hardware security implementers

Abstract: Symmetric primitives over Galois rings need nonlinear components whose differentials with respect to ring addition are controlled. Let $R=\mathrm{GR}(4,m)$ and $q=2^m$, so that $(R,+)\cong(\mathbb{Z}/4\mathbb{Z})^m$ has order $N=q^2$. For every $m\ge1$ we construct an explicit permutation $G_c$ of $R$ all of whose differentials with a nonzero input difference have probability at most $36/N$, whereas every permutation polynomial of $R$ has such a differential of probability at least $2/\sqrt{N}$ (Ronjom--Sandrib). The bound holds for the fixed permutation itself, not on average over keys. Equivalently, $Δ(G_c)\le36$ against $Δ\ge2\sqrt{N}$ for permutation polynomials; since every permutation has $Δ\ge2$, the least differential uniformity of a permutation of $(\mathbb{Z}/4\mathbb{Z})^m$ lies between $2$ and $36$ for every $m$. In Teichmuller digits $(a,b)\in\mathbb{F}_q^2$ and for $c\in\mathbb{F}_q$ of absolute trace $1$, $G_c(a,b)=(L,(L^2+L+c)a)$ with $L=(a^2+a+c)b$. The map is $F_c\circ J\circ F_c$, where $F_c(a,b)=(a,(a^2+a+c)b)$ is induced by a polynomial over $R$ and $J$ exchanges the digits: a single digit exchange between two polynomial layers yields a bound independent of $m$. The proof reduces the difference equations, in each of three types of directions, to one-variable polynomials whose degrees do not depend on $m$. For general maps $F\circ J\circ F$ with $F(a,b)=(p(a),h(a)+d(a)b)$, where $p,d,h$ have degrees bounded independently of $m$, $p'\ne0$ and $d$ has no zeros, a Jacobian identity in characteristic $2$ bounds the differentials with nonzero low input and output differences independently of $m$; the remaining directions need a separate argument, which we give for an explicit family ($Δ\le440$, resp. $510$, for odd $m$).