here - Sites personnels de TELECOM ParisTech - Télécom ParisTech

1.2. Families of Boolean functions with good cryptographic properties 111.1.5 Nonlinearity and bentnessThe last cryptographic criterion of interest in this thesis is that of nonlinearity and the relatednotion of bentness. Nonlinearity characterizes the distance between a Boolean function and theset of affine functions and is naturally defined using the Hamming distance.Definition 1.1.9 (Hamming distance). Let f and g be two Boolean functions in n variables.The Hamming distance between f and g, denoted by d H (f, g), is defined as# {x ∈ F n 2 | f(x) ≠ g(x)} .The distance can also be defined as d H (f, g) = w H (f + g) (where addition occurs in F 2 ).Definition 1.1.10 (Nonlinearity [38, 4.1.2]). Let f : F n 2 → F 2 be a Boolean function in nvariables. The nonlinearity of f, denoted by nl(f), is the minimum distance to affine functions(i.e. those of algebraic degree 0 or 1).It can be shown that the nonlinearity of a Boolean function in n variables is upper bounded by2 n−1 − 2 n/2−1 [38, 4.1.2]. High nonlinearity is important to prevent fast correlation attacks [191]and best affine approximation attacks [72].Boolean functions achieving maximal nonlinearity are called bent functions.Definition 1.1.11 (Bentness [70]). Let f : F n 2 → F 2 be a Boolean function in n variables. f issaid to be bent if it satisfies nl(f) = 2 n−1 − 2 n/2−1 .Obviously, bent functions only exist when n is even. Such functions can not be directly usedin the filter and combiner models; in particular, they are not balanced. They are however a veryimportant building block for many cryptographic systems and Chapter 3 will be devoted to theirstudy.1.2 Families of Boolean functions with good cryptographicproperties1.2.1 Trade-offs between the different criteriaBuilding a Boolean function meeting as many criteria as possible is a difficult task. Trade-offs mustusually be made between them. Since the introduction of algebraic immunity, several constructionsof Boolean functions with high algebraic immunity have been suggested, but very few of themare of optimal algebraic immunity. More importantly, those having other good cryptographicproperties, as balancedness or high nonlinearity for instance, are even rarer. Among those havingoptimal algebraic immunity AI(f) = ⌈n/2⌉, most have a poor nonlinearity [40, 64, 177, 178, 42],close to the lower bound of Lobanov [184]:( ) nnl(f) ≥ 2 n−1 −⌊ n 2 ⌋We now present different good families, i.e. meeting most of the criteria mentioned in Section 1.1in a satisfactory way..