#### Abstract

Permutations with low differential uniformity, high algebraic degree, and high nonlinearity over can be used as the substitution boxes for many block ciphers. In this paper, several classes of low differential uniformity permutations are constructed based on the method of choosing two permutations over to get the desired permutations. The resulted low differential uniformity permutations have high algebraic degrees and nonlinearities simultaneously, which provide more choices for the substitution boxes. Moreover, some numerical examples are provided to show the efficacy of the theoretical results.

#### 1. Introduction

Suppose that be a positive even integer. We always denote by the finite field of even characteristic with degree and the multiplicative group of nonzero elements of . Every map from to itself is called an -function, and bijective -function is called a permutation over . It is well known that confusion introduced by Shannon [1] is one of the most generally accepted design principles for block ciphers and stream ciphers, which means making the relation between the ciphertext and the plaintext as complex as possible for the attacker. The substitution boxes (S-boxes) with good cryptographic properties are used to create confusion in block ciphers and often chosen to be permutations over . As pointed out in [2], since it needs to resist the differential attack on the block cipher algorithm, the differential uniformity of those permutations as S-boxes is required to be as low as possible. The permutations as S-boxes should also have high algebraic degree to resist the higher order differential attack and high nonlinearity to resist the linear attack (see, for instance, [3, 4]).

It is well known that the lowest differential uniformity of an -function over is not less than 2. Those -functions with differential uniformity 2 are called almost perfect nonlinear (APN) function, which has many interesting properties studied in the last decades (see, for instance, [5–7] and references). However, it is difficult to find APN permutations over the finite field for . Up to now, a few examples of APN permutations have been found over [8–10]. Naturally, people pay more attention to those permutations with differential uniformity 4 or 6 for S-boxes, and a lot of work has been done (see, for instance, [11–25]). Although low differential uniformity permutations are not an optimal choice of S-boxes, they are still an efficient way to against differential attacks. For example, the famous advanced encryption standard (AES) chooses differential 4-uniformity permutation as its S-box.

The original differential 4-uniformity permutations select Gold functions [12], the Kasami functions [13], the inverse functions [15], and the Bracken–Leander functions [11]. In 2012, Bracken et al. [26] constructed a class of binomials as differential 4-uniformity permutations with high nonlinearity. Inspired by the idea of Carlet [27], Li and Wang [28] obtained a construction of differential 4-uniformity permutations over from quadratic APN permutations over . The modern method to construct differential 4-uniformity permutation is the switching method proposed by Dillon. In recent years, the power of this method has been shown in the construction of differential 4-uniformity permutations. Qu et al. in [21] constructed differential 4-uniformity permutations by composing the inverse function and permutations over and, in [22], proved that the number of CCZ-inequivalent differential 4-uniformity permutations over increases exponentially. For more details, the readers can refer to [14, 19, 23–25, 29, 30].

Different from the above method, in [31, 32], some monomials with differential 6-uniformity over for are constructed and in the family of functions:

In 2014, Zha et al. [33] presented three classes of nonmonomial with differential 6-uniformity by modifying the image values of the Gold function. In recent years, more nonmonomial permutations of differential 6-uniformity are proposed. Tu et al. [34, 35] constructed several classes of differential 6-uniformity permutations by selecting the inverse function as a special type of rational functions over .

Inspired by the idea of [18], we construct some new low differential uniformity permutations. Compared with the previous similar works, our construction can provide a large number of CCZ-inequivalent classes of functions. Precisely, for any and some being a subset of with an odd integer , we prove that the permutationshave low differential uniformity 4 or 6. It is pointed out here that all of differentially 6-uniform permutations in our construction are CCZ-inequivalent to the existing ones, and it is surprising that there are two new differential 4-uniformity permutations for CCZ-inequivalent to the previous ones mentioned above. Moreover, all these functions have the optimal algebraic degree and we get a lower bound of the high nonlinearity of .

The rest of this paper is organized as follows. In the next section, we recall some definitions and general properties of the differential uniformity, algebraic degree, and nonlinearity of -functions. In Section 3, we present a new construction of low differential uniformity permutations and discuss the differential uniformity of these permutations over with odd. In Section 4, we consider their other cryptographic properties. Finally, Section 5 concludes the paper.

#### 2. Preliminaries

Let be a positive even integer and be an -function. We know that any -function can be uniquely represented as a univariate polynomial in :where , . Let , and . We say that is the binary expansion of if and is the 2-weight of . The algebraic degree of is defined as follows:

An -function is affine if . For any -permutation , it is known that . If this upper bound is achieved, then is said to have optimal algebraic degree.

For an -function and , denote by the number of solutions of the equation . We call the multisetthe differential spectrum of . The maximum value in the differential spectrum of is called the differential uniformity of and denoted by , and is called a differential -uniform function [15]. Observe that if is a solution of , then is also a solution of the equation, and then it follows that must be an even number greater than or equal to 2.

Let be a positive integer and a divisor of . The trace map from onto its subfield is defined by

In particular, for , is called the absolute trace map and denoted by simply.

For an -function , the Walsh transform of the function is defined as follows:

The multisets and are called Walsh spectrum and extended Walsh spectrum of , respectively. The nonlinearity of is defined as follows:

It is well known that when is odd. For the case even, is conjectured to be an upper bound of [36].

For two -functions and , if there exist two affine permutations and such that , then and are called affine equivalent; if there exists an affine function such that , then and are called extended affine (EA) equivalent. If the graphs of and are EA-equivalent, then they are said to be Carlet–Charpin–Zinoviev (CCZ) equivalent, where the graph of is . It is known that EA-equivalence implies CCZ-equivalence, and the converse is not always right. Moreover, CCZ-equivalence and EA-equivalence preserve the extended Walsh spectrum and the differential spectrum, and EA-equivalence also preserves the algebraic degree when it is greater than 2 [37, 38].

*Definition 1. *Let and be two permutations over . Given , if there exist some positive integer and some set of with such thatthen the -subset is called a -cycle set of the function related to the function and we denote by . Obviously, if and only if . All the -cycle sets for are also called cycle sets [18].

We still need some helpful lemmas. The following famous lemma reveals that the nonlinearity of the inverse function could achieve the upper bound of .

Lemma 1 (see [39]). *For any positive integer and any , the value ofcan take any integer divisible by 4 in the range .*

Lemma 2 (see [40]). *Let be a positive integer. For any with , the equationhas two solutions in if and only if .*

Lemma 3 (see [18]). *Let and be two permutations over . Then, the functionis a permutation over if and only if is a union of some cycle sets of related to .*

#### 3. Construction of Low Differential Uniformity Permutations

In this section, we always assume that is odd. For any , we select and and define aswhere is a disjoint union of the cycle set of related to .

Firstly, we find all the cycle sets of related to for , where is as defined in Definition 1. In what follows, we always write that is a primitive element in .

Lemma 4. *For any , the cycle set of related to can be expressed as follows:*(1)*If ,**(2)**If ,**(3)**If ,*

*Proof. *By similarity, we only give the details of (1) and (2).

We first prove (1). For , obviously, and . When , for any , we have . Therefore, the cycle set of related to is a 1-cycle set, i.e., . When , we let and conclude that by . It computes that directly. This shows that the cycle set of related to is a 2-cycle set and .

To show (2), we set . Since , we have and . When , by , we get . Then we also get . Therefore, the cycle set of related to is just a 2-cycle set and . In the case of , we calculate by and by . Furthermore, . It follows that the cycle set of related to is a 3-cycle set . Similarly, we obtain thateither or .

*Remark 1. *When , the cycle sets of related to are equivalent to Lemma 4 (3) since is a primitive element of if and only if is also a primitive element of .

Some properties of these cycle sets are listed as follows.

Lemma 5. *Let and be the same as in Lemma 4. Then*(a)* .*(b)

*For any , .*(c)

*For any , ; otherwise, .*

*Proof. *For (a), by similarity, we only prove it for . If , it is easy to check that . If , we haveAnd if or ,The proof of (b) is very simple and we omit the details.

To prove (c), we suppose that . Then there exists , which together with (b) implies . We complete the proof of Lemma 5.

*Remark 2. *There are 2-cycle sets of related to over , where . We can define the 2-cycle set as and easily get thatis closed under addition by .

To decompose , we still introduce the set aswhere is the same as in Lemma 4.

Fix . For any , each set is a subset of . Noticing that, for any and odd, is a positive divisor of , by Lemma 5 (c), could be decomposed into a total of such subsets.

*Example 1. *Let , and be the primitive element of . Then, andwhereIf , we setwhere every is the leading element of , . By Lemma 5, the sets , , have a nice structure which is stated in the following proposition. The details are omitted.

Proposition 1. *Let . Then is closed under addition by .*

Theorem 1. * is a permutation over if the following conditions hold:where is a subset of and the set has been defined in Remark 2.*

*Proof. *By the definition of , we know that all of is a union of some cycle sets of related to , which, associated with Lemma 3, implies Theorem 1 holds.

The next step is to study the differential uniformity of . For any and , the equation is equivalent to the following four equations on :As the statement of [18], the notations of roots and solutions have different meanings for those equations. For example, we say is a root of equation (26) if , and say is a solution of equation (26) if is a root of (26) with .

Lemma 6. *For the roots of equations (26)–(29), we have the following:*(a)*If x is a root of equation (26), then is a root of equation (27), and vice versa. Moreover, is also a root of equation (26).*(b)

*If*

*x*is a root of equation (28), then is a root of equation (29), and vice versa. Moreover, is also a root of equation (28).*Proof. *If is a root of equation (26), then we have , which is equivalent to the equation . This shows that is a root of equation (27). Obviously, is another root of equation (26) and is also a root of equation (27). It finishes the proof of (a) and the proof of (b) can be similarly proved.

We also consider the following equations:

*Remark 3. *Let . When , equations (26) and (27) are equivalent to the following two equations (30) and (31), respectively. When , equations (28) and (29) are equivalent to the following two equations (32) and (33), respectively.

If we denote by the set of all solutions of equations (30)∼(33), respectively, then we have the following results for the cardinals of , .

Lemma 7. (1)* or , and *(2)* or , and if and only if *

*Proof. *We only prove (1) by similarity. If , then there exists being the solution of equation (30). So is . Noting that equation (30) has at most two solutions for any pair , we have . Similarly, if , then . Now we prove that . Suppose that and . By Lemma 6 (1), we may write . However, the fact that and meet a contradiction by Proposition 1. Thus, .

Denoting by the sets of all solutions of equation (26)∼(29), .

When , it is obvious that the function in (13) is a differential 4-uniformity permutation over if . If , Zha et al. [24] proved in (13) is a differential 4-uniformity permutation over as a special case. Now, we only need to show that the differential uniformity of the permutation is as in (13) when .

Theorem 2. *Let and . If as in Theorem 1 satisfies that, for any , . Then, the functionis of differential 4-uniformity.*

*Proof. *By Theorem 1, it suffices to prove that has at most 4 solutions. It is equivalent to show that the sum of the numbers of solutions of equations (26) to (29) is less than 4.

Let . The fact that is of differential uniformity 4 implies that the total of the numbers of solutions of equations (26) and (27) is at most 4. Moreover, (28) and (29) have no solutions. Thus, in this case, is of differential 4-uniformity.

Now we prove that has at most 4 solutions for . To end this, we consider it to three cases:(1) and . From Lemma 7, it follows that which shows that has at most 4 solutions.(2). When , by the fact that , we know that is not a solution of equation (26). Neither is 0. The sum of the numbers of equations (26) and (27) is at most 2. Since , by Lemma 7 (2), the sum of the numbers of equations (28) and (29) is also at most 2. And hence, has at most 4 solutions. When , obviously, 0 and are the solutions of equation (26). In addition, since and , by Lemma 2, equation (30) has two solutions and , where that is a primitive element in . We have . By and Lemma 7 (1), we conclude that is empty. Moreover, we claim that equations (28) and (29) have no solutions. In fact, by Lemma 7, we only need to show that equation (31) or (32) has no solutions. If is a solution of equation (32), we get . However, which together with Lemma 2 implies that for any . It is a contradiction. Thus, has 4 solutions.(3). Similar to the statement of the proof of the case , we also obtain has at most 4 solutions.Together with the discussion of the above three cases, we know that is of differential 4-uniformity. Therefore, it finishes the proof of Theorem 1.

*Remark 4. *(1)Let , and be the primitive element of . If we choose , then satisfies all conditions of Theorem 2.(2)When and , Tang et al. [23] also obtained Theorem 2 and constructed 22 classes of CCZ-inequivalent differential 4-uniformity permutations. In this case, however, we find 27 classes of CCZ-inequivalent differential 4-uniformity permutations based on CCZ-invariant (see Table 1).

Theorem 3. *If and ,where , then the differential uniformity of the function is of 4 or 6.*

*Proof. *Since the proof of Theorem 3 is very similar to that of Theorem 2, we omit the details.

*Remark 5. *(1)The permutations constructed in Theorem 3 are of differential 4-uniformity for all of if satisfy one of the following three cases: (1) ; (2) ; and (3) .(2)The permutations are of differential 4-uniformity when (i.e., ), where has been defined above. In this case, the proof can refer to the case that in (13) with and , since is closed under addition by .(3)The permutations constructed in Theorem 3 are of differential 6-uniformity for all of ( is a proper subset of ) if satisfy one of the following two cases: (1) or and (2) or .(4)When or , the differential uniformity of the permutations depends on the choice of . For example, let and , constructed in Theorem 3 are differential 4-uniformity permutations over if or , where comes from Example 1 (see Table 2). Otherwise, constructed in Theorem 3 are differential 6-uniformity permutations over (see Table 3).

#### 4. Other Cryptographic Properties

In this section, we study the algebraic degree and nonlinearity of over . Moreover, we present some numerical results about the differential spectra, extend Walsh spectra, and nonlinearities of . We also discuss the CCZ-equivalence of constructed in Section 3.

##### 4.1. Algebraic Degree and Nonlinearity

The aim of this section is to prove that all functions we constructed have the optimal algebraic degree. For any given permutation over , the algebraic degree of is at most . As noticed in [23] that, for any -function (or -variable Boolean function) with , if has algebraic degree at most , one must have

It follows that the size of the set must be even from the fact that the algebraic degree of is at most . Hence, for a permutation over , if we can show that there exists some Boolean function with algebraic degree at most 1 such thatthen we can conclude that the algebraic degree of is at least .

Theorem 4. *Let be an odd integer. For any , as in (13) has the optimal algebraic degree .*

*Proof. *When , Zha et al. [24] proved Theorem 4 as a special case. Now we turn to prove it for . To end this, we only need to show that there exists some Boolean function with algebraic degree at most 1 such that.

Let . Taking , we know that it is of algebraic degree 1. By and , we havewhere is the same as in Theorem 1. For any , we have . Then and so .

Therefore,We complete the proof of Theorem 4.

Now we consider the nonlinearity of the functions and obtain the following lower bound.

Theorem 5. *Let be an odd integer. For any , the nonlinearity of satisfies , where is as in Theorem 1.*

*Proof. *By the definition of the Walsh transform of the function , we have, for any ,If , thenAnd if , thenLemma 1 tells us that . Therefore, , which, according to the definition of , implies that

##### 4.2. Numerical Result of CCZ-Inequivalence of

From the primary definition of CCZ-equivalence, it is difficult to check whether two -functions are CCZ-equivalent. An alternative method to solve this problem is to compare their CCZ-invariant parameters (such as differential spectrum and extended Walsh spectrum).

We compute the nonlinearity, the extended Walsh spectrum, and the differential spectrum of the constructed functions with different parameters. As we said in Remark 4, we find at least 27 classes of CCZ-inequivalent differential 4-uniformity functions which are listed in Table 1. And as we remarked in Remark 5 (4), there are 2 CCZ-inequivalent differential 4-uniformity classes of functions, which are listed in Table 2. Moreover, CCZ-invariant parameters of the newly differential 6-uniformity functions from Theorem 3 are also computed and listed in Table 3. In these tables, we denote by the nonlinearity of a function and the multiset the times of appearing in this multiset which is .

It is obvious that all of the functions in Table 2 are CCZ-inequivalent to those constructed in [11–13, 15, 26] since they have different nonlinearity. To compare our construction with that described in [14, 16–25], it is found that all of the functions in Table 2 are CCZ-inequivalent to them, since at least one of the extended Walsh spectrum and the differential spectrum is different. Moreover, in Table 3, all of the differential 6-uniformity permutations from Theorem 3 are CCZ-inequivalent to the previously constructed ones in [31–35] when .

#### 5. Conclusions

In this paper, we constructed several classes of low differential uniformity permutations over with odd. All these functions have the optimal algebraic degree, and we get a lower bound of the high nonlinearity of . Moreover, it has been checked by a computer program for that there are many new CCZ-inequivalent classes of differentially 4- and 6-uniform permutations in our construction. Precisely, all of the differential 6-uniformity permutations are CCZ-inequivalent with the known ones, and there are two new families of differential 4-uniformity permutations.

#### Data Availability

The data of this study are available from the corresponding author upon request.

#### Conflicts of Interest

The authors declare that they have no conflicts of interest regarding the publication of this paper.

#### Acknowledgments

This project was supported by the National Natural Science Foundation of China (Grant no. 71701076), Hubei Education Department Key Project (Grant no. D20181902), and Graduate Research Innovation Project of Hubei Normal University (Grant no. 20190108). Tao Xie was supported by the Youth Project of Hubei Province Education Department (Grant no. 2017149) and Doctoral Research Project of Hubei Normal University.