Timeline for Number theory in symmetric cryptography
Current License: CC BY-SA 4.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 4, 2020 at 19:59 | comment | added | kodlu | @esg, I believe that's still open. I just did a quick search as a sanity check: it is stated as open in papers published in 2020. | |
| Oct 4, 2020 at 15:07 | comment | added | esg | 20 years ago (standardization of AES) the differential optimality of $x\mapsto x^{254}$ (your $p(x)$) on $\mathbb{F}_{2^8}$ was a still a conjecture. Is it now kown that differentially 2-uniform permutations of $\mathbb{F}_{2^8}$ do not exist? | |
| Oct 4, 2020 at 12:39 | comment | added | kodlu | Hi Mark, very nice discussion. It meant I didn't need to include this topic in my answer. | |
| S Oct 4, 2020 at 12:22 | history | suggested | wlad | CC BY-SA 4.0 |
underscored 2^8
|
| Oct 4, 2020 at 11:38 | comment | added | Mark Wildon | Thank you Felipe Voloch. In fact the derivative is $2$ to $1$ with no exceptional set: $dx^2 + d^2x + d^3 = e$ if and only if $y^2+y+1 = e/d^3$ where $y = x/d$, and the function $y \mapsto y^2+y+1$ is $2$ to $1$, with fibres $\{y,y+1\}$. So it's even better than pseudo-inversion: the image of the derivative has size $2^7$, not $2^7-1$, and this really is the maximum possible, since always $x$ and $x + d$ have the same image. Alas $x \mapsto x^3$ is not a drop-in replacement for $p$ in AES, because cubing is not injective on the finite field $\mathbb{F}_{2^8}$. | |
| Oct 4, 2020 at 8:38 | comment | added | wlad | Shouldn't that be $Dp_\Delta(x) = p(x + \Delta) - p(x)$? Oh yeah, characteristic 2 means they're equivalent | |
| Oct 4, 2020 at 8:35 | review | Suggested edits | |||
| S Oct 4, 2020 at 12:22 | |||||
| Oct 3, 2020 at 21:02 | comment | added | Mark Schultz-Wu | Incidentally, $x^3$ has recently been revisited as a source of non-linearity to design block ciphers (for use in the development of STARKS), in particular MiMC. The resistance to differential/linear cryptanalysis seems to be fairly simple to show (half a page on page 14), although there is a higher-order differential analytic attack over binary fields. | |
| Oct 3, 2020 at 19:35 | comment | added | Felipe Voloch | $x^3$ is a little simpler than $1/x$ (still in char $2$). $x^3 + (x+d)^3 = dx^2+d^2x+d^3$ is quadratic so at most $2$ to $1$. | |
| Oct 3, 2020 at 15:51 | comment | added | Mark Wildon | Incidentally, if anyone has any suggestions for an undergraduate-friendly non-linear function that has an extremely simple theory of either differential- or linear-cryptanalysis, please let me know, and it will be very welcome as I deliver the revamped course using 'active blended learning' this term. | |
| Oct 3, 2020 at 15:40 | history | answered | Mark Wildon | CC BY-SA 4.0 |