Recovering or Testing Extended-Affine Equivalence

• Main Authors: Canteaut, A. (Author), Couvreur, A. (Author), Perrin, L. (Author)
• Format: Article
• Language: English
• Published: Institute of Electrical and Electronics Engineers Inc. 2022
• Subjects: affine equivalence; Affine equivalence; APN Function; Boolean functions; Complexity theory; Computational complexity; Cryptography; Equivalence classes; Equivalence relations; extended-affine equivalence; Extended-affine equivalence; Jacobian matrices; Partitioning algorithms; Quadratic function; quadratic functions; Random access memory; Random access storage; Recovery; Search problem; Search problems; Testing; Vectorial Boolean function
• Online Access: View Fulltext in Publisher

 Extended Affine (EA) equivalence is the equivalence relation between two vectorial Boolean functions F and G such that there exist two affine permutations A, B, and an affine function C satisfying G = A ∘ F ∘ B + C. While the problem has a simple formulation, it is very difficult in practice to test whether two functions are EA-equivalent. This problem has two variants: EA-partitioning deals with partitioning a set of functions into disjoint EA-equivalence classes, and EA-recovery is about recovering the tuple (A,B,C) if it exists. In this paper, we present a new algorithm that efficiently solves the EA-recovery problem for quadratic functions. Although its worst-case complexity occurs when dealing with APN functions, it supersedes, in terms of performance, all previously known algorithms for solving this problem for all quadratic functions and in any dimension, even in the case of APN functions. This approach is based on the Jacobian matrix of the functions, a tool whose study in this context can be of independent interest. The best approach for EA-partitioning in practice mainly relies on class invariants. We provide an overview of the known invariants along with a new one based on the ortho-derivative. This new invariant is applicable to quadratic APN functions, a specific type of functions that is of great interest, and of which tens of thousands need to be sorted into distinct EA-classes. Our ortho-derivative-based invariant is very fast to compute, and it practically always distinguishes between EA-inequivalent quadratic APN functions. IEEE