[Paper Review] Generating S-Boxes from Semi-fields Pseudo-extensions

Jean‐Guillaume Dumas, Jean-Baptiste Orfila|arXiv (Cornell University)|Nov 10, 2014

Cryptographic Implementations and Security8 references3 citations

TL;DR

This paper proposes a novel method to generate high-security 8×8 S-Boxes and Almost Perfect Nonlinear (APN) functions by constructing pseudo-extensions of finite semifields instead of finite fields. Using semifield-based pseudo-inversion and pseudo-cubing over $\mathbb{S}^2_{2^4}$, the authors generate 12,781 non-equivalent S-Boxes with maximal nonlinearity and differential invariants, and 2,684 new APN functions, including 336 with perfect avalanche and bit independence properties.

ABSTRACT

Specific vectorial boolean functions, such as S-Boxes or APN functions have many applications, for instance in symmetric ciphers. In cryptography they must satisfy some criteria (balancedness, high nonlinearity, high algebraic degree, avalanche, or transparency) to provide best possible resistance against attacks. Functions satisfying most criteria are however difficult to find. Indeed, random generation does not work and the S-Boxes used in the AES or Camellia ciphers are actually variations around a single function, the inverse function in F_2^n. Would the latter function have an unforeseen weakness (for instance if more practical algebraic attacks are developped), it would be desirable to have some replacement candidates. For that matter, we propose to weaken a little bit the algebraic part of the design of S-Boxes and use finite semifields instead of finite fields to build such S-Boxes. Since it is not even known how many semifields there are of order 256, we propose to build S-Boxes and APN functions via semifields pseudo-extensions of the form S_{2^4}^2, where S_{2^4} is any semifield of order 16 . Then, we mimic in this structure the use of functions applied on a finite fields, such as the inverse or the cube. We report here the construction of 12781 non equivalent S-Boxes with with maximal nonlinearity, differential invariants, degrees and bit interdependency, and 2684 APN functions.

Motivation & Objective

• To develop alternative S-Box constructions to replace the inverse function in AES and Camellia, which may become vulnerable to future algebraic attacks.
• To address the lack of known semifields of order $2^8$ by constructing pseudo-extensions of smaller semifields ($\mathbb{S}_{2^4}$) of degree 2.
• To mimic the cryptographic behavior of inverse and cube functions in finite fields within semifield-based structures to preserve desirable security properties.
• To generate new S-Boxes and APN functions with optimal or near-optimal cryptographic criteria, such as high nonlinearity, maximal differential uniformity, and perfect avalanche.
• To explore the feasibility of using semifields as a foundation for next-generation symmetric ciphers with enhanced resistance to linear and differential cryptanalysis.

Proposed method

• Construct degree-2 pseudo-extensions $\mathbb{S}^2_{2^4}$ from semifields of order $2^4$ using a pseudo-irreducibility condition derived from finite field polynomial irreducibility.
• Define a pseudo-inverse function on $\mathbb{S}^2_{2^4}$ that emulates the behavior of the inverse in $\mathbb{F}_{2^8}$, using algebraic expressions involving semifield multiplication and addition.
• Apply affine transformations to the output of the pseudo-inverse to produce bijective S-Boxes from $\mathbb{F}_2^8$ to $\mathbb{F}_2^8$.
• Mimic the cube function in finite fields by deriving a pseudo-cube function over $\mathbb{S}^2_{2^4}$ using algebraic expansions of $ (aX + b)^3 $ in semifield polynomial rings.
• Use efficient algorithms to enumerate and test all isotopy classes of semifields of order $2^4$ to generate diverse S-Boxes and APN functions.
• Evaluate all constructed functions using standard cryptographic criteria: nonlinearity, differential uniformity ($\delta$), algebraic degree, avalanche effect, and bit independence.

Experimental results

Research questions

• RQ1 Can semifield-based pseudo-extensions be used to generate S-Boxes with cryptographic properties matching or exceeding those of AES and Camellia?
• RQ2 To what extent can the inverse and cube functions in finite fields be emulated in semifield pseudo-extensions while preserving high nonlinearity and low differential uniformity?
• RQ3 How many distinct, non-equivalent S-Boxes and APN functions can be generated using this semifield pseudo-extension framework?
• RQ4 Do the generated S-Boxes and APN functions achieve optimal or near-optimal values for key criteria such as nonlinearity, differential uniformity, and avalanche effect?
• RQ5 Can this approach yield new, previously unknown APN functions, particularly those with perfect avalanche and bit independence scores?

Key findings

• The authors successfully generated 12,781 non-equivalent S-Boxes from semifield pseudo-extensions $\mathbb{S}^2_{2^4}$, all with maximal nonlinearity and differential invariants.
• Among the 12,781 S-Boxes, 120 achieved better cryptographic scores than both AES and Camellia S-Boxes in terms of nonlinearity and differential uniformity.
• The method produced 2,684 new Almost Perfect Nonlinear (APN) functions, with 336 of them exhibiting perfect avalanche and bit independence properties.
• The pseudo-inverse function over $\mathbb{S}^2_{2^4}$ effectively emulates the cryptographic behavior of the inverse in $\mathbb{F}_{2^8}$, enabling high-quality S-Box generation.
• The pseudo-cube function derived from semifield polynomial expansions successfully generates APN functions, demonstrating the viability of mimicking classical finite field functions in semifield settings.
• No S-Boxes with $ (\delta, \lambda) = (4, 16) $ were found in non-isomorphic semifields of order $ 256 $, except in the case isomorphic to $ \mathbb{F}_{2^8} $, highlighting the uniqueness of the finite field structure for such optimal parameters.