Explicit permutations with tightly controlled security for digital rings
Explicit permutations of $(\mathbb{Z}/4\mathbb{Z})^m$ with uniformly bounded differential uniformity
Cryptography and SecurityInformation Theory
Summary
The paper deals with mathematical functions over certain digital structures used in cryptography, called Galois rings. The authors construct special functions called permutations that resist certain types of pattern-based attacks better than previously known functions in this setting. Unlike earlier results that only provided average-case guarantees, their construction has guaranteed security bounds for every instance. The key idea involves swapping parts of the input digits in a clever way combined with polynomial operations, keeping security risks low regardless of the size of the input.
What this means in practice
- •For cryptographic engineers: Design robust symmetric encryption components over Galois rings with guaranteed low differential vulnerabilities independent of input size.
- •For hardware security implementers: Implement secure permutations in lightweight hardware using digit exchange methods that maintain bounded differential uniformity regardless of dimension.
Authors
Hiroki Fukui
Abstract
Symmetric primitives over Galois rings need nonlinear components whose differentials with respect to ring addition are controlled. Let $R=\mathrm{GR}(4,m)$ and $q=2^m$, so that $(R,+)\cong(\mathbb{Z}/4\mathbb{Z})^m$ has order $N=q^2$. For every $m\ge1$ we construct an explicit permutation $G_c$ of $R$ all of whose differentials with a nonzero input difference have probability at most $36/N$, whereas every permutation polynomial of $R$ has such a differential of probability at least $2/\sqrt{N}$ (Ronjom--Sandrib). The bound holds for the fixed permutation itself, not on average over keys. Equivalently, $Δ(G_c)\le36$ against $Δ\ge2\sqrt{N}$ for permutation polynomials; since every permutation has $Δ\ge2$, the least differential uniformity of a permutation of $(\mathbb{Z}/4\mathbb{Z})^m$ lies between $2$ and $36$ for every $m$. In Teichmuller digits $(a,b)\in\mathbb{F}_q^2$ and for $c\in\mathbb{F}_q$ of absolute trace $1$, $G_c(a,b)=(L,(L^2+L+c)a)$ with $L=(a^2+a+c)b$. The map is $F_c\circ J\circ F_c$, where $F_c(a,b)=(a,(a^2+a+c)b)$ is induced by a polynomial over $R$ and $J$ exchanges the digits: a single digit exchange between two polynomial layers yields a bound independent of $m$. The proof reduces the difference equations, in each of three types of directions, to one-variable polynomials whose degrees do not depend on $m$. For general maps $F\circ J\circ F$ with $F(a,b)=(p(a),h(a)+d(a)b)$, where $p,d,h$ have degrees bounded independently of $m$, $p'\ne0$ and $d$ has no zeros, a Jacobian identity in characteristic $2$ bounds the differentials with nonzero low input and output differences independently of $m$; the remaining directions need a separate argument, which we give for an explicit family ($Δ\le440$, resp. $510$, for odd $m$).