A new framework concerning the construction of small-order resilient Boolean functions whose nonlinearity is strictly greater than 2n-1- 2[n/2]is given. First, a generalized Maiorana-McFarland construction technique is described, which extends the current approaches by combining the usage of affine and nonlinear functions in a controllable manner. It is shown that for any given m, this technique can be used to construct a large class of n-variable (n both even and odd) m-resilient degree-optimized Boolean functions with currently best known nonlinearity. This class may also provide functions with excellent algebraic properties, measured through the resistance to (fast) algebraic attacks, if the number of n/2-variable affine subfunctions used in the construction is relatively low. Due to a potentially low hardware implementation cost, along with overall good cryptographic properties, this class of functions is an attractive candidate for the use in certain stream cipher schemes.

Substitution boxes (S-boxes) play a central role in the modern design of iterative block ciphers. While in substitution-permutation networks the S-boxes are bijective, thus ensuring the invertibility of the encryption algorithm, the property of being bijective is not mandatory for Feistel kind of networks. In this paper, two methods of constructing highly nonlinear balanced S-boxes (whose nonlinearity > 2n-1-2n/2is better than the nonlinearity of the commonly used inverse S-box) with good algebraic and differential properties are given. The first method employs two vectorial Boolean functions from the Maiorana-McFarland class that need to fulfill certain conditions. In particular, these conditions are shown to be satisfied by maximum length sequences. The second method is based on a suitable modification of a certain class of vectorial bent functions. The differential properties of these boxes, measured as a deviation from an optimal uniform distribution, also appear to be better than those of the inverse S-box. Both methods are susceptible to further optimizations of the relevant cryptographic parameters due to the underlying design ideas.

Substitution boxes (S‐boxes) are the key components of conventional cryptographic systems. To quantify the confusion property of S‐boxes, different non‐linearity criteria are proposed such as usual non‐linearity ( N F ), unrestricted non‐linearity (UN F ), generalised non‐linearity (GN F ), higher order non‐linearity (HN F ) and so on. Although these different criteria come from the idea of linear (or non‐linear) approximation of S‐boxes, the algebraic structures of Boolean functions that are used to approximate to S‐boxes have not been considered yet. In this study, the concept of the extended non‐linearity of S‐boxes (denoted by EN F ) is introduced by measuring the distance of a given function to a subset of Maiorana–McFarland functions. This approximation appears to be appealing because of a particular structure of this class of functions, namely their representation as a concatenation of affine functions. The complexity of computing the r th order extended non‐linearity for S‐boxes over GF (2) n is less than O (( n r )2 n − r ), ( r > 1). Moreover, a theoretical upper bound for the r th order extended non‐linearity is proved, which is much lower than previous generalised non‐linearity which might give a rise to more efficient attacks that combine a generalised correlation approach with guess and determine techniques. Furthermore, the relationship between the r ‐order extended non‐linearity and the generalised non‐linearity is derived.

In this paper, we consider the spectra of Boolean functions with respect to the action of unitary transforms obtained by taking tensor products of the Hadamard kernel, denoted byH, and the nega-Hadamard kernel, denoted byN. The set of all such transforms is denoted by {H,N}n. A Boolean function is said to be bent4if its spectrum with respect to at least one unitary transform in {H,N}nis flat. We obtain a relationship between bent, semibent, and bent4functions, which is a generalization of the relationship between bent and negabent Boolean functions proved by Parker and Pott [cf., LNCS 4893 (2007), 9-23]. As a corollary to this result, we prove that the maximum possible algebraic degree of a bent4function onnvariables is [n/2] and, hence, solve an open problem posed by Riera and Parker [cf., IEEE-TIT 52:9 (2006), 4142-4159].

Recently, several construction methods of highly nonlinear Boolean functions with relatively good algebraic properties were proposed. These approaches manage in optimizing most of the relevant cryptographic criteria, but not all of them at the same time. Usually, either the nonlinearity bounds are rather loose (though the actual nonlinearity is relatively high) or the functions do not provide a good resistance to fast algebraic cryptanalysis. In this paper, we develop a theoretical framework for using objects in suitable projective geometry spaces for construction of highly nonlinear Boolean functions. This allows us to establish tight bounds on the nonlinearity using simple counting arguments, thus avoiding rather complicated estimates of certain trace sums. Our method generates a class of almost fully optimized functions, that is the functions apart from very high nonlinearity also have the maximum algebraic degree and optimal algebraic immunity. Compared to the classes of functions proposed by Carlet and Feng, Wang , and Zeng , our functions achieve a slightly better nonlinearity which is traded-off against a little worse resistance against fast algebraic attacks. On the other hand, compared to the functions by Tang and Tu and Deng, our nonlinearity is somewhat lower, but the algebraic properties are slightly better.

Although there are many different approaches used in cryptanalysis of nonlinear filter generators, the selection of tap positions has not received enough attention yet. In this paper we examine the security of nonlinear filter generators that output several bits at the time against a variant of a guess and determine attack that takes into account the tap positions of the generator. In difference to the filter state guessing attack (FSGA) introduced by Pasalic (2009), our approach further reduces the input preimage space by using a given placement of the tap positions. The new attack, though a simple generalization of the FSGA, in many cases outperforms both classical algebraic attacks and the FSGA. In particular, the new attack is much more efficiently applied against filter generators that use a vectorial Maiorana-McFarland than classical algebraic attacks or the FSGA. As a proof of the concept we apply our attack to the stream cipher SOBER-t32 without stuttering and show that our attack performs slightly better than a guess and determine attack proposed by Babbage et al.

In this paper, the correlation properties of a nonlinear combining function over its support or zero set are investigated. Based on this characterization, a new attack on nonlinear combining generators is proposed. Our attack does not utilize traditional (non)linear statistics between the input and the output over the entire variable space, as the distinguishing process is rather applied to the restricted input space. The attack appears to be very efficient against nonlinear combining generators whose combining LFSRs are of relatively small input size. In many cases, our attack is a more favorable alternative than the known correlation attacks (but also than algebraic attacks in certain cases). To study the maximum correlation of a nonlinear combining function over its support or zero set, the notion of maximum distinguishable correlation is introduced. The relationship between the maximum distinguishable correlation and the nonlinearity of a combining function is then derived by using the normalized Walsh transform. Finally, we extend the usual notion of resiliency and discuss its implications towards the resistance against our attack.

In this paper, the complexity of applying a guess and determine attack to so-called Linear Feedback Shift register (LFSR)-based stream ciphers is analyzed. This family of stream ciphers uses a single or several LFSR and a filtering function F : GF(2)nrarr GF(2)mto generate the blocks of m ges 1 keystream bits at the time. In difference to a classical guess and determine attack, a method based on guessing certain bits in order to determine the remaining secret key/state bits, our approach efficiently takes advantage of the reduced preimage space for relatively large m and at the same time employing the design structure of the cipher. Several variations of the algorithm are derived to circumvent the sensitivity of attack to the input data, n, m and the key length. In certain cases, our attack outperforms classical algebraic attacks; these being considered as one of the most efficient cryptanalyst tools for this type of ciphers. A superior performance of our attack over algebraic attacks is demonstrated in case the filtering function belongs to the extended Maiorana-McFarland class.

In this work, the performance of probabilistic algebraic attacks is compared to classical (fast) algebraic attacks in the context of their application to certain linear beedback shift register (LFSR)-based stream ciphers. Using some results from coding theory it is shown that in terms of time complexity classical deterministic algebraic attacks are in general a more efficient cryptanalytic tool, unless the filtering function$F:{\hbox{GF}}\,(2)^{n} \rightarrow {\hbox{GF}}\,(2)^{m}$has such a nonrandom structure that its cryptographic use is presumably refutable anyway.

In this paper, we consider a subclass of the Maiorana-McFarland class used in the design of resilient nonlinear Boolean functions. We show that these functions allow a simple modification so that resilient Boolean functions of maximum algebraic degree may be generated instead of suboptimized degree in the original class. Preserving a high-nonlinearity value immanent to the original construction method, together with the degree optimization gives in many cases functions with cryptographic properties superior to all previously known construction methods. This approach is then used to increase the algebraic degree of functions in the extended Maiorana-McFarland (MM) class (nonlinear resilient functions F:GF(2)n|rarrGF(2)mderived from linear codes). We also show that in the Boolean case, the same subclass seems not to have an optimized algebraic immunity, hence not providing a maximum resistance against algebraic attacks. A theoretical analysis of the algebraic properties of extended Maiorana-McFarland class indicates that this class of functions should be avoided as a filtering function in nonlinear combining generators

The maximum-length sequences, also called m-sequences, have received a lot of attention since the late 1960s. In terms of linear-feedback shift register (LFSR) synthesis they are usually generated by certain power polynomials over a finite field and in addition are characterized by a low cross correlation and high nonlinearity. We say that such a sequence is generated by a semi-bent function. Some new families of such function, represented by f(x)=/spl Sigma//sub i=1//sup (n-1)/2/c/sub i/Tr(x(2/sup i/)+1), n odd and c/sub i//spl isin/F/sub 2/, have recently (2002) been introduced by Khoo et al. We first generalize their results to even n. We further investigate the conditions on the choice of c/sub i/ for explicit definitions of new infinite families having three and four trace terms. Also, a class of nonpermutation polynomials whose composition with a quadratic function yields again a quadratic semi-bent function is specified. The treatment of semi-bent functions is then presented in a much wider framework. We show how bent and semi-bent functions are interlinked, that is, the concatenation of two suitably chosen semi-bent functions will yield a bent function and vice versa. Finally, this approach is generalized so that the construction of both bent and semi-bent functions of any degree in certain range for any n/spl ges/7 is presented, n being the number of input variables.

We provide a construction technique for multiple-output resilient functions F:F/sub 2//sup n//spl rarr/F/sub 2//sup m/ with high nonlinearity. The construction leads to the problem of finding a set of linear codes with a fixed minimum distance, having the property that the intersection between any two codes is the all-zero codeword only. This problem is considered, and existence results are provided. Moreover, the constructed functions obtain a nonlinearity superior to previous construction methods.

One well-known method of generating key stream sequences for stream ciphers is to combine the outputs of several linear-feedback shift registers (LFSR) using a combining Boolean function. Here we concentrate on the design of good combining Boolean functions. We provide resilient Boolean functions with currently best known nonlinearity. These functions were not known earlier and the issues related to their existence were posed as open questions in the literature. Some of the functions we construct here achieve the provable upper bound on nonlinearity for resilient Boolean functions. Our technique interlinks mathematical results with classical computer search.

We provide a new generalized construction method for highly nonlinear t-resilient functions, F:F/sub 2//sup n//spl rarr/ F/sub 2//sup m/. The construction is based on the use of linear error-correcting codes together with highly nonlinear multiple output functions. Given a linear [u, m, t+1] code we show that it is possible to construct n-variable, m-output, t-resilient functions with very high nonlinearity for n>u. The method provides the currently best known nonlinearity results for most of the cases.