The non-linearity in the block cipher AES comes from the pseudo-inversion function on the finite field $\mathbb{F}_{2^8}$, defined by

$$ p(x) = \begin{cases} x^{-1} & \text{if $x \not=0$} \\ 0 & \text{if $x=0$.}\end{cases} $$

It is a nice exercise to show that $p$ is as strong as possible against the difference attack. That is, given any non-zero $\Delta \in \mathbb{F}_2^8$, the function $Dp_\Delta : \mathbb{F}_2^8 \rightarrow \mathbb{F}_2^8$ defined by

$$Dp_\Delta(x) = p(x) + p(x + \Delta) $$

takes $2^7-1$ different values, and is $2$ to $1$, except for an exceptional set of size $4$, namely $\{0,\Delta,\beta\Delta,(1+\beta)\Delta\}$ where $\beta$ is a solution to $\beta^2+\beta+1 = 0$, all of whose elements are sent to $\Delta^{-1}$. Not especially deep, but it's a nice application of the theory of quadratic equations in fields of characteristic two, so arguably number-theoretic. (Anyway I like it, because I discovered it for myself when asked to lecture undergraduate cryptography.)

The linear cryptanalysis of AES, by approximating the AES functions with $\mathbb{F}_2$-linear maps suggested by the Discrete Fourier Transform, seems to be somewhat trickier: see for instance this paper by Kenichi Sakamura, Wang Xiao Dong and Hirofumi Ishikawa.

The non-linearity in the block cipher AES comes from the pseudo-inversion function on the finite field $\mathbb{F}_{2^8}$, defined by

$$ p(x) = \begin{cases} x^{-1} & \text{if $x \not=0$} \\ 0 & \text{if $x=0$.}\end{cases} $$

It is a nice exercise to show that $p$ is as strong as possible against the difference attack. That is, given any non-zero $\Delta \in \mathbb{F}_{2^8}$, the function $Dp_\Delta : \mathbb{F}_{2^8} \rightarrow \mathbb{F}_{2^8}$ defined by

$$Dp_\Delta(x) = p(x) + p(x + \Delta) $$

takes $2^7-1$ different values, and is $2$ to $1$, except for an exceptional set of size $4$, namely $\{0,\Delta,\beta\Delta,(1+\beta)\Delta\}$ where $\beta$ is a solution to $\beta^2+\beta+1 = 0$, all of whose elements are sent to $\Delta^{-1}$. Not especially deep, but it's a nice application of the theory of quadratic equations in fields of characteristic two, so arguably number-theoretic. (Anyway I like it, because I discovered it for myself when asked to lecture undergraduate cryptography.)

The linear cryptanalysis of AES, by approximating the AES functions with $\mathbb{F}_2$-linear maps suggested by the Discrete Fourier Transform, seems to be somewhat trickier: see for instance this paper by Kenichi Sakamura, Wang Xiao Dong and Hirofumi Ishikawa.