Constructions of Boolean Functions
Claude Carlet (University of Paris 8-MAATICAH and INRIA)
Outline
I The primary constructions
- The Maiorana-McFarland construction ;
- The extended Maiorana-McFarland constructions ;
I The secondary constructions
- With extension of the number of variables ;
- Without extension of the number of variables ;
1
The primary constructions
Maiorana-McFarland’s constructions
For constructing bent functions : fπ,g (x, y) = x · π(y) + g(y),
n/2
n/2
n/2
7→ F2) is bent iff π is a
7→ F2 , g : F2
(where π : F2
permutation.
Equivalently : concatenating affine functions which are different
up to constants.
2
For constructing resilient functions (Camion, C., Charpin, Sendrier) :
n = r + s.
Let g : F2s 7→ F2 and φ : F2s 7→ F2r .
If wH (φ(y)) > k, ∀y ∈ F2s then the function :
fφ,g (x, y) = x · φ(y) + g(y), x ∈ F2r , y ∈ F2s
is m-resilient with m ≥ k.
Equivalently : concatenating affine functions whose ANFs contain
at least k + 1 variables.
3
x1
0
1
0
1
0
1
0
1
0
1
0
1
0
1
0
1
x2
0
0
1
1
0
0
1
1
0
0
1
1
0
0
1
1
x3
0
0
0
0
1
1
1
1
0
0
0
0
1
1
1
1
x4
0
0
0
0
0
0
0
0
1
1
1
1
1
1
1
1
x1x2x3
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
1
x1x4
0
0
0
0
0
0
0
0
0
1
0
1
0
1
0
1
f (x)
0
0
1
1
0
0
1
0
0
1
1
0
0
1
1
1
(−1)f (x)
1
1
-1
-1
1
1
-1
1
1
-1
-1
1
1
-1
-1
-1
2
0
-2
0
2
0
-2
0
0
2
0
-2
0
2
0
2
4
0
-4
0
0
0
0
0
0
4
0
0
0
0
0
-4
0
0
8
0
0
0
0
0
0
4
0
4
0
-4
0
4
bf(x)
0
0
8
8
0
0
0
0
4
-4
4
-4
-4
4
4
-4
Tab. 1: truth table and Walsh spectrum of f (x) = x1x2x3 +x1x4 +x2
r
fd
φ,g (a, b) = 2
X
(−1)g(y)+b·y .
y∈φ−1(a)
Nonlinearity of fφ,g .
A = maxa∈F2r #φ−1(a).
2n−1 − 2r−1A ≤ Nfφ,g
l√ m
≤ 2n−1 − 2r−1
A .
Consequence : if fφ,g achieves the best possible nonlinearity 2n−1 −
2k+1, then n ≤ k + 2 + log2(k + 3).
5
Some parameters that can be achieved :
• For every even n ≤ 10, Sarkar et al.’s bound with m = n/2 − 2
can be achieved by Maiorana-McFarland’s functions.
• For every n ≡ 1 mod 4, there exist Maiorana-McFarland’s
n−1
n−1
n
n−1
−2 2 .
4 -resilient functions on F2 with nonlinearity equal to 2
6
Generalizations of Maiorana-McFarland’s construction
- Concatenating quadratic functions in Dickson forms (C.C.)
let n = r + s and r = 2t or r = 2t + 1.
Let g : F2s 7→ F2, φ : F2s 7→ F2r and ψ : F2s 7→ F2t.
For x ∈ F2r , y ∈ F2s, define
fψ,φ,g (x, y) =
t
X
x2i−1x2i ψi(y) + x · φ(y) + g(y).
i=1
7
Nonlinearities of these functions (r even) :
f[
ψ,φ,g (a, b) =
X
r−wH (ψ(y))
2
Pt
(−1)
i=1 (φ2i−1 (y)+a2i−1 )(φ2i (y)+a2i )+g(y)+y·b
y∈Ea
Ea = {y ∈ F2s/ ∀i ≤ t,
ψi(y) = 1
or (φ2i−1(y) = a2i−1 and φ2i(y) = a2i)}
A = maxa∈F2r #Ea
8
M = maxy∈F2s wH (ψ(y)), M 0 = miny∈F2s wH (ψ(y)).
l√ m
A .
2n−1 − 2r−M −1A ≤ N(fψ,φ,g ) ≤ 2n−1 − 2r−M −1
0
A sufficient condition on ψ and φ such that f is m-resilient :
Let Φ : F2s 7→ F2r be obtained by multiplying bitwisely φ and
(ψ1, ψ1, ψ2, ψ2, . . . , ψt, ψt).
If wH (Φ(y)) > k for every y ∈ F2s, then fψ,φ,g is m-resilient with
m ≥ k.
9
Some parameters that can be achieved :
• n = 2m with m odd.
There exists fψ,φ,g balanced with nonlinearity 2n−1 − 2n/2−1 −
2(n/2−1)/2 (best known nonlinearity for these parameters).
2n/2−2
Pk
n/2−2
• n even ; k such that i=0
≤ 5 .
i
There exists fψ,φ,g k-resilient with nonlinearity 2n−1 − 2n/2−1 −
2n/2−2.
10
- Concatenating indicators of flats (C.C.)
∀(x, y) ∈ F2r × F2s,
t(y)
f (x, y) =
Y
(x · φi(y) + gi(y) + 1) + x · φ(y) + g(y)
(1)
i=1
where :
- the function t(y) is valued in {0, 1, . . . , r},
- φ1, . . . , φr and φ are functions from F2s into F2r such that, for
every y ∈ F2s, the vectors φ1(y), . . . , φt(y)(y) are linearly independent,
- g1, . . . , gr and g are Boolean functions on F2s.
11
Nonlinearities of these functions
X
bf(a, b) = 2r
(−1)g(y)+b·y −
y∈φ−1(a)
X
Pt(y)
g(y)+b·y+ i=1 ηi(a,y) gi(y)
2r−t(y)+1(−1)
y∈Fa
Fa = {y ∈ F2s | a ∈ φ(y)+ < φ1(y), . . . , φt(y)(y) >,
a + φ(y) =
Pt(y)
i=1
ηi(a, y) φi(y)
12

n−1
2
− maxr 
a∈F2

X
r−1
r−t(y)
−2
2
+
y∈φ−1(a)
X
2r−t(y)
y∈Fa\φ−1(a)
≤ Nf ≤
n−1
2
− maxr
a∈F2
s X
y∈φ−1(a)
2r−1 − 2r−t(y)
2
+
X
22r−2t(y).
y∈Fa\φ−1(a)
13
A sufficient condition such that f is m-resilient
If, for every y ∈ F2s, any element in φ(y)+ < φ1(y), . . . , φt(y)(y) >
has weight strictly greater than k, then f is m-resilient with m ≥ k.
14
The secondary constructions
With extension of the number of variables (Siegenthaler,
Tarannikov, Pasalic, Maitra, Sarkar, Johansson, C.C.)
Let r, s, t and m be positive integers such that t < r and m < s.
Let f1 and f2 be two r-variable t-resilient functions. Let g1 and g2
be two s-variable m-resilient functions.
Then the function
h(x, y) = f1(x) + g1(y) + (f1 + f2)(x) (g1 + g2)(y), x ∈ F2r , y ∈ F2s
is an (r + s)-variable (t + m + 1)-resilient function (C.C.).
15
1b
1b
b
h(a, b) = f1(a) [gb1(b) + gb2(b)] + f2(a) [gb1(b) − gb2(b)]
2
2
implies
Nh ≥
−2r+s−1 + 2s(Nf1 + Nf2 ) + 2r (Ng1 + Ng2 ) − (Nf1 + Nf2 )(Ng1 + Ng2 ).
Moreover, if the Walsh transforms of g1 and g2 have disjoint
supports, as well as f1 and f2, then
Nh =
min
i,j∈{1,2}
r+s−2
2
r−1
+2
N gj + 2
s−1
N fi − N f i N g j .
16
Without extension of the number of variables (C.C.)
Let f1, f2 and f3 be three Boolean functions on F2n.
Denote by σ1 the Boolean function equal to f1 ⊕ f2 ⊕ f3
and by σ2 the Boolean function equal to f1f2 ⊕ f1f3 ⊕ f2f3.
Then we have f1 + f2 + f3 = σ1 + 2σ2.
This implies
fb1 + fb2 + fb3 = σb1 + 2σb2.
17
If f1, f2 and f3 are k-resilient, then the function σ1 = f1 ⊕ f2 ⊕ f3
is k-resilient if and only if the function σ2 = f1f2 ⊕ f1f3 ⊕ f2f3 is
k-resilient.
Moreover :
Nσ2
1
≥
2
Nσ1 +
3
X
!
N fi
− 2n−1
i=1
and if the Walsh supports of f1, f2 and f3 are pairwise disjoint, then
1
Nσ1 + min Nfi .
N σ2 ≥
1≤i≤3
2
18